rabbitmq / credentials-obfuscation

Tiny library/OTP app for credential obfuscation
Other
14 stars 8 forks source link

Convert strings to binaries even if disabled or secret pending #17

Closed gomoripeti closed 2 years ago

gomoripeti commented 2 years ago

Proposed Changes

This way the type signature does not depend on the service state and is consistently: decrypt(encrypt(Data)) -> binary().

Some users like rabbit_shovel_parameters rely on this (https://github.com/rabbitmq/rabbitmq-server/blob/master/deps/rabbitmq_shovel/src/rabbit_shovel_parameters.erl#L447)

This should address crashes we've seen, when no secret was set yet and the shovel plugin crashed starting dynamic shovels. (Why there was no secret could be because of independent circumstances)

Alternatively it would be possible to support all terms unchanged (as since PR 15 encrypt_term is used under the hood). This would be a breaking change though.

Another alternative is to support unicode:chardata() instead of iodata() as input (but still always return binaries) which would more reflect the modern notion of a "string" - but probably more expensive to convert.

Types of Changes

What types of changes does your code introduce to this project? Put an x in the boxes that apply

Checklist

Put an x in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask on the mailing list. We're here to help! This is simply a reminder of what we are going to look for before merging your code.

Further Comments

If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution you did and what alternatives you considered, etc.