cossacklabs / acra

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
https://www.cossacklabs.com/acra/
Apache License 2.0
1.32k stars 128 forks source link

Apply type awareness actions on failure of hash validation #612

Closed Lagovas closed 1 year ago

Lagovas commented 1 year ago

I found that when acra-server validates searchable hash after decryption and it failed then it skips applying response_on_fail option and just returns as is. It's because our searchable encryptor decrypts data as first, marks the current context as successful decryption, and then validates hash which will fail. Due to the context was marked as successful, acra-server do nothing on encoding stage because it expects valid raw value instead of returning error or default value. In this PR were added marking context as NotDecrypted in case of failed hash validation and tests for that. Additionally found, that our encryptor_config validations denied searchable fields with type awareness (probably because searchable encryption was added after the first introduction of type awareness) and added missed masks.

Checklist