Comments (3)
Hi @tas50 I have worked on some part of this issue, My analysis is as below
-
Issue is reproducible while creating vault(adding values from command itself)
-
Got root cause, its happening beaause of JSON.parse() and its known issue.
e.g.irb(main):030:0> x = '{"username": "root", "password": "abc\abc"}'
=> "{"username": "root", "password": "abc\abc"}"irb(main):031:0> JSON.parse(x)
=> {"username"=>"root", "password"=>"abcabc"}irb(main):032:0> YAML.safe_load(x)
=> {"username"=>"root", "password"=>"abc\abc"} -
So tried to resolve particular scenario using YAML.safe_load() (as shown in point 2)
-
But again problem arises with the loading, this saved knife-vault item with format json, its showing some unicode characters like
{
"id": "root",
"username": "root",
"password": "abc\u0007bc"
}if we use format as yaml it showing correctly,
We used FFI_Yajl::Parser to fetch data from databag
@tas50 , Please share your thoughts so that we can proceed?
from chef-vault.
@sanga1794 you need to escape the backslash (more than you might think), because backslash is a special escape character.
in this example, it looks like there is a backslash in the password but that is actually \a
not \
and a
.
irb(main):030:0> x = '{"username": "root", "password": "abc\abc"}'
=> "{"username": "root", "password": "abc\abc"}"
To understand that visually, look at \n
:
irb(main):021:0> string = "\n\n\n"
irb(main):022:0> string
=> "\n\n\n"
irb(main):023:0> puts string
=> nil
The string "looks like" it has three backslashes in it, but those are escape characters, combined with n
that means newline, not the characters \
and n
.
In this example:
{
"id": "serverabc",
"agent_service_password": "blahblah\blah",
"database_service_password": "blahblah"
}
That should probably be this, to get one backslash:
{
"id": "serverabc",
"agent_service_password": "blahblah\\\\blah",
"database_service_password": "blahblah"
}
You can also see this work out by creating a hash in ruby with a properly escaped backslash (only has to be \\
in a ruby string, and you'll see that JSON.generate produces \\\\
:
irb(main):016:0> creds_hash = {"username"=>"root", "password"=>"abc\\abc"}
irb(main):017:0> creds_hash
=> {"username"=>"root", "password"=>"abc\\abc"}
irb(main):018:0> creds_json = JSON.generate(creds_hash)
irb(main):019:0> creds_json
=> "{\"username\":\"root\",\"password\":\"abc\\\\abc\"}"
irb(main):020:0> JSON.parse(creds_json)
=> {"username"=>"root", "password"=>"abc\\abc"}
If the JSON file is being created by hand, the user has to be aware of the requirement that any \
character is represented by \\\\
. We can't do much to fix that directly. We can 1) document it and 2) warn about it.
ChefConfig::PathHelper.printable?
may be useful here. You can see how we use it to warn a user that they may have the wrong number of escape characters in ChefConfig::PathHelper.validate_path
.
https://github.com/chef/chef/blob/master/chef-config/lib/chef-config/path_helper.rb
Maybe you could do the same thing in ChefVault::Mixin::Helper.values_from_json and have ChefVault::Log.warn
if the unparsed or parsed JSON contains non-printable characters (which is what something like \a would be). I'm not sure if parsed or unparsed is the right place to check yet. it would be easier to help the user if we checked the parsed json, because we could print the k and value that were the concern in the warning.
from chef-vault.
Here's further example:
irb(main):039:1* def self.printable?(string)
irb(main):040:2* if string =~ /[^[:print:]]/
irb(main):041:2* false
irb(main):042:2* else
irb(main):043:2* true
irb(main):044:1* end
irb(main):045:0> end
=> :printable?
irb(main):046:0> printable?("foo")
=> true
irb(main):047:0> printable?("abc\abc")
=> false
from chef-vault.
Related Issues (20)
- Different vault variable output HOT 1
- Handling race conditions when bootstrapping multiple nodes HOT 1
- rotate keys with --clean-unknown-clients also cleans known clients HOT 2
- Feature Request: Allow knife vault commands to be executed on .json files
- cucumber tests are failing on windows
- Syntax errors in vault_admins.rb HOT 1
- Does the latest version of the gem support autoscaling ?
- Impossible to store SSL/SSH private Key in vault HOT 9
- chef-vault command not returning any results HOT 3
- Can't create chef vault items in solo mode HOT 1
- Gemspec gives incorrect Ruby version being supported with "rescue in blocks" syntax being used HOT 2
- Faulty regex and usage of to_s triggers unwanted warning HOT 2
- "Item itemname_keys not found in data bag databagname", while I try to create a new vault with newer versions of Chef Workstation HOT 8
- knife vault doesn't support ssh_agent_signing HOT 3
- ERROR: ChefVault::Exceptions::SecretDecryption: is encrypted for you, but your private key failed to decrypt the contents. (if you regenerated your client key, have an administrator of the vault run 'knife vault refresh') HOT 3
- RSA paddings
- add support for client_key_contents HOT 1
- Do chef vault have any c# library to read the secret data
- No longer able to refresh when search_query is empty
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from chef-vault.