From 3c2caae9d1575b4e82a075fe536b477298842176 Mon Sep 17 00:00:00 2001 From: zHd4 <38856321+zHd4@users.noreply.github.com> Date: Wed, 15 Jul 2026 19:39:21 +0200 Subject: [PATCH 1/2] Add validation for new crypto secrets in SecretsUpdateService --- .../security/crypto/update/SecretsUpdateService.java | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/service/src/main/java/app/notesr/service/security/crypto/update/SecretsUpdateService.java b/service/src/main/java/app/notesr/service/security/crypto/update/SecretsUpdateService.java index f62885ae..eb523e63 100644 --- a/service/src/main/java/app/notesr/service/security/crypto/update/SecretsUpdateService.java +++ b/service/src/main/java/app/notesr/service/security/crypto/update/SecretsUpdateService.java @@ -55,6 +55,12 @@ public void updateSecrets( SecretsUpdateStateHolder stateHolder, CryptoSecrets newSecrets) { + try { + newSecrets.validate(); + } catch (IllegalStateException e) { + throw new SecretsUpdateFailedException("Invalid new secrets", e); + } + var currentSecrets = cryptoManager.getSecrets(); try (txFiles) { From 64e9e0a43d6cd6f03001fca606e38c78d6a6235f Mon Sep 17 00:00:00 2001 From: zHd4 <38856321+zHd4@users.noreply.github.com> Date: Wed, 15 Jul 2026 19:39:40 +0200 Subject: [PATCH 2/2] Add validation tests for new crypto secrets in SecretsUpdateService --- .../update/SecretsUpdateServiceTest.java | 79 ++++++++++++++++++- 1 file changed, 78 insertions(+), 1 deletion(-) diff --git a/service/src/test/java/app/notesr/service/security/crypto/update/SecretsUpdateServiceTest.java b/service/src/test/java/app/notesr/service/security/crypto/update/SecretsUpdateServiceTest.java index 8a4843ea..651d6243 100644 --- a/service/src/test/java/app/notesr/service/security/crypto/update/SecretsUpdateServiceTest.java +++ b/service/src/test/java/app/notesr/service/security/crypto/update/SecretsUpdateServiceTest.java @@ -366,11 +366,88 @@ void testSetStatusUpdatesStateHolderAndTriggersOnUpdate() { @Test void testGetStatusReturnsStatusFromStateHolder() { - stateHolder.setState(new SecretsUpdateState().setStatus(SecretsUpdateStatus.MOVING_BLOBS_DATA)); + stateHolder.setState(new SecretsUpdateState() + .setStatus(SecretsUpdateStatus.MOVING_BLOBS_DATA)); SecretsUpdateStatus status = secretsUpdateService.getStatus(stateHolder); assertEquals(SecretsUpdateStatus.MOVING_BLOBS_DATA, status, "Should return the correct status from the state holder"); } + + @Test + void testUpdateSecretsThrowsWhenNewSecretsKeyIsNull() { + CryptoSecrets newSecrets = new CryptoSecrets(null, password.clone()); + + assertThrows(SecretsUpdateFailedException.class, () -> secretsUpdateService.updateSecrets( + txFiles, cryptoManager, dbName, stateHolder, newSecrets), + "Should throw SecretsUpdateFailedException when new secrets key is null"); + } + + @Test + void testUpdateSecretsThrowsWhenNewSecretsKeyIsEmpty() { + CryptoSecrets newSecrets = new CryptoSecrets(new byte[0], password.clone()); + + assertThrows(SecretsUpdateFailedException.class, () -> secretsUpdateService.updateSecrets( + txFiles, cryptoManager, dbName, stateHolder, newSecrets), + "Should throw SecretsUpdateFailedException when new secrets key is empty"); + } + + @Test + void testUpdateSecretsThrowsWhenNewSecretsKeyWrongSize() { + byte[] wrongSizedKey = new byte[32]; // Wrong size, should be 48 + CryptoSecrets newSecrets = new CryptoSecrets(wrongSizedKey, password.clone()); + + assertThrows(SecretsUpdateFailedException.class, () -> secretsUpdateService.updateSecrets( + txFiles, cryptoManager, dbName, stateHolder, newSecrets), + "Should throw SecretsUpdateFailedException when new secrets key has wrong size"); + } + + @Test + void testUpdateSecretsThrowsWhenNewSecretsKeyIsAllZeros() { + byte[] nulledKey = new byte[KEY_SIZE]; // All zeros + CryptoSecrets newSecrets = new CryptoSecrets(nulledKey, password.clone()); + + assertThrows(SecretsUpdateFailedException.class, () -> secretsUpdateService.updateSecrets( + txFiles, cryptoManager, dbName, stateHolder, newSecrets), + "Should throw SecretsUpdateFailedException when new secrets key is all zeros"); + } + + @Test + void testUpdateSecretsThrowsWhenNewSecretsPasswordIsNull() { + CryptoSecrets newSecrets = new CryptoSecrets(newKey.clone(), null); + + assertThrows(SecretsUpdateFailedException.class, () -> secretsUpdateService.updateSecrets( + txFiles, cryptoManager, dbName, stateHolder, newSecrets), + "Should throw SecretsUpdateFailedException when new secrets password is null"); + } + + @Test + void testUpdateSecretsThrowsWhenNewSecretsPasswordIsEmpty() { + CryptoSecrets newSecrets = new CryptoSecrets(newKey.clone(), new char[0]); + + assertThrows(SecretsUpdateFailedException.class, () -> secretsUpdateService.updateSecrets( + txFiles, cryptoManager, dbName, stateHolder, newSecrets), + "Should throw SecretsUpdateFailedException when new secrets password is empty"); + } + + @Test + void testUpdateSecretsThrowsWhenNewSecretsPasswordTooShort() { + char[] shortPassword = "abc".toCharArray(); // Less than 4 characters + CryptoSecrets newSecrets = new CryptoSecrets(newKey.clone(), shortPassword); + + assertThrows(SecretsUpdateFailedException.class, () -> secretsUpdateService.updateSecrets( + txFiles, cryptoManager, dbName, stateHolder, newSecrets), + "Should throw SecretsUpdateFailedException when new secrets password is too short"); + } + + @Test + void testUpdateSecretsThrowsWhenNewSecretsPasswordIsAllZeros() { + char[] nulledPassword = new char[4]; // All '\0' characters + CryptoSecrets newSecrets = new CryptoSecrets(newKey.clone(), nulledPassword); + + assertThrows(SecretsUpdateFailedException.class, () -> secretsUpdateService.updateSecrets( + txFiles, cryptoManager, dbName, stateHolder, newSecrets), + "Should throw SecretsUpdateFailedException when new secrets password is all zeros"); + } }