search

paragonie / halite

High-level cryptography interface powered by libsodium
https://paragonie.com/project/halite
Mozilla Public License 2.0
1.13k stars 87 forks source link

Remove non-visible characters from key, that was read from file #160

Open taras-mrtn opened 3 years ago

taras-mrtn commented 3 years ago

There is an issue when a key file was generated by some tools or scripts, and some non-visible characters were inserted. This can be New line or Carriage return symbols, for example. It will be useful to filter such things since even not all text-editors can show that. I had an issue, when echo command inserted 0A byte at the end of the line.

To fix it, something like like this $string = preg_replace('/[\x00-\x1F\x7F]/u', '', $string);

should be inserted here https://github.com/paragonie/halite/blob/master/src/KeyFactory.php#L819

sstok commented 3 years ago

You shouldn't use anything else but the provided KeyFactory to generate a key file, this ensures the key-file Hex encoded.

Using anything else doesn't guarantee that Halite is able to process the key-file.

taras-mrtn commented 3 years ago

But in this case, how I should setup pipeline to deploy new version of my app, but use the key that was generated previously? Right now I store generated key in secrets storage, and put it in place right before application start. An at his moment I faced with this issue. What recommendations how to manage key in CICD processes? On 26 Mar 2021, 13:05 +0200, Sebastiaan Stok @.***>, wrote:

You shouldn't use anything else but the provided KeyFactory to generate a key file, this ensures the key-file Hex encoded. Using anything else doesn't guarantee that Halite is able to process the key-file. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe.