0

我正在尝试将加密的 jsonb 字段添加到我在 rails 中的用户模型中。尝试读取或设置值时出现错误。

错误

irb(main):002:0> User.last.q2_email_address = "bob@bob.com"
  User Load (0.4ms)  SELECT "users".* FROM "users" ORDER BY "users"."id" DESC LIMIT $1  [["LIMIT", 1]]
  Encrypt Data Key (190.1ms)  Context: {:model_name=>"User", :model_id=>11}
/Users/antarr/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/encryptor-3.0.0/lib/encryptor.rb:61:in `crypt': must specify an iv (ArgumentError)

用户.rb

    has_kms_key eager_encrypt: :fetch_id
    attr_encrypted :settings, key: :kms_key, mashall: true
  
    store :settings,
          accessors: [:address1, :address2, :city, :customer_id, :customer_name, :customer_primary_cif, :social_security_number,
                      :email_address, :first_name, :group_desc, :group_id, :home_phone, :aba, :hq_session_id, :language, :last_name,
                      :login_name, :middle_name, :mobile_phone, :postal_code, :ssn, :state, :user_logon_id, :user_id, :user_primary_cif,
                      :work_phone, :ip_address, :token], coder: JSON, prefix: :q2

移民

  def up
    add_column :users, :encrypted_kms_key, :text
    add_column :users, :encrypted_settings, :jsonb, null: false, default: '{}'
    add_column :users, :encrypted_settings_iv, :string
    add_index :users, :encrypted_settings, using: :gin
  end

配置/初始化程序/aws.rb

Aws.config[:credentials] = Aws::Credentials.new(
  ENV['AMAZON_ACCESS_KEY'],
  ENV['AMAZON_SECRET_KEY']
)

宝石文件

gem 'attr_encrypted' # 3.1.0
gem 'aws-sdk-kms'
gem 'kms_encrypted'
4

1 回答 1

1

encryptgem中有2种方法attr_encrypted，一种是类方法，一种是实例方法，实例方法会自动生成random iv，而类方法不会，它使用iv你设置的。

调用的时候User.last.q2_email_address = "bob@bob.com"，这个方法会调用类方法encrypt，不会调用实例方法，所以如果不setup ，就会iv报错。must specify an iv (ArgumentError)

有两种方法可以解决，第一种是设置iv

attr_encrypted :settings, key: :kms_key, mashall: true, iv: SecureRandom.random_bytes(12)

不幸的是，将引发另一个错误（与 相关iv_len），我仍然没有找出根本原因并修复它。

第二种方式：将此方法复制到模型中，以便encrypt调用实例方法，iv生成一个随机数，它可以工作。

但是，在 的情况下store attributes，它不会保存encrypted attribute，例如

user = User.last
user.settings = {....}
user.save! # OK

user.q2_email_address = "bob@bob.com" 
user.settings # changed, but not re-encrypt `encrypted_settings`
user.save! # changed settings will not be saved

所以我想出了一个想法，我们可以创建一个模块支持store attributes如下

# model/concern/store_encrypted.rb
module StoreEncrypted
  def self.extended(base)
    base.class_eval do
     # initialize store attributes values with default `{}`
     # so that a new object or existed object that miss iv
     # will generate random iv
     def initialize(*args)
      super(*args)
      @@store_attr_encryptes.each do |attribute|
        instance_variable_get("@#{attribute}") || send("#{attribute}=", {})
      end
     end

      alias old_save! save!
      def save!(**options, &block)
        # re-set attribute (encrypt again)
        @@store_attr_encryptes&.each do |attribute|
          send("#{attribute}=", send("#{attribute}"))
        end
        old_save!(**options, &block)
      end
    end
  end

  def store_encrypted(attribute, options={})
    @@store_attr_encryptes ||= []
    @@store_attr_encryptes << attribute
    attr_encrypted attribute, key: options[:key], marshal: options[:marshal]
    store attribute, accessors: options[:accessors], coder: options[:coder], 
                      prefix: options[:prefix], suffix: options[:suffix]
    # copy
    define_method("#{attribute}=") do |value|
      send("encrypted_#{attribute}=", encrypt(attribute, value))
      instance_variable_set("@#{attribute}", value)
    end
  end
end

# user.rb
class User < ActiveRecord::Base
  extend StoreEncrypted
  has_kms_key eager_encrypt: :fetch_id
  store_encrypted :settings, key: :kms_key, mashall: true,
                  accessors: [...], coder: JSON, prefix: :q2
end

#
user = User.last
user.q2_email_address = "bob@bob.com" 
user.save! # it'll re-encrypt settings
于 2021-06-20T18:29:21.953 回答