You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@knox.apache.org by ha...@apache.org on 2026/05/05 13:45:38 UTC
(knox) branch master updated: KNOX-3314: Ensure secure length for encryptQueryString generated by descriptors (#1220)
This is an automated email from the ASF dual-hosted git repository.
hanicz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/knox.git
The following commit(s) were added to refs/heads/master by this push:
new 37fbbde37 KNOX-3314: Ensure secure length for encryptQueryString generated by descriptors (#1220)
37fbbde37 is described below
commit 37fbbde37763cf39a00ba63d4d55277c5e61c710
Author: hanicz <ha...@users.noreply.github.com>
AuthorDate: Tue May 5 15:45:31 2026 +0200
KNOX-3314: Ensure secure length for encryptQueryString generated by descriptors (#1220)
---
.../org/apache/knox/gateway/SimpleDescriptorHandlerFuncTest.java | 5 +++--
.../apache/knox/gateway/topology/simple/SimpleDescriptorHandler.java | 4 +++-
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/gateway-test/src/test/java/org/apache/knox/gateway/SimpleDescriptorHandlerFuncTest.java b/gateway-test/src/test/java/org/apache/knox/gateway/SimpleDescriptorHandlerFuncTest.java
index d0f5cd752..ca5a60502 100644
--- a/gateway-test/src/test/java/org/apache/knox/gateway/SimpleDescriptorHandlerFuncTest.java
+++ b/gateway-test/src/test/java/org/apache/knox/gateway/SimpleDescriptorHandlerFuncTest.java
@@ -47,6 +47,7 @@ import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
+import java.util.Locale;
import java.util.Map;
import static org.easymock.EasyMock.anyObject;
@@ -250,8 +251,8 @@ public class SimpleDescriptorHandlerFuncTest {
assertEquals("Unexpected cluster name for the alias (should be the topology name).",
testDescriptor.getName(), capturedCluster.getValue());
assertEquals("Unexpected alias name.", "encryptQueryString", capturedAlias.getValue());
- assertEquals("Unexpected alias value (should be master secret + topology name.",
- testMasterSecret + testDescriptor.getName(), capturedPwd.getValue());
+ assertEquals("Unexpected alias value.",
+ String.format(Locale.ROOT, SimpleDescriptorHandler.ENCRYPT_QUERY_STRING_TEMPLATE, testMasterSecret, testDescriptor.getName()), capturedPwd.getValue());
assertEquals(1, NoOpServiceDiscovery.discoveryCalled);
} catch (Exception e) {
diff --git a/gateway-topology-simple/src/main/java/org/apache/knox/gateway/topology/simple/SimpleDescriptorHandler.java b/gateway-topology-simple/src/main/java/org/apache/knox/gateway/topology/simple/SimpleDescriptorHandler.java
index b4fbe0182..b6bbc3270 100644
--- a/gateway-topology-simple/src/main/java/org/apache/knox/gateway/topology/simple/SimpleDescriptorHandler.java
+++ b/gateway-topology-simple/src/main/java/org/apache/knox/gateway/topology/simple/SimpleDescriptorHandler.java
@@ -99,6 +99,8 @@ public class SimpleDescriptorHandler {
"CLIENTID",
"HEALTH").collect(Collectors.toSet()));
+ public static final String ENCRYPT_QUERY_STRING_TEMPLATE = "knox:query-encryption:%s:%s";
+
public static Map<String, File> handle(GatewayConfig config, File desc, File destDirectory, Service...gatewayServices) throws IOException {
return handle(config, SimpleDescriptorFactory.parse(desc.getAbsolutePath()), desc.getParentFile(), destDirectory, gatewayServices);
}
@@ -312,7 +314,7 @@ public class SimpleDescriptorHandler {
AliasService aliasService = services.getService(ServiceType.ALIAS_SERVICE);
if (aliasService != null) {
// Derive and set the query param encryption password
- String queryEncryptionPass = new String(ms.getMasterSecret()) + topologyName;
+ String queryEncryptionPass = String.format(Locale.ROOT, ENCRYPT_QUERY_STRING_TEMPLATE, new String(ms.getMasterSecret()), topologyName);
aliasService.addAliasForCluster(topologyName, "encryptQueryString", queryEncryptionPass);
result = true;
}