An End-to-End Distributed and Scalable Cloud KMS (Key Management System) built on top of Intel SGX enclave-based HSM (Hardware Security Module), aka eHSM.
The list_secrets API crashed with Server internal error, please contact the administrator. and code 500 when one of the description of the secrets is an empty string.
8a6738f1f1a 2811841 2023-10-17T07:00:54.630 ERROR [errors: line 399] - TypeError [ERR_INVALID_ARG_TYPE]: The first argument must be of type string or an instance of Buffer, ArrayBuffer, or Array or an Array-like Object. Received undefined
at new NodeError (node:internal/errors:399:5)
at new from (node:buffer:330:9)
at base64_decode (/workspaces/ehsm/ehsm_kms_service/function.js:34:39)
at listSecrets (/workspaces/ehsm/ehsm_kms_service/secret_manager_apis.js:539:41)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5) {
code: 'ERR_INVALID_ARG_TYPE'
Reproduction
Create a file inside ehsm/test with following python code:
Description
The
list_secrets
API crashed withServer internal error, please contact the administrator.
and code500
when one of the description of the secrets is an empty string.The full response:
The server log:
Reproduction
Create a file inside
ehsm/test
with following python code:Root Cause
According to the stack trace of ehsm server, this error is triggered by a function call to
base64_decode
inlistSecrets
function. (ehsm_kms_service/secret_manager_apis.js#L539https://github.com/intel/ehsm/blob/926fd308016119293ebc1231f8f284f46b5a8844/ehsm_kms_service/secret_manager_apis.js#L539
The
base64_decode
function crash when input string is empty.Possible Solution
Add custom handling to empty string for
base64_decode
function.