feat: Improvements to the message decryption process (#23)

See GHSA-x5h4-9gqw-942j

Co-authored-by: Alex Chew <[email protected]>
Co-authored-by: Robin Salkeld <[email protected]>
Co-authored-by: Benjamin Farley <[email protected]>

Author: 4 people

buildspec.yml

@@ -7,67 +7,42 @@ batch:
       buildspec: codebuild/py27/integ.yml
     - identifier: py27_examples
       buildspec: codebuild/py27/examples.yml
-    - identifier: py27_awses_1_7_1
-      buildspec: codebuild/py27/awses_1.7.1.yml
-    - identifier: py27_awses_2_0_0
-      buildspec: codebuild/py27/awses_2.0.0.yml
-    - identifier: py27_awses_latest
-      buildspec: codebuild/py27/awses_latest.yml
+    - identifier: py27_awses_local
+      buildspec: codebuild/py27/awses_local.yml
 
     - identifier: py35_integ
       buildspec: codebuild/py35/integ.yml
     - identifier: py35_examples
       buildspec: codebuild/py35/examples.yml
-    - identifier: py35_awses_1_7_1
-      buildspec: codebuild/py35/awses_1.7.1.yml
-    - identifier: py35_awses_2_0_0
-      buildspec: codebuild/py35/awses_2.0.0.yml
-    - identifier: py35_awses_latest
-      buildspec: codebuild/py35/awses_latest.yml
+    - identifier: py35_awses_local
+      buildspec: codebuild/py35/awses_local.yml
 
     - identifier: py36_integ
       buildspec: codebuild/py36/integ.yml
     - identifier: py36_examples
       buildspec: codebuild/py36/examples.yml
-    - identifier: py36_awses_1_7_1
-      buildspec: codebuild/py36/awses_1.7.1.yml
-    - identifier: py36_awses_2_0_0
-      buildspec: codebuild/py36/awses_2.0.0.yml
-    - identifier: py36_awses_latest
-      buildspec: codebuild/py36/awses_latest.yml
+    - identifier: py36_awses_local
+      buildspec: codebuild/py36/awses_local.yml
 
     - identifier: py37_integ
       buildspec: codebuild/py37/integ.yml
     - identifier: py37_examples
       buildspec: codebuild/py37/examples.yml
-    - identifier: py37_awses_1_7_1
-      buildspec: codebuild/py37/awses_1.7.1.yml
-    - identifier: py37_awses_2_0_0
-      buildspec: codebuild/py37/awses_2.0.0.yml
-    - identifier: py37_awses_latest
-      buildspec: codebuild/py37/awses_latest.yml
+    - identifier: py37_awses_local
+      buildspec: codebuild/py37/awses_local.yml
 
     - identifier: py38_integ
       buildspec: codebuild/py38/integ.yml
     - identifier: py38_examples
       buildspec: codebuild/py38/examples.yml
-    - identifier: py38_awses_1_7_1
-      buildspec: codebuild/py38/awses_1.7.1.yml
-    - identifier: py38_awses_2_0_0
-      buildspec: codebuild/py38/awses_2.0.0.yml
-    - identifier: py38_awses_latest
-      buildspec: codebuild/py38/awses_latest.yml
+    - identifier: py38_awses_local
+      buildspec: codebuild/py38/awses_local.yml
 
     - identifier: py39_integ
       buildspec: codebuild/py39/integ.yml
     - identifier: py39_examples
       buildspec: codebuild/py39/examples.yml
-    - identifier: py39_awses_1_7_1
-      buildspec: codebuild/py39/awses_1.7.1.yml
-    - identifier: py39_awses_2_0_0
-      buildspec: codebuild/py39/awses_2.0.0.yml
     - identifier: py39_awses_latest
-      buildspec: codebuild/py39/awses_latest.yml
 
     - identifier: code_coverage
       buildspec: codebuild/coverage/coverage.yml

codebuild/py27/awses_latest.yml

@@ -2,7 +2,7 @@ version: 0.2
 
 env:
   variables:
-    TOXENV: "py27-awses_1.7.1"
+    TOXENV: "py27-awses_local"
     AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
       arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
     AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-

codebuild/py27/awses_1.7.1.yml renamed to codebuild/py27/awses_local.yml

@@ -2,7 +2,7 @@ version: 0.2
 
 env:
   variables:
-    TOXENV: "py35-awses_2.0.0"
+    TOXENV: "py35-awses_local"
     AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
       arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
     AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-

codebuild/py35/awses_1.7.1.yml

@@ -2,7 +2,7 @@ version: 0.2
 
 env:
   variables:
-    TOXENV: "py27-awses_2.0.0"
+    TOXENV: "py36-awses_local"
     AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
       arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
     AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-

codebuild/py35/awses_latest.yml

@@ -2,7 +2,7 @@ version: 0.2
 
 env:
   variables:
-    TOXENV: "py37-awses_2.0.0"
+    TOXENV: "py37-awses_local"
     AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
       arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
     AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-

codebuild/py35/awses_2.0.0.yml renamed to codebuild/py35/awses_local.yml

@@ -2,7 +2,7 @@ version: 0.2
 
 env:
   variables:
-    TOXENV: "py36-awses_2.0.0"
+    TOXENV: "py38-awses_local"
     AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID: >-
       arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f
     AWS_ENCRYPTION_SDK_PYTHON_INTEGRATION_TEST_AWS_KMS_KEY_ID_2: >-

codebuild/py36/awses_1.7.1.yml

@@ -103,18 +103,18 @@ def cycle_file(key_arn, source_plaintext_filename, botocore_session=None):
                 ciphertext.write(chunk)
 
     # Decrypt the ciphertext with only the AWS KMS master key
+    # Buffer the data in memory before writing to disk to ensure the signature is verified first.
     with open(ciphertext_filename, "rb") as ciphertext, open(cycled_kms_plaintext_filename, "wb") as plaintext:
         with client.stream(
             source=ciphertext, mode="d", key_provider=aws_encryption_sdk.StrictAwsKmsMasterKeyProvider(**kms_kwargs)
         ) as kms_decryptor:
-            for chunk in kms_decryptor:
-                plaintext.write(chunk)
+            plaintext.write(kms_decryptor.read())
 
     # Decrypt the ciphertext with only the static master key
+    # Buffer the data in memory before writing to disk to ensure the signature is verified first.
     with open(ciphertext_filename, "rb") as ciphertext, open(cycled_static_plaintext_filename, "wb") as plaintext:
         with client.stream(source=ciphertext, mode="d", key_provider=static_master_key_provider) as static_decryptor:
-            for chunk in static_decryptor:
-                plaintext.write(chunk)
+            plaintext.write(static_decryptor.read())
 
     # Verify that the "cycled" (encrypted, then decrypted) plaintext is identical to the source plaintext
     assert filecmp.cmp(source_plaintext_filename, cycled_kms_plaintext_filename)