chore(tests): add security tests#174
Conversation
…python into kessplas/security-tests
| # 3. Decryption with mismatched context MUST fail | ||
| with pytest.raises((S3EncryptionClientError, Exception)): | ||
| s3ec.get_object(Bucket=bucket, Key=key, EncryptionContext={"project": "beta"}) | ||
|
|
There was a problem hiding this comment.
Issue: This check for beta is for the test below, not this test. This test should reject the message outright, without fudging the EC, at least according to the docstrings.
This assert should be on decrypting with legacy disabled.
There was a problem hiding this comment.
I'm partial to having both tests, I'll add another that tests that scenario.
| """Tampering x-amz-wrap-alg from 'kms+context' to 'kms' with wrong context. | ||
|
|
||
| The KmsV1 wrapping algorithm does not support encryption context. | ||
| The client MUST reject when a caller provides encryption context |
There was a problem hiding this comment.
| The client MUST reject when a caller provides encryption context | |
| The client MUST reject when a caller provides mismatched encryption context |
There was a problem hiding this comment.
done, I also added a test for when the EC matches, since that MUST fail as well.
| from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes | ||
| from cryptography.hazmat.primitives.padding import PKCS7 |
There was a problem hiding this comment.
Move these imports to at least the class level, if not the module level.
| not called in any production code path. | ||
| """ | ||
|
|
||
| def test_v2_keys_in_instruction_file_cause_format_confusion(self): |
There was a problem hiding this comment.
Issue: this test appears to assert that there is an vulnerability, as compared to asserting that the vulnerability is mitigated. I am not sure we should be testing that.
There was a problem hiding this comment.
The vulnerability is mitigated, the comment is wrong. I'll fix it.
2 participants
Issue #, if available: #167
Description of changes:
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.