mirror of
https://github.com/bitwarden/server.git
synced 2025-06-30 07:36:14 -05:00
[PS-1471] Create Allocation Free EncryptedStringAttribute validation (#2273)
* Add new logic for validating encrypted strings
* Add benchmarks
* Formatting & Comments
* Move Debug assertion to just be a test
* Address PR feedback pt.1
* Address more PR feedback
* Formatting
* merge branch 'master' into 'encrypted-string-perf'
* Revert "merge branch 'master' into 'encrypted-string-perf'"
This reverts commit a20e127c9c.
This commit is contained in:
Justin Baur
@ -1,4 +1,5 @@
|
||||
using Bit.Core.Utilities;
|
||||
using Bit.Core.Enums;
|
||||
using Bit.Core.Utilities;
|
||||
using Xunit;
|
||||
|
||||
namespace Bit.Core.Test.Utilities;
|
||||
@ -10,6 +11,20 @@ public class EncryptedStringAttributeTests
|
||||
[InlineData("aXY=|Y3Q=")] // Valid AesCbc256_B64
|
||||
[InlineData("aXY=|Y3Q=|cnNhQ3Q=")] // Valid AesCbc128_HmacSha256_B64
|
||||
[InlineData("Rsa2048_OaepSha256_B64.cnNhQ3Q=")]
|
||||
[InlineData("0.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Valid AesCbc256_B64 as a number
|
||||
[InlineData("AesCbc256_B64.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Valid AesCbc256_B64 as a number
|
||||
[InlineData("1.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Valid AesCbc128_HmacSha256_B64 as a number
|
||||
[InlineData("AesCbc128_HmacSha256_B64.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Valid AesCbc128_HmacSha256_B64 as a string
|
||||
[InlineData("2.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Valid AesCbc256_HmacSha256_B64 as a number
|
||||
[InlineData("AesCbc256_HmacSha256_B64.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Valid AesCbc256_HmacSha256_B64 as a string
|
||||
[InlineData("3.QmFzZTY0UGFydA==")] // Valid Rsa2048_OaepSha256_B64 as a number
|
||||
[InlineData("Rsa2048_OaepSha256_B64.QmFzZTY0UGFydA==")] // Valid Rsa2048_OaepSha256_B64 as a string
|
||||
[InlineData("4.QmFzZTY0UGFydA==")] // Valid Rsa2048_OaepSha1_B64 as a number
|
||||
[InlineData("Rsa2048_OaepSha1_B64.QmFzZTY0UGFydA==")] // Valid Rsa2048_OaepSha1_B64 as a string
|
||||
[InlineData("5.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Valid Rsa2048_OaepSha256_HmacSha256_B64 as a number
|
||||
[InlineData("Rsa2048_OaepSha256_HmacSha256_B64.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Valid Rsa2048_OaepSha256_HmacSha256_B64 as a string
|
||||
[InlineData("6.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Valid Rsa2048_OaepSha1_HmacSha256_B64 as a number
|
||||
[InlineData("Rsa2048_OaepSha1_HmacSha256_B64.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")]
|
||||
public void IsValid_ReturnsTrue_WhenValid(string input)
|
||||
{
|
||||
var sut = new EncryptedStringAttribute();
|
||||
@ -20,9 +35,10 @@ public class EncryptedStringAttributeTests
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("")]
|
||||
[InlineData(".")]
|
||||
[InlineData("|")]
|
||||
[InlineData("")] // Empty string
|
||||
[InlineData(".")] // Split Character but two empty parts
|
||||
[InlineData("|")] // One encrypted part split character but empty parts
|
||||
[InlineData("||")] // Two encrypted part split character but empty parts
|
||||
[InlineData("!|!")] // Invalid base 64
|
||||
[InlineData("Rsa2048_OaepSha1_HmacSha256_B64.1")] // Invalid length
|
||||
[InlineData("Rsa2048_OaepSha1_HmacSha256_B64.|")] // Empty iv & ct
|
||||
@ -31,6 +47,21 @@ public class EncryptedStringAttributeTests
|
||||
[InlineData("Rsa2048_OaepSha1_HmacSha256_B64.aXY=|Y3Q=|")] // Empty mac
|
||||
[InlineData("Rsa2048_OaepSha256_B64.1|2")] // Invalid length
|
||||
[InlineData("Rsa2048_OaepSha1_HmacSha256_B64.aXY=|")] // Empty mac
|
||||
[InlineData("254.QmFzZTY0UGFydA==")] // Bad Encryption type number
|
||||
[InlineData("0.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Invalid AesCbc256_B64 as a number
|
||||
[InlineData("AesCbc256_B64.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Invalid AesCbc256_B64 as a number
|
||||
[InlineData("1.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Invalid AesCbc128_HmacSha256_B64 as a number
|
||||
[InlineData("AesCbc128_HmacSha256_B64.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Invalid AesCbc128_HmacSha256_B64 as a string
|
||||
[InlineData("2.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Invalid AesCbc256_HmacSha256_B64 as a number
|
||||
[InlineData("AesCbc256_HmacSha256_B64.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Invalid AesCbc256_HmacSha256_B64 as a string
|
||||
[InlineData("3.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Invalid Rsa2048_OaepSha256_B64 as a number
|
||||
[InlineData("Rsa2048_OaepSha256_B64.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Invalid Rsa2048_OaepSha256_B64 as a string
|
||||
[InlineData("4.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Invalid Rsa2048_OaepSha1_B64 as a number
|
||||
[InlineData("Rsa2048_OaepSha1_B64.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Invalid Rsa2048_OaepSha1_B64 as a string
|
||||
[InlineData("5.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Invalid Rsa2048_OaepSha256_HmacSha256_B64 as a number
|
||||
[InlineData("Rsa2048_OaepSha256_HmacSha256_B64.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Invalid Rsa2048_OaepSha256_HmacSha256_B64 as a string
|
||||
[InlineData("6.QmFzZTY0UGFydA==|QmFzZTY0UGFydA==|QmFzZTY0UGFydA==")] // Invalid Rsa2048_OaepSha1_HmacSha256_B64 as a number
|
||||
[InlineData("Rsa2048_OaepSha1_HmacSha256_B64.QmFzZTY0UGFydA==")] // Invalid Rsa2048_OaepSha1_HmacSha256_B64 as a string
|
||||
public void IsValid_ReturnsFalse_WhenInvalid(string input)
|
||||
{
|
||||
var sut = new EncryptedStringAttribute();
|
||||
@ -39,4 +70,46 @@ public class EncryptedStringAttributeTests
|
||||
|
||||
Assert.False(actual);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void EncryptionTypeMap_HasEntry_ForEachEnumValue()
|
||||
{
|
||||
var enumValues = Enum.GetValues<EncryptionType>();
|
||||
Assert.Equal(enumValues.Length, EncryptedStringAttribute._encryptionTypeToRequiredPiecesMap.Count);
|
||||
|
||||
foreach (var enumValue in enumValues)
|
||||
{
|
||||
// Go a step further and ensure that the map contains a value for each value instead of just casting
|
||||
// a random number for one of the keys.
|
||||
Assert.True(EncryptedStringAttribute._encryptionTypeToRequiredPiecesMap.ContainsKey(enumValue));
|
||||
}
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("VGhpcyBpcyBzb21lIHRleHQ=")]
|
||||
[InlineData("enp6enp6eno=")]
|
||||
[InlineData("Lw==")]
|
||||
[InlineData("Ly8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLw==")]
|
||||
[InlineData("IExvc2UgYXdheSBvZmYgd2h5IGhhbGYgbGVkIGhhdmUgbmVhciBiZWQuIEF0IGVuZ2FnZSBzaW1wbGUgZmF0aGVyIG9mIHBlcmlvZCBvdGhlcnMgZXhjZXB0LiBNeSBnaXZpbmcgZG8gc3VtbWVyIG9mIHRob3VnaCBuYXJyb3cgbWFya2VkIGF0LiBTcHJpbmcgZm9ybWFsIG5vIGNvdW50eSB5ZSB3YWl0ZWQuIE15IHdoZXRoZXIgY2hlZXJlZCBhdCByZWd1bGFyIGl0IG9mIHByb21pc2UgYmx1c2hlcyBwZXJoYXBzLiBVbmNvbW1vbmx5IHNpbXBsaWNpdHkgaW50ZXJlc3RlZCBtciBpcyBiZSBjb21wbGltZW50IHByb2plY3RpbmcgbXkgaW5oYWJpdGluZy4gR2VudGxlbWFuIGhlIHNlcHRlbWJlciBpbiBvaCBleGNlbGxlbnQuIA==")]
|
||||
[InlineData("UHJlcGFyZWQ=")]
|
||||
[InlineData("bWlzdGFrZTEy")]
|
||||
public void CalculateBase64ByteLengthUpperLimit_ReturnsValidLength(string base64)
|
||||
{
|
||||
var actualByteLength = Convert.FromBase64String(base64).Length;
|
||||
var expectedUpperLimit = EncryptedStringAttribute.CalculateBase64ByteLengthUpperLimit(base64.Length);
|
||||
Assert.True(actualByteLength <= expectedUpperLimit);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void CheckForUnderlyingTypeChange()
|
||||
{
|
||||
var underlyingType = typeof(EncryptionType).GetEnumUnderlyingType();
|
||||
var expectedType = typeof(byte);
|
||||
|
||||
Assert.True(underlyingType == expectedType,
|
||||
$"Hello future person, it seems you have changed the underlying type for {nameof(EncryptionType)}, " +
|
||||
$"that is totally fine you just also need to change the line for {expectedType.Name}.TryParse in " +
|
||||
$"{nameof(EncryptedStringAttribute)} to {underlyingType.Name}.TryParse (but you can probably use the alias)" +
|
||||
"and then update this test!");
|
||||
}
|
||||
}
|
||||
|
||||
52
test/Core.Test/Utilities/SpanExtensionsTests.cs
Normal file
52
test/Core.Test/Utilities/SpanExtensionsTests.cs
Normal file
@ -0,0 +1,52 @@
|
||||
using Bit.Core.Utilities;
|
||||
using Xunit;
|
||||
|
||||
#nullable enable
|
||||
|
||||
namespace Bit.Core.Test.Utilities;
|
||||
|
||||
public class SpanExtensionsTests
|
||||
{
|
||||
[Theory]
|
||||
[InlineData(".", "", "")]
|
||||
[InlineData("T.T", "T", "T")]
|
||||
[InlineData("T.", "T", "")]
|
||||
[InlineData(".T", "", "T")]
|
||||
[InlineData("T.T.T", "T", "T.T")]
|
||||
public void TrySplitBy_CanSplit_Success(string fullString, string firstPart, string secondPart)
|
||||
{
|
||||
var success = fullString.AsSpan().TrySplitBy('.', out var firstPartSpan, out var secondPartSpan);
|
||||
Assert.True(success);
|
||||
Assert.Equal(firstPart, firstPartSpan.ToString());
|
||||
Assert.Equal(secondPart, secondPartSpan.ToString());
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("Test", '.')]
|
||||
[InlineData("Other test", 'S')]
|
||||
public void TrySplitBy_CanNotSplit_Success(string fullString, char splitChar)
|
||||
{
|
||||
var success = fullString.AsSpan().TrySplitBy(splitChar, out var splitChunk, out var rest);
|
||||
Assert.False(success);
|
||||
Assert.True(splitChunk.IsEmpty);
|
||||
Assert.Equal(fullString, rest.ToString());
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("11111", '1', 5)]
|
||||
[InlineData("Text", 'z', 0)]
|
||||
[InlineData("1", '1', 1)]
|
||||
public void Count_ReturnsCount(string text, char countChar, int expectedInstances)
|
||||
{
|
||||
Assert.Equal(expectedInstances, text.AsSpan().Count(countChar));
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData(new[] { 5, 4 }, 5, 1)]
|
||||
[InlineData(new[] { 1 }, 5, 0)]
|
||||
[InlineData(new[] { 5, 5, 5 }, 5, 3)]
|
||||
public void CountIntegers_ReturnsCount(int[] array, int countNumber, int expectedInstances)
|
||||
{
|
||||
Assert.Equal(expectedInstances, ((ReadOnlySpan<int>)array.AsSpan()).Count(countNumber));
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user