-
Notifications
You must be signed in to change notification settings - Fork 12
fix: handle encryption and decryption errors instead of silently ignoring them #778
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #778 +/- ##
==========================================
- Coverage 39.67% 39.57% -0.10%
==========================================
Files 112 112
Lines 10657 10699 +42
==========================================
+ Hits 4228 4234 +6
- Misses 6047 6067 +20
- Partials 382 398 +16 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
amarnath-ac
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
rsdmike
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks good @DevipriyaS17 , however why did we get rid of the mocks in our unit tests : https://github.com/device-management-toolkit/console/pull/778/changes#diff-b056c32c8c660947e21a854ea331a396f34760eacc118bb765399e7f1588fb24R47 ? that seems like it would loosen the test expectation.
@rsdmike Thanks for the feedback! From my understanding, the previous test was setting up mock expectations but calling the real [redirector] instead, so the mock was never actually invoked. I've removed the unused mock and updated the test to call the real implementation directly. |
Summary
Properly handles errors from
Encrypt()andDecrypt()operations that were previously being silently ignored, preventing potential security issues where unencrypted passwords could be stored or used.Problem
Password encryption/decryption errors were silently ignored using
_in multiple locations throughout the codebase. This could lead to:To Reproduce the Issue
echo 'APP_ENCRYPTION_KEY=shortkey' > .env
Solution
Implemented proper error handling for all
Encrypt()andDecrypt()calls:Redirection.SetupWsmanClientnow returns errorAfter the Fix
Testing
go vet ./...- No issuesgolangci-lint run ./...- 0 issuesgo test ./...- All tests passing