Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

decryptor: recover from SOPS store panic #691

Merged
merged 1 commit into from
Jul 13, 2022
Merged

decryptor: recover from SOPS store panic #691

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 11 additions & 2 deletions controllers/kustomization_decryptor.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ const (
// DecryptionProviderSOPS is the SOPS provider name.
DecryptionProviderSOPS = "sops"
// DecryptionPGPExt is the extension of the file containing an armored PGP
//key.
// key.
DecryptionPGPExt = ".asc"
// DecryptionAgeExt is the extension of the file containing an age key
// file.
Expand Down Expand Up @@ -263,7 +263,16 @@ func (d *KustomizeDecryptor) ImportKeys(ctx context.Context) error {
// for the input format, gathers the data key for it from the key service,
// and then decrypts the file data with the retrieved data key.
// It returns the decrypted bytes in the provided output format, or an error.
func (d *KustomizeDecryptor) SopsDecryptWithFormat(data []byte, inputFormat, outputFormat formats.Format) ([]byte, error) {
func (d *KustomizeDecryptor) SopsDecryptWithFormat(data []byte, inputFormat, outputFormat formats.Format) (_ []byte, err error) {
defer func() {
// It was discovered that malicious input and/or output instructions can
// make SOPS panic. Recover from this panic and return as an error.
if r := recover(); r != nil {
err = fmt.Errorf("failed to emit encrypted %s file as decrypted %s: %v",
sopsFormatToString[inputFormat], sopsFormatToString[outputFormat], r)
}
}()

store := common.StoreForFormat(inputFormat)

tree, err := store.LoadEncryptedFile(data)
Expand Down