Skip to content

Commit

Permalink
feat: first draft done
Browse files Browse the repository at this point in the history
  • Loading branch information
0x0elliot committed Sep 7, 2023
1 parent 831042a commit 23fa49a
Showing 1 changed file with 27 additions and 30 deletions.
57 changes: 27 additions & 30 deletions db-connector.go
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ var mc = gomemcache.New(memcached)
var maxCacheSize = 1020000

var phrase = os.Getenv("SHUFFLE_MEMCACHE_ENCRYPTION_PASSPHRASE")
var encryptionEnabled = len(phrase) > 0
var encryptionEnabled = len(phrase) > 0 && len(os.Getenv("SHUFFLE_ENCRYPTION_MODIFIER")) > 0

//var maxCacheSize = 2000000

Expand Down Expand Up @@ -507,28 +507,27 @@ func GetCache(ctx context.Context, name string) (interface{}, error) {
name = strings.Replace(name, " ", "_", -1)

if len(memcached) > 0 {

if (encryptionEnabled) {
// since we stored cache key as encrypted,
// we need to encrypt the name string to match
nameBytes := []byte(name)

newNameBytes, err := handleKeyEncryption(nameBytes, phrase)
if err != nil {
log.Printf("[ERROR] Failed encrypting cache key: %s. Proceeding with original string", err)
} else {
// convert back newNameBytes to string
name = string(newNameBytes)
}
}

item, err := mc.Get(name)

if err == gomemcache.ErrCacheMiss {
//log.Printf("[DEBUG] Cache miss for %s: %s", name, err)
} else if err != nil {
log.Printf("[DEBUG] Failed to find cache for key %s: %s", name, err)
} else {
//log.Printf("[INFO] Got new cache: %s", item)
if (encryptionEnabled) {
// we need to decrypt the value
data := item.Value

decryptedData, err := HandleKeyDecryption(data, phrase)
if err != nil {
log.Printf("[ERROR] Failed decrypting cache key: %s. Proceeding with original string", err)
} else {
// convert back newNameBytes to string
log.Printf("[DEBUG] Decrypting cache key %s", name)

Check failure

Code scanning / CodeQL

Log entries created from user input High

This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

Sensitive data returned by HTTP request headers
flows to a logging call.
item.Value = decryptedData
}
}

if len(item.Value) == maxCacheSize {
totalData := item.Value
Expand Down Expand Up @@ -631,20 +630,6 @@ func SetCache(ctx context.Context, name string, data []byte, expiration int32) e
// Maxsize ish~
name = strings.Replace(name, " ", "_", -1)

if (encryptionEnabled) {
// since we need to store cache key as encrypted,
// we need to encrypt the name string and store it like that
nameBytes := []byte(name)

newNameBytes, err := handleKeyEncryption(nameBytes, phrase)
if err != nil {
log.Printf("[ERROR] Failed encrypting cache key: %s. Proceeding with original string", err)
} else {
// convert back newNameBytes to string
name = string(newNameBytes)
}
}

// Splitting into multiple cache items
//if project.Environment == "cloud" || len(memcached) > 0 {
if len(memcached) > 0 {
Expand All @@ -653,6 +638,18 @@ func SetCache(ctx context.Context, name string, data []byte, expiration int32) e
return errors.New(fmt.Sprintf("Couldn't set cache for %s - too large: %d > %d", name, len(data), maxCacheSize*comparisonNumber))
}

if encryptionEnabled {
// we need to encrypt the value before storing it
encryptedData, err := handleKeyEncryption(data, phrase)
if err != nil {
log.Printf("[ERROR] Failed encrypting cache key: %s. Proceeding with original string", err)
} else {
// convert back newNameBytes to string
log.Printf("[DEBUG] Encrypted cache value for key %s", name)

Check failure

Code scanning / CodeQL

Log entries created from user input High

This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.
This log entry depends on a
user-provided value
.

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

Sensitive data returned by HTTP request headers
flows to a logging call.
data = encryptedData
}
}

loop := false
if len(data) > maxCacheSize {
loop = true
Expand Down

0 comments on commit 23fa49a

Please sign in to comment.