GH-119: Changed path environment variables to base64 value variables

Author: TiagoMMDavid

.github/workflows/ci.yaml

@@ -16,7 +16,7 @@ jobs:
         env:
           JDBC_CONNECTION_URL: jdbc:postgresql://localhost:5432/db?user=codegarten&password=changeit
           CODEGARTEN_TEST_DB_CONNECTION_STRING: jdbc:postgresql://localhost:5433/db?user=codegarten&password=changeit
-          CODEGARTEN_GITHUB_APP_PROPERTIES_PATH: secrets-example/github-app-properties.json
-          CODEGARTEN_GITHUB_APP_PRIVATE_KEY_PATH: secrets-example/gh-app-private-key.pem
-          CODEGARTEN_CIPHER_KEY_PATH: secrets-example/cipher-key.txt
+          CODEGARTEN_GITHUB_APP_PROPERTIES: ewogICAgIm5hbWUiOiAiR2l0SHViIEFwcCBOYW1lIiwKICAgICJpZCI6IDEyMzQsCiAgICAiY2xpZW50SWQiOiAiVGhlIENsaWVudCBJRCIsCiAgICAiY2xpZW50U2VjcmV0IjogIlRoZSBDbGllbnQgU2VjcmV0Igp9
+          CODEGARTEN_GITHUB_APP_PRIVATE_KEY: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlDWEFJQkFBS0JnUUNUSjJJTmU3UURCUkFoRHpFQ096c2Q5ZW9OR3VZd0l2NmNENENFbDdDcDVxTlBtNFBqClBRenQwemE3QTZuN04vVGZHZGJxcVlCWU43RzhDWXQ1VDQzbStEMW9mRmJaeC8wenROU3BkdkNEcGNSdHYzS0IKcjdlM2xOL0dGNkpQd3EyNlJZR0lTNFRwTFBJZkZBVFA4SUFpS3AraHVJMkt4S1MzK3psamdvM3Urd0lEQVFBQgpBb0dBZlVGQWpRbUdxQ3RmRjBTL0NvOHdPc2hmZU5nMHB6U2lWR1E5bUo4bG1QamdlWnArSUthT29zRHVEVEdKCk5uVGkwaVJFYzJuai9UTXE3a3VSbEtqS3QweUk1M29FSzNMbjBMV1dJQUh4cXFjNWg0ZGNmYWRmM2ZpRlhHbmkKSG0vKzU5U2JmTFBaajFCcUhtTFQ2ckpUWFptRkE1ck5TTTgyMzJDbFh1cW1rd0VDUVFER0V5ZXhGOVFSdXBhYwpaMGQ4NUttVFFFOW10NWQ5OERVS1g5WktPSDJPWjhuVzdOZEtrUytBTzlPQTl3L2RiRTcrTTBXcmJ3a05OTTlICnV1L1pzVlhyQWtFQXZqQUpETlhzcll0VFdkR01BMHBRKzFTNlRLdDQ2c0JBdjkxKzRHYVd3WTZodldOMEJzSzgKVHhaWGpwQnNZSG8zeUJNV0wrdEdnN1crWDR2UlBiVTNNUUpBRzFjTmhYNDZnVy8xMWdUVGMwUEV2RlNHSVRGNgpNYUgwVUVoR05keHlTRE8vUW5GU2pqSllFaVV2M244N3ExNkYwTVNXKzBES1NRNWZCaEdoaGJUYW5RSkJBSnE0CjhXUGoxVHdLRUxFTmJGNXc0eGpVZ1F0R3BJUTJDM2NMZHVDUUZTMDZJQkszQ2ZsR0MzUTd0TmRpWHdqTjVQdDcKcTUwb1JxRjRCWHd0ZnZnNHFNRUNRRGM2M1JZeVdndkVGZWFIRExVR1htMlFPa3Z1Q0kreEtpMWF0eHpnVnpXWgpmblhRR2NFZ3VwOGZzZXdhWld0Zy9xWnFUeDAxNklxbTRHcmE3d2gxOTNNPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQoKVGhlIGFib3ZlIGtleSBpcyBtZXJlbHkgYSBkdW1teSBrZXkuIFBsZWFzZSByZXBsYWNlIGl0IHdpdGggeW91ciBvd24u
+          CODEGARTEN_CIPHER_KEY: cipherkeywith16-24-32bytes
         run: code/jvm/gradlew -p code/jvm test

code/js/Dockerfile

@@ -8,8 +8,6 @@ COPY secrets ./secrets
 COPY ./dist ./dist
 COPY ./views ./views
 
-ENV CG_WEB_CIPHER_KEY_PATH=secrets/cipher-key.txt
-
 EXPOSE 80
 
 ENTRYPOINT [ "node", "./dist/index.js" ]

code/js/lib/user-control.ts

@@ -2,16 +2,14 @@
 
 import { NextFunction, Request, Response } from 'express'
 import { getAuthenticatedUser } from './repo/services/users'
-import { authRoutes } from './repo/api-routes'
 import { revokeAccessToken } from './repo/services/auth'
 import { Error } from './types/error-types'
 import * as crypto from 'crypto'
-import * as fs from 'fs'
 
 const ACCESS_TOKEN_VALIDITY_THRESHOLD = 1000 * 60 * 60 * 24 // 1 day
 const ACCESS_TOKEN_COOKIE = 'tok'
 
-const SECRET_KEY = fs.readFileSync(`${process.env.CG_WEB_CIPHER_KEY_PATH}`)
+const SECRET_KEY = getSecretKey()
 const CIPHER_ALGORITHM = 'aes-256-cbc'
 
 export = function(req: Request, res: Response, next: NextFunction): void {
@@ -91,3 +89,12 @@ function setAccessToken(res: Response, accessToken: AccessToken): void {
 function removeAccessToken(res: Response) {
     res.expireCookie(ACCESS_TOKEN_COOKIE)
 }
+
+function getSecretKey(): string {
+    const key = process.env.CG_WEB_CIPHER_KEY
+    if (!key || key.length != 32) {
+        throw Error('Invalid cipher key specified! The environment variable \'CG_WEB_CIPHER_KEY\' has to have exactly 32 characters.')
+    }
+
+    return key
+}

code/js/secrets-example/README.md

@@ -8,10 +8,6 @@ COPY ${DEPENDENCY}/META-INF ./server/META-INF
 COPY secrets ./secrets
 COPY ${DEPENDENCY}/BOOT-INF/classes ./server
 
-ENV CODEGARTEN_GITHUB_APP_PROPERTIES_PATH=secrets/github-app-properties.json
-ENV CODEGARTEN_GITHUB_APP_PRIVATE_KEY_PATH=secrets/gh-app-private-key.pem
-ENV CODEGARTEN_CIPHER_KEY_PATH=secrets/cipher-key.txt
-
 EXPOSE 8080
 
 ENTRYPOINT ["java", "-XX:+UseContainerSupport", "-Xmx256m", "-cp", "server:server/lib/*", "org.ionproject.codegarten.CodeGartenApplicationKt"]

code/js/secrets-example/cipher-key.txt

@@ -21,29 +21,40 @@ import org.springframework.context.annotation.Bean
 import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder
 import org.springframework.scheduling.annotation.EnableScheduling
 import org.springframework.stereotype.Component
+import org.springframework.util.Base64Utils
 import org.springframework.web.method.support.HandlerMethodArgumentResolver
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer
-import java.io.File
+import java.lang.IllegalArgumentException
+import java.lang.IllegalStateException
 import java.net.URI
 
 @ConfigurationPropertiesScan
 @EnableScheduling
 @SpringBootApplication
 class CodeGartenApplication(private val configProperties: ConfigProperties) {
 
-	private val cryptoUtils = CryptoUtils(System.getenv(configProperties.cipherKeyEnv)!!)
+	private val cryptoUtils: CryptoUtils
+
+	init {
+		val cipherKey = System.getenv(configProperties.cipherKeyEnv)
+			?: throw IllegalStateException("Missing ${configProperties.cipherKeyEnv} environment variable!")
+
+		cryptoUtils = CryptoUtils(cipherKey)
+	}
 
 	@Bean
 	fun getJdbi(): Jdbi {
 		val jdbcConnectionString = System.getenv(configProperties.dbJdbcConnectionStringEnv)
 		val connectionUrl = System.getenv(configProperties.dbUrlConnectionStringEnv)
+		if (jdbcConnectionString == null && connectionUrl == null)
+			throw IllegalStateException("Missing ${configProperties.dbJdbcConnectionStringEnv} or ${configProperties.dbUrlConnectionStringEnv} environment variable!")
 
 		val connectionString: String =
 			if (jdbcConnectionString != null)
 				jdbcConnectionString
 			else {
-				val dbUri = URI(connectionUrl!!)
+				val dbUri = URI(connectionUrl)
 
 				val username: String = dbUri.userInfo.split(":")[0]
 				val password: String = dbUri.userInfo.split(":")[1]
@@ -57,23 +68,36 @@ class CodeGartenApplication(private val configProperties: ConfigProperties) {
 
 	@Bean
 	fun getGithubInterface(): GitHubInterface {
-		val mapper: ObjectMapper = Jackson2ObjectMapperBuilder().build()
+		val ghAppPropertiesEnv = System.getenv(configProperties.gitHubAppPropertiesEnv)
+			?: throw IllegalStateException("Missing ${configProperties.gitHubAppPropertiesEnv} environment variable!")
+		val ghAppPrivateKeyEnv = System.getenv(configProperties.gitHubAppPrivateKeyEnv)
+			?: throw IllegalStateException("Missing ${configProperties.gitHubAppPrivateKeyEnv} environment variable!")
+
+		val ghAppPropertiesString = try {
+			Base64Utils.decodeFromString(ghAppPropertiesEnv)
+		} catch(ex: IllegalArgumentException) {
+			throw IllegalArgumentException("${configProperties.gitHubAppPropertiesEnv} environment variable is not a valid Base64 string!")
+		}
+
+		val ghAppPrivateKeyString = try {
+			String(Base64Utils.decodeFromString(ghAppPrivateKeyEnv))
+		} catch(ex: IllegalArgumentException) {
+			throw IllegalArgumentException("${configProperties.gitHubAppPrivateKeyEnv} environment variable is not a valid Base64 string!")
+		}
 
+		val mapper: ObjectMapper = Jackson2ObjectMapperBuilder().build()
 		val ghAppProperties = mapper.readValue(
-			File(System.getenv(configProperties.gitHubAppPropertiesPathEnv)!!),
+			ghAppPropertiesString,
 			GitHubAppProperties::class.java
 		)
 
 		return GitHubInterface(
 			ghAppProperties,
-			cryptoUtils.readRsaPrivateKey(
-				System.getenv(configProperties.gitHubAppPrivateKeyPemPath)!!
-			),
+			cryptoUtils.readRsaPrivateKey(ghAppPrivateKeyString),
 			mapper
 		)
 	}
 
-
 	@Bean
 	fun getCryptoUtils() = cryptoUtils
 }

code/jvm/Dockerfile

@@ -10,8 +10,8 @@ data class ConfigProperties(
     val dbJdbcConnectionStringEnv: String,
 
     // GitHub App Info
-    val gitHubAppPropertiesPathEnv: String,
-    val gitHubAppPrivateKeyPemPath: String,
+    val gitHubAppPropertiesEnv: String,
+    val gitHubAppPrivateKeyEnv: String,
 
     // Used to encrypt/decrypt access tokens and other sensitive information
     val cipherKeyEnv: String

code/jvm/src/main/kotlin/org/ionproject/codegarten/CodeGartenApplication.kt

@@ -3,8 +3,8 @@ package org.ionproject.codegarten.utils
 import org.bouncycastle.jce.provider.BouncyCastleProvider
 import org.bouncycastle.util.io.pem.PemReader
 import org.springframework.util.Base64Utils
-import java.io.File
 import java.io.FileReader
+import java.io.Reader
 import java.security.Key
 import java.security.KeyFactory
 import java.security.MessageDigest
@@ -29,7 +29,7 @@ data class CodeWrapper(
     val expirationDate: OffsetDateTime
 )
 
-class CryptoUtils(cipherKeyPath: String) {
+class CryptoUtils(cipherKey: String) {
 
     private val validChars: List<Char> = ('a'..'z') + ('A'..'Z') + ('0'..'9')
     private val digester = MessageDigest.getInstance("SHA-256")
@@ -38,21 +38,20 @@ class CryptoUtils(cipherKeyPath: String) {
     init {
         java.security.Security.addProvider(BouncyCastleProvider())
 
-        // Read cipher key file content into variable (adding padding if necessary)
-        val key = File(cipherKeyPath).readText()
+        // Add padding to cipher key if necessary
         var toAssign: ByteArray? = null
         for (range in KEY_LENGTH_RANGES) {
-            if (range.contains(key.length)) {
-                toAssign = String.format("%1$-" + range.last + "s", key).toByteArray()
+            if (range.contains(cipherKey.length)) {
+                toAssign = String.format("%1$-" + range.last + "s", cipherKey).toByteArray()
                 break
             }
         }
 
         if (toAssign == null) {
-            toAssign = key.substring(0, KEY_LENGTH_RANGES.last().last).toByteArray()
+            toAssign = cipherKey.substring(0, KEY_LENGTH_RANGES.last().last).toByteArray()
         }
 
-        cipherKey = toAssign
+        this.cipherKey = toAssign
     }
 
     fun generateAuthCode() = generateRandomCode(AUTH_CODE_LENGTH, OffsetDateTime.now().plusMinutes(1))
@@ -111,11 +110,12 @@ class CryptoUtils(cipherKeyPath: String) {
         return String(decryptedValue)
     }
 
-    fun readRsaPrivateKey(filePath: String): Key {
+    fun readRsaPrivateKey(privateKey: String): Key {
         val keyContent: ByteArray
-        FileReader(filePath).use {
+        privateKey.reader().use {
             keyContent = PemReader(it).readPemObject().content
         }
+
         val factory = KeyFactory.getInstance("RSA")
         val keySpec = PKCS8EncodedKeySpec(keyContent)
         return factory.generatePrivate(keySpec)

code/jvm/src/main/kotlin/org/ionproject/codegarten/ConfigProperties.kt

@@ -1,8 +1,8 @@
 cg-server.dbUrlConnectionStringEnv=DATABASE_URL
 cg-server.dbJdbcConnectionStringEnv=JDBC_DATABASE_URL
 
-cg-server.gitHubAppPropertiesPathEnv=CODEGARTEN_GITHUB_APP_PROPERTIES_PATH
-cg-server.gitHubAppPrivateKeyPemPath=CODEGARTEN_GITHUB_APP_PRIVATE_KEY_PATH
+cg-server.gitHubAppPropertiesEnv=CODEGARTEN_GITHUB_APP_PROPERTIES
+cg-server.gitHubAppPrivateKeyEnv=CODEGARTEN_GITHUB_APP_PRIVATE_KEY
 
-cg-server.cipherKeyEnv=CODEGARTEN_CIPHER_KEY_PATH
+cg-server.cipherKeyEnv=CODEGARTEN_CIPHER_KEY
 server.port=${port:8080}

code/jvm/src/main/kotlin/org/ionproject/codegarten/utils/CryptoUtils.kt

@@ -1,8 +1,8 @@
 cg-server.dbUrlConnectionStringEnv=DATABASE_URL
 cg-server.dbJdbcConnectionStringEnv=CODEGARTEN_TEST_DB_CONNECTION_STRING
 
-cg-server.gitHubAppPropertiesPathEnv=CODEGARTEN_GITHUB_APP_PROPERTIES_PATH
-cg-server.gitHubAppPrivateKeyPemPath=CODEGARTEN_GITHUB_APP_PRIVATE_KEY_PATH
+cg-server.gitHubAppPropertiesEnv=CODEGARTEN_GITHUB_APP_PROPERTIES
+cg-server.gitHubAppPrivateKeyEnv=CODEGARTEN_GITHUB_APP_PRIVATE_KEY
 
-cg-server.cipherKeyEnv=CODEGARTEN_CIPHER_KEY_PATH
+cg-server.cipherKeyEnv=CODEGARTEN_CIPHER_KEY
 server.port=${port:8080}