sidekiq-encrypted_args 2.0.0 → 2.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aed8d03eeb0b589556b436823f85c13331ab6c1703d732d425321b4cc1b2bc71
-  data.tar.gz: 2f2a42257c669731f97ee25cfc52da48a4cbdbe18b59e0fd84bcebbe50820e89
+  metadata.gz: 579403fba577dd83ce26ad13d8893ccdf86bc28883fff397fc029f265f0b7cd5
+  data.tar.gz: '08435986fca6664001ebb07dcd1b49a79a116b6cd78f26638a3c0a5d37e9c7b3'
 SHA512:
-  metadata.gz: cbdd4e2d8144eddf2e3699ac30ab52114de6ab8e09b97e75909e2e67defc81f5c4cd71e43efb22c404ac4890213abd6c300ee45117ae7e1428cf5b2b1794595c
-  data.tar.gz: 6644bca285087c5de5b2c68aba368f4192b2061f3f5f6095125d8ca7e16888b40214e2ce7b9a3c2a2ec39b808be6ccadefc7a1c7777c0bd3edecf1ef935f7a18
+  metadata.gz: 936274740450e2cbaf08f7f060df37f3a5a29e4aea47bc9985028403f2aca0f879f724167861e1b444f829b597682f2786dd2bf31f00b5ef5a26002ddda094d8
+  data.tar.gz: a59847233f9e50690fad84ed1cb071b204effe830f00bf738a08b2f7208211cd38d79e4b5504d1408c63dba930da4f87db31d0eb1d75c860b0dc1e2bc3bb53a9

data/CHANGE_LOG.md

@@ -4,6 +4,24 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 2.0.2
+
+### Changed
+
+- An `ArgumentError` is now raised when a named encrypted argument cannot be matched to a parameter of the worker's `perform` method or when the worker class name cannot be resolved to a class. Previously these arguments were silently left unencrypted.
+
+### Fixed
+
+- Setting the secret to an empty value (e.g. an empty array or empty string) no longer silently disables encryption. An `InvalidSecretError` is now raised when encrypting or decrypting if no secret is available.
+- The client middleware no longer mutates the caller's arguments array in place when encrypting arguments.
+- Lazily initializing the encryption keys from the `SIDEKIQ_ENCRYPTED_ARGS_SECRET` environment variable is now thread safe.
+
+## 2.0.1
+
+### Added
+
+- Added initializer helper methods `Sidekiq::EncryptedArgs.encrypt_before` and `Sidekiq::EncryptedArgs.encrypt_after` to allow specifying middleware order for inserting the client encryption middleware and `Sidekiq::EncryptedArgs.decrypt_before` and `Sidekiq::EncryptedArgs.decrypt_after` to allow specifying middleware order for inserting the server decryption middleware.
+
 ## 2.0.0
 
 ### Changed

data/README.md

@@ -51,6 +51,15 @@ Sidekiq.configure_server do |config|
 end
 ```
 
+If there is specific middleware you want to insert the encryption or decryption middleware before or after, you can use the following helper methods:
+
+```ruby
+Sidekiq::EncryptedArgs.encrypt_before(SomeOtherMiddlewareClass)
+Sidekiq::EncryptedArgs.encrypt_after(SomeOtherMiddlewareClass)
+Sidekiq::EncryptedArgs.decrypt_before(SomeOtherMiddlewareClass)
+Sidekiq::EncryptedArgs.decrypt_after(SomeOtherMiddlewareClass)
+```
+
 ## Worker Configuration
 
 To declare that a worker is using encrypted arguments, you must set the `encrypted_args` sidekiq option.

data/VERSION

@@ -1 +1 @@
-2.0.0
+2.0.2

data/lib/sidekiq/encrypted_args/client_middleware.rb

@@ -35,15 +35,19 @@ module Sidekiq
       #
       # Additionally, set `job["encrypted_args"]` to the canonicalized version (i.e. `Array<Integer>`)
       #
+      # The args array is replaced rather than mutated in place since the array
+      # can be the same object passed in by the caller of Sidekiq::Client.push.
+      #
       # @param [Hash] job The Sidekiq job hash containing arguments and metadata
       # @param [Array<Integer>] encrypted_args array of indexes in job to encrypt
       # @return [void]
       def encrypt_job_arguments!(job, encrypted_args)
         if encrypted_args
-          job_args = job["args"]
-          job_args.each_with_index do |value, position|
+          job["args"] = job["args"].map.with_index do |value, position|
             if encrypted_args.include?(position) && !EncryptedArgs.encrypted?(value)
-              job_args[position] = EncryptedArgs.encrypt(value)
+              EncryptedArgs.encrypt(value)
+            else
+              value
             end
           end
           job["encrypted_args"] = encrypted_args

data/lib/sidekiq/encrypted_args.rb

@@ -12,6 +12,7 @@ module Sidekiq
   # personally identifiable information.
   module EncryptedArgs
     @encryptors = nil
+    @mutex = Mutex.new
 
     # Error thrown when the secret is invalid
     class InvalidSecretError < StandardError
@@ -20,7 +21,8 @@ module Sidekiq
     class << self
       # Set the secret key used for encrypting arguments. If this is not set,
       # the value will be loaded from the `SIDEKIQ_ENCRYPTED_ARGS_SECRET` environment
-      # variable. If that value is not set, arguments will not be encrypted.
+      # variable. If that value is not set either, an InvalidSecretError will be
+      # raised when arguments are encrypted or decrypted.
       #
       # You can set multiple secrets by passing an array if you need to roll your secrets.
       # The left most value in the array will be used as the encryption secret, but
@@ -38,7 +40,9 @@ module Sidekiq
       # @param [String, Array<String>] value One or more secrets to use for encrypting arguments.
       # @return [void]
       def secret=(value)
-        @encryptors = make_encryptors(value).freeze
+        @mutex.synchronize do
+          @encryptors = make_encryptors(value).freeze
+        end
       end
 
       # Add the client and server middleware to the default Sidekiq
@@ -75,6 +79,66 @@ module Sidekiq
         end
       end
 
+      # Insert the client encryption middleware before the specified middleware.
+      #
+      # @param [Class] middleware The middleware class to insert before
+      # @return [void]
+      def encrypt_before(middleware)
+        Sidekiq.configure_client do |config|
+          config.client_middleware do |chain|
+            chain.insert_before(middleware, Sidekiq::EncryptedArgs::ClientMiddleware)
+          end
+        end
+
+        Sidekiq.configure_server do |config|
+          config.client_middleware do |chain|
+            chain.insert_before(middleware, Sidekiq::EncryptedArgs::ClientMiddleware)
+          end
+        end
+      end
+
+      # Insert the client encryption middleware after the specified middleware.
+      #
+      # @param [Class] middleware The middleware class to insert after
+      # @return [void]
+      def encrypt_after(middleware)
+        Sidekiq.configure_client do |config|
+          config.client_middleware do |chain|
+            chain.insert_after(middleware, Sidekiq::EncryptedArgs::ClientMiddleware)
+          end
+        end
+
+        Sidekiq.configure_server do |config|
+          config.client_middleware do |chain|
+            chain.insert_after(middleware, Sidekiq::EncryptedArgs::ClientMiddleware)
+          end
+        end
+      end
+
+      # Insert the server decryption middleware before the specified middleware.
+      #
+      # @param [Class] middleware The middleware class to insert before
+      # @return [void]
+      def decrypt_before(middleware)
+        Sidekiq.configure_server do |config|
+          config.server_middleware do |chain|
+            chain.insert_before(middleware, Sidekiq::EncryptedArgs::ServerMiddleware)
+          end
+        end
+      end
+
+      # Insert the server decryption middleware after the specified middleware.
+      #
+      # @param [Class] middleware The middleware class to insert after
+      # @return [void]
+      def decrypt_after(middleware)
+        Sidekiq.configure_server do |config|
+          config.server_middleware do |chain|
+            chain.insert_after(middleware, Sidekiq::EncryptedArgs::ServerMiddleware)
+          end
+        end
+      end
+
       # Encrypt a value.
       #
       # @example Encrypting a simple value
@@ -85,17 +149,12 @@ module Sidekiq
       #
       # @param [#to_json, Object] data Data to encrypt. You can pass any JSON compatible data types or structures.
       #
-      # @return [String]
+      # @return [String, nil]
       def encrypt(data)
         return nil if data.nil?
 
         json = (data.respond_to?(:to_json) ? data.to_json : JSON.generate(data))
-        encrypted = encrypt_string(json)
-        if encrypted == json
-          data
-        else
-          encrypted
-        end
+        encrypt_string(json)
       end
 
       # Decrypt data
@@ -143,15 +202,24 @@ module Sidekiq
           raise ArgumentError.new("Hash-based argument encryption is no longer supported.")
         else
           array_type = nil
-          Array(option).each_with_index do |val, position|
+          Array(option).each do |val|
             current_type = nil
             if val.is_a?(Integer)
               indexes << val
               current_type = :integer
             elsif val.is_a?(Symbol) || val.is_a?(String)
-              worker_class = constantize(worker_class) if worker_class.is_a?(String)
+              if worker_class.is_a?(String)
+                class_name = worker_class
+                worker_class = constantize(worker_class)
+                if worker_class.nil?
+                  raise ArgumentError.new("Cannot resolve worker class #{class_name.inspect} to look up named encrypted args; use integer positions instead.")
+                end
+              end
               position = perform_method_parameter_index(worker_class, val)
-              indexes << position if position
+              if position.nil?
+                raise ArgumentError.new("Encrypted arg #{val.inspect} is not a parameter of #{worker_class}#perform.")
+              end
+              indexes << position
               current_type = :symbol
             else
               raise ArgumentError.new("Encrypted args must be specified as integers or symbols.")
@@ -174,10 +242,7 @@ module Sidekiq
       private_constant :SALT
 
       def encrypt_string(value)
-        encryptor = encryptors.first
-        return value if encryptor.nil?
-
-        encryptor.encrypt(value)
+        encryptors.first.encrypt(value)
       end
 
       def decrypt_string(value)
@@ -192,15 +257,20 @@ module Sidekiq
       end
 
       def encryptors
-        if @encryptors.nil?
-          secret = ENV.fetch("SIDEKIQ_ENCRYPTED_ARGS_SECRET", "").strip
-          if secret.empty?
-            raise InvalidSecretError.new("Secret not set. Call Sidekiq::EncryptedArgs.secret= or set the SIDEKIQ_ENCRYPTED_ARGS_SECRET environment variable.")
-          end
+        current = @encryptors
+        return current unless current.nil?
+
+        @mutex.synchronize do
+          if @encryptors.nil?
+            secret = ENV.fetch("SIDEKIQ_ENCRYPTED_ARGS_SECRET", "").strip
+            if secret.empty?
+              raise InvalidSecretError.new("Secret not set. Call Sidekiq::EncryptedArgs.secret= or set the SIDEKIQ_ENCRYPTED_ARGS_SECRET environment variable.")
+            end
 
-          @encryptors = make_encryptors(secret.split).freeze
+            @encryptors = make_encryptors(secret.split).freeze
+          end
+          @encryptors
         end
-        @encryptors
       end
 
       # Create encryptors from secrets.
@@ -208,15 +278,16 @@ module Sidekiq
       # @param [String, Array<String>] secrets One or more secrets to create encryptors from
       # @return [Array<SecretKeys::Encryptor>, nil] Array of encryptors or nil if no secrets provided
       def make_encryptors(secrets)
-        return nil if secrets.nil?
+        secrets = Array(secrets).reject { |val| val.nil? || val.to_s.empty? }
+        return nil if secrets.empty?
 
-        Array(secrets).map { |val| SecretKeys::Encryptor.from_password(val, SALT) }
+        secrets.map { |val| SecretKeys::Encryptor.from_password(val, SALT) }
       end
 
       # Convert a string class name into the actual class constant.
       #
       # @param [String] class_name Name of a class (e.g., "MyModule::MyClass")
-      # @return [Class] The class constant that was referenced by name
+      # @return [Class, nil] The class constant that was referenced by name, or nil if it is not defined
       def constantize(class_name)
         names = class_name.split("::")
         # Clear leading :: for root namespace since we're already calling from object
@@ -224,6 +295,8 @@ module Sidekiq
         # Map reduce to the constant. Use inherit=false to not accidentally search
         # parent modules
         names.inject(Object) { |constant, name| constant.const_get(name, false) }
+      rescue NameError
+        nil
       end
 
       # Get the index of a parameter in the worker's perform method.
@@ -232,10 +305,17 @@ module Sidekiq
       # @param [String, Symbol] parameter The parameter name to find
       # @return [Integer, nil] The zero-based index of the parameter, or nil if not found
       def perform_method_parameter_index(worker_class, parameter)
-        if worker_class
-          parameter = parameter.to_sym
-          worker_class.instance_method(:perform).parameters.find_index { |_, name| name == parameter }
+        return nil unless worker_class
+
+        perform_method = begin
+          worker_class.instance_method(:perform)
+        rescue NameError
+          nil
         end
+        return nil if perform_method.nil?
+
+        parameter = parameter.to_sym
+        perform_method.parameters.find_index { |_, name| name == parameter }
       end
     end
   end

data/sidekiq-encrypted_args.gemspec

@@ -18,6 +18,7 @@ Gem::Specification.new do |spec|
   # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
   ignore_files = %w[
     .
+    benchmark.rb
     Appraisals
     Gemfile
     Gemfile.lock
@@ -38,6 +39,4 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency "sidekiq", ">= 6.3"
   spec.add_dependency "secret_keys"
-
-  spec.add_development_dependency "bundler"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sidekiq-encrypted_args
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.0.2
 platform: ruby
 authors:
 - Brian Durand
@@ -38,20 +38,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 email:
 - bbdurand@gmail.com
 - me@winstondurand.com