symmetric-encryption 4.1.2 → 4.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ada00eaa90ed1edb19723bfc1e0e34f3e6f8be5f060b6c2a79eaf046483f77b0
-  data.tar.gz: 0bf3ae34653d9598fc0a0be1058aa366f1e401b053bad92995ef08f00dc1fcbc
+  metadata.gz: '0081579e03f62e94a1bdb39ace0dc95339594e68e47e31dc16fe529f8ba7bb03'
+  data.tar.gz: 96d3b4546062000216f38ea2d09eabb386aebcc562caf7d4f325c67fc35d548b
 SHA512:
-  metadata.gz: 8299b773b5fbe49452187aeaa746343e9aff7c49a86f226142ae105a1aa9d1ad29401aa44297d19c6ae79161c2e8f0a9ad4f159e36c7191df5b36bb704367ef1
-  data.tar.gz: f9a37ecd2aa9c95eeb543e08be08de1a859bb1e0745241d9e983534e9b3df334bcc1486f6a46430ab2bfeaa5286a5902bffacaced9c9c0d53526cfe16d29b357
+  metadata.gz: 52bd12e37b92ab8805b3014db5715d7a247e77a068a086bfcfef9feda41caaf111bafa706e4ba9cbd7b8d1e4644ba955f0bd66a5649cad34794d4e00bd65cc47
+  data.tar.gz: 53e10160042b149bae4b55b7cde5815c4736ac10665133b5fd01b75d4b19c44a9210fb099e972651728daf4ee2468e8ca9dbf4545fef7b34b447ff00afaf9174

data/lib/symmetric_encryption/cli.rb

@@ -8,7 +8,7 @@ module SymmetricEncryption
                 :environments, :cipher_name, :rolling_deploy, :rotate_keys, :rotate_kek, :prompt, :show_version,
                 :cleanup_keys, :activate_key, :migrate, :regions
 
-    KEYSTORES = %i[heroku environment file].freeze
+    KEYSTORES = %i[aws heroku environment file].freeze
 
     def self.run!(argv)
       new(argv).run!
@@ -19,7 +19,7 @@ module SymmetricEncryption
       @environment      = ENV['SYMMETRIC_ENCRYPTION_ENV'] || ENV['RACK_ENV'] || ENV['RAILS_ENV'] || 'development'
       @config_file_path = File.expand_path(ENV['SYMMETRIC_ENCRYPTION_CONFIG'] || 'config/symmetric-encryption.yml')
       @app_name         = 'symmetric-encryption'
-      @key_path         = '~/.symmetric-encryption'
+      @key_path         = "#{ENV['HOME']}/.symmetric-encryption"
       @cipher_name      = 'aes-256-cbc'
       @rolling_deploy   = false
       @prompt           = false
@@ -292,7 +292,7 @@ module SymmetricEncryption
         require 'highline'
       rescue LoadError
         puts("\nPlease install gem highline before using the command line task to decrypt an entered string.\n   gem install \"highline\"\n\n")
-        exit -2
+        exit(-2)
       end
 
       encrypted = HighLine.new.ask('Enter the value to decrypt:')
@@ -307,7 +307,7 @@ module SymmetricEncryption
         require 'highline'
       rescue LoadError
         puts("\nPlease install gem highline before using the command line task to encrypt an entered string.\n   gem install \"highline\"\n\n")
-        exit -2
+        exit(-2)
       end
       value1 = nil
       value2 = 0

data/lib/symmetric_encryption/config.rb

@@ -36,6 +36,8 @@ module SymmetricEncryption
     # Write the entire configuration for all environments to the supplied file name.
     def self.write_file(file_name, config)
       config = deep_stringify_keys(config)
+
+      FileUtils.mkdir_p(file_name)
       File.open(file_name, 'w') do |f|
         f.puts '# This file was auto generated by symmetric-encryption.'
         f.puts '# Recommend using symmetric-encryption to make changes.'

data/lib/symmetric_encryption/keystore/file.rb

@@ -45,8 +45,11 @@ module SymmetricEncryption
 
       # Returns the Encryption key in the clear.
       def read
-        # TODO: Validate that file is not globally readable.
-        raise(SymmetricEncryption::ConfigError, "Symmetric Encryption key file: '#{file_name}' not found") unless ::File.exist?(file_name)
+        raise(SymmetricEncryption::ConfigError,
+              "Symmetric Encryption key file: '#{file_name}' not found") unless ::File.exists?(file_name)
+        raise(SymmetricEncryption::ConfigError,
+              "Symmetric Encryption key file '#{file_name}' has the wrong "\
+              "permissions: #{::File.stat(file_name).mode.to_s(8)}. Expected 100600.") unless correct_permissions?
 
         data = read_from_file
         key_encrypting_key ? key_encrypting_key.decrypt(data) : data
@@ -72,7 +75,16 @@ module SymmetricEncryption
         key_path = ::File.dirname(file_name)
         ::FileUtils.mkdir_p(key_path) unless ::File.directory?(key_path)
         ::File.rename(file_name, "#{file_name}.#{Time.now.to_i}") if ::File.exist?(file_name)
-        ::File.open(file_name, 'wb') { |file| file.write(data) }
+        ::File.open(file_name, 'wb', 0600) { |file| file.write(data) }
+      end
+
+      # Returns true if the file is owned by the user running this code and it
+      # has the correct mode - readable and writable by its owner and no one 
+      # else, much like the keys one has in ~/.ssh
+      def correct_permissions?
+        stat = ::File.stat(file_name)
+        
+        stat.owned? && stat.mode.to_s(8) == '100600'
       end
     end
   end

data/lib/symmetric_encryption/version.rb

@@ -1,3 +1,3 @@
 module SymmetricEncryption
-  VERSION = '4.1.2'.freeze
+  VERSION = '4.1.3'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: symmetric-encryption
 version: !ruby/object:Gem::Version
-  version: 4.1.2
+  version: 4.1.3
 platform: ruby
 authors:
 - Reid Morrison
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-11-11 00:00:00.000000000 Z
+date: 2019-02-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: coercible
@@ -84,8 +84,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.7
+rubygems_version: 3.0.2
 signing_key: 
 specification_version: 4
 summary: Encrypt ActiveRecord and Mongoid attributes, files and passwords in configuration