starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

[PR #2530] [CLOSED] Fix encoding of plaintext length indicator for secrets (fixes #2473) #12401

New Issue
Closed
opened 2025-12-29 22:21:18 +01:00 by adam · 0 comments
adam commented 2025-12-29 22:21:18 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/netbox-community/netbox/pull/2530
Author: @mwheckmann
Created: 10/19/2018
Status: ❌ Closed

Base: develop ← Head: develop

📝 Commits (2)

  • 11b85e5 Fix encoding of plaintext length indicator for secrets (fixes #2473)
  • 21b75fe Fix #2473: Switch to using a separate code path for py2 or py3

📊 Changes

2 files changed (+33 additions, -3 deletions)

View changed files

📝 netbox/secrets/models.py (+10 -3)
📝 netbox/secrets/tests/test_models.py (+23 -0)

📄 Description

Fixes: #2473

The encoding of the secret length indicator has likely been broken
since commit b21833f79c which introduced
Py3 support for secrets: the indicator was switched to using UTF-8 byte
strings and this caused the length indicator to consume 3 bytes instead
of just 2 under certain circumstances. For example when the plaintext
secret length is between 128 and 256 bytes long. This is because contrary
to latin-1 encoding, UTF-8 byte sting encoding consumes 2 bytes for
code points > 80. See the table at https://en.wikipedia.org/wiki/UTF-8#Description

The fix is to explicitely use 'latin-1' encoding for the length indicator.
This makes the code behave exactly as it did with the original Python2
implemenation while remaining compatible w/ Py3.

This fix does not alter the unpad/decode code path, only the code path which
encrypts new secrets. In other words, secrets that were stored in a broken state
will remain broken and what worked before will continue to work.

A test case which uses a 171 byte long plaintext string has also been added.
This test triggers the bug when the fix is not present.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/netbox-community/netbox/pull/2530 **Author:** [@mwheckmann](https://github.com/mwheckmann) **Created:** 10/19/2018 **Status:** ❌ Closed **Base:** `develop` ← **Head:** `develop` --- ### 📝 Commits (2) - [`11b85e5`](https://github.com/netbox-community/netbox/commit/11b85e52479b5870cfeaf0bf6f770e5b52149145) Fix encoding of plaintext length indicator for secrets (fixes #2473) - [`21b75fe`](https://github.com/netbox-community/netbox/commit/21b75fe4ddae289e9c6c82a7324c061bd9808d65) Fix #2473: Switch to using a separate code path for py2 or py3 ### 📊 Changes **2 files changed** (+33 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `netbox/secrets/models.py` (+10 -3) 📝 `netbox/secrets/tests/test_models.py` (+23 -0) </details> ### 📄 Description ### Fixes: #2473 The encoding of the secret length indicator has likely been broken since commit b21833f79c86bcdbc5a080703fd15f0e12cfa7a0 which introduced Py3 support for secrets: the indicator was switched to using UTF-8 byte strings and this caused the length indicator to consume 3 bytes instead of just 2 under certain circumstances. For example when the plaintext secret length is between 128 and 256 bytes long. This is because contrary to latin-1 encoding, UTF-8 byte sting encoding consumes 2 bytes for code points > 80. See the table at https://en.wikipedia.org/wiki/UTF-8#Description The fix is to explicitely use 'latin-1' encoding for the length indicator. This makes the code behave exactly as it did with the original Python2 implemenation while remaining compatible w/ Py3. This fix does not alter the unpad/decode code path, only the code path which encrypts new secrets. In other words, secrets that were stored in a broken state will remain broken and what worked before will continue to work. A test case which uses a 171 byte long plaintext string has also been added. This test triggers the bug when the fix is not present. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 22:21:18 +01:00
adam closed this issue 2025-12-29 22:21:19 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#12401
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?