cossacklabs / acra

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
https://www.cossacklabs.com/acra/
Apache License 2.0
1.33k stars 128 forks source link

[ISSUE] Acra replaces null values by an empty string when using prepared statements #591

Closed Machado117 closed 1 year ago

Machado117 commented 1 year ago

Describe the bug When an INSERT is executed on a table using encryption, if the query explicitly sets a value to NULL, and is executed using a prepared statement, Acra replaces the NULL value by an empty string.

To Reproduce Steps to reproduce the behavior:

  1. Run the following java code:
    
    import java.sql.*;

public class AcraTest {

public static void main(String[] args) throws Exception {
    Class.forName("org.postgresql.Driver");
    String url = "jdbc:postgresql://localhost:9393/testdb";
    Connection conn = DriverManager.getConnection(url, "postgres", "postgres");
    final Statement statement = conn.createStatement();

    statement.execute("CREATE TABLE mytable (name bytea, age text)");

    // Execute INSERT directly
    statement.execute("INSERT INTO mytable (name, age) values ('John', NULL)");

    // Execute INSERT with a prepared statement
    PreparedStatement st = conn.prepareStatement("INSERT INTO mytable (name, age) values (?, ?)");
    st.setString(1, "Peter");
    st.setString(2, null);
    st.execute();
    st.close();

    // Check values inserted
    final ResultSet resultSet = statement.executeQuery("SELECT * FROM mytable");
    while (resultSet.next()) {
        System.out.println(String.format(
                "Name: %s | Age: %s | Null: %s",
                resultSet.getString("name"),
                resultSet.getString("age"),
                resultSet.getString("age") == null
        ));
    }
    conn.close();
}

}

Output:
Name: John | Age: null | Null: true
Name: Peter | Age:  | Null: false

**Expected behavior**
Acra should have the same behavior whether the INSERT is executed on a prepared statement or not and should not replace null values.

**Acra configuration files**
For AcraServer: 
    - [ ] `encryptor_config.yaml`

Environment:

Additional context Add any other context about the problem here.

Lagovas commented 1 year ago

@Machado117 nice catch, thank you for your instructions on how to reproduce it. We fixed it and it will be merged to master soon.

Lagovas commented 1 year ago

Oh, I accidentally closed it when merge PR that should fix it. Please, try now with a fresh state of the master branch and re-open if it didn't fix your problem.

Machado117 commented 1 year ago

It's fixed, thanks!