Skip to content

Conversation

@nickvergessen
Copy link
Member

@nickvergessen nickvergessen commented Jan 25, 2024

Summary

Quite some app configs contain sensitive information that we could prevent to leak, when a backup of the DB is leaked, to reduce the risk of follow up leaks/hacks.
The state of the art is to use ICrypto::encrypt() and ICrypto::decrypt() for that. While looking into it for some of the talk configs which are arrays, I thought it's a shame that we would loose all the typing as we have to json_encode the config making it strings, in order to be able to encrypt them.

So why not just encrypt all sensitive configs all the time automatically?

TODO

  • Adjust normal getter and setter
  • Check getAllValues and getDetails

Checklist

@nickvergessen nickvergessen added this to the Nextcloud 29 milestone Jan 25, 2024
@nickvergessen nickvergessen self-assigned this Jan 25, 2024
@nickvergessen nickvergessen marked this pull request as draft January 25, 2024 13:35
@nickvergessen nickvergessen changed the base branch from master to enh/noid/improve-index-on-appconfig January 25, 2024 13:35
Base automatically changed from enh/noid/improve-index-on-appconfig to master January 26, 2024 10:53
@nickvergessen nickvergessen force-pushed the bugfix/noid/automatically-encrypt-sensitive-values branch from 2ef454d to 6d20fd0 Compare January 26, 2024 21:05
@nickvergessen nickvergessen force-pushed the bugfix/noid/automatically-encrypt-sensitive-values branch from 6d20fd0 to 24607a3 Compare March 6, 2024 21:27
@nickvergessen nickvergessen force-pushed the bugfix/noid/automatically-encrypt-sensitive-values branch from e77d9e4 to 3a67080 Compare March 6, 2024 21:59
@nickvergessen nickvergessen marked this pull request as ready for review March 6, 2024 21:59
@nickvergessen nickvergessen requested review from artonge and come-nc March 6, 2024 22:00
@nickvergessen nickvergessen mentioned this pull request Mar 6, 2024
@nickvergessen nickvergessen merged commit 718c845 into master Mar 7, 2024
@nickvergessen nickvergessen deleted the bugfix/noid/automatically-encrypt-sensitive-values branch March 7, 2024 08:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3. to review Waiting for reviews enhancement

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants