Merge pull request #43 from aws/sync-from-public

Author: robin-aws

.github/ISSUE_TEMPLATE/aws-encryption-sdk-issue.md

@@ -0,0 +1,26 @@
+---
+name: AWS Encryption SDK Issue
+about: AWS Encryption SDK Issue
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+### Security issue notifications
+
+If you discover a potential security issue in the AWS Encryption SDK we ask that you notify AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public GitHub issue.
+
+### Problem:
+
+A short description of what the problem is and why we need to fix it. Add reproduction steps if necessary.
+
+### Solution:
+
+A description of the possible solution in terms of Encryption SDK architecture.
+
+### Out of scope:
+
+Is there anything the solution will intentionally NOT address?
+
+[//]: #  (NOTE: If you believe this might be a security issue, please email aws-security@amazon.com instead of creating a GitHub issue. For more details, see the AWS Vulnerability Reporting Guide: https://aws.amazon.com/security/vulnerability-reporting/ )

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "src/test/resources/aws-encryption-sdk-test-vectors"]
+	path = src/test/resources/aws-encryption-sdk-test-vectors
+	url = https://github.com/awslabs/private-aws-encryption-sdk-test-vectors-staging.git

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 2.2.0 -- 2021-05-27
+
+* feat: Improvements to the message decryption process. 
+
+  See https://github.com/aws/aws-encryption-sdk-java/security/advisories/GHSA-55xh-53m6-936r
+
+
 ## 2.0.0 -- 2020-09-24
 
 * feat!: Updates to the AWS Encryption SDK. 4678ffa

README.md

@@ -56,7 +56,7 @@ You can get the latest release from Maven:
 <dependency>
   <groupId>com.amazonaws</groupId>
   <artifactId>aws-encryption-sdk-java</artifactId>
-  <version>2.0.0</version>
+  <version>2.2.0</version>
 </dependency>
 ```
 

codebuild/corretto11.yml

@@ -6,4 +6,4 @@ phases:
             java: corretto11
     build:
         commands:
-          - mvn install -Dgpg.skip=true '-DtestVectorZip=https://github.com/awslabs/aws-encryption-sdk-test-vectors/raw/master/vectors/awses-decrypt/python-1.3.8.zip'
+            - mvn install -Dgpg.skip=true "-DtestVectorZip=file://$CODEBUILD_SRC_DIR/src/test/resources/aws-encryption-sdk-test-vectors/vectors/awses-decrypt/python-2.2.0.zip"

codebuild/corretto8.yml

@@ -6,4 +6,4 @@ phases:
             java: corretto8
     build:
         commands:
-          - mvn install -Dgpg.skip=true '-DtestVectorZip=https://github.com/awslabs/aws-encryption-sdk-test-vectors/raw/master/vectors/awses-decrypt/python-1.3.8.zip'
+          - mvn install -Dgpg.skip=true "-DtestVectorZip=file://$CODEBUILD_SRC_DIR/src/test/resources/aws-encryption-sdk-test-vectors/vectors/awses-decrypt/python-2.2.0.zip"

codebuild/openjdk11.yml

@@ -6,4 +6,4 @@ phases:
             java: openjdk11
     build:
         commands:
-          - mvn install -Dgpg.skip=true '-DtestVectorZip=https://github.com/awslabs/aws-encryption-sdk-test-vectors/raw/master/vectors/awses-decrypt/python-1.3.8.zip'
+            - mvn install -Dgpg.skip=true "-DtestVectorZip=file://$CODEBUILD_SRC_DIR/src/test/resources/aws-encryption-sdk-test-vectors/vectors/awses-decrypt/python-2.2.0.zip"

codebuild/openjdk8.yml

@@ -6,4 +6,4 @@ phases:
             java: openjdk8
     build:
         commands:
-          - mvn install -Dgpg.skip=true '-DtestVectorZip=https://github.com/awslabs/aws-encryption-sdk-test-vectors/raw/master/vectors/awses-decrypt/python-1.3.8.zip'
+            - mvn install -Dgpg.skip=true "-DtestVectorZip=file://$CODEBUILD_SRC_DIR/src/test/resources/aws-encryption-sdk-test-vectors/vectors/awses-decrypt/python-2.2.0.zip"

pom.xml

@@ -4,7 +4,7 @@
 
     <groupId>com.amazonaws</groupId>
     <artifactId>aws-encryption-sdk-java</artifactId>
-    <version>2.0.0</version>
+    <version>2.2.0</version>
     <packaging>jar</packaging>
 
     <name>aws-encryption-sdk-java</name>
@@ -60,9 +60,9 @@
         </dependency>
 
         <dependency>
-            <groupId>junit</groupId>
-            <artifactId>junit</artifactId>
-            <version>4.13.1</version>
+            <groupId>org.junit.vintage</groupId>
+            <artifactId>junit-vintage-engine</artifactId>
+            <version>5.7.1</version>
             <scope>test</scope>
         </dependency>
 

src/examples/java/com/amazonaws/crypto/examples/EscrowedEncryptExample.java

@@ -3,6 +3,8 @@
 
 package com.amazonaws.crypto.examples;
 
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.security.GeneralSecurityException;
@@ -138,10 +140,16 @@ private static void standardDecrypt(final String kmsArn, final String fileName)
         // use an encryption context. For an example, see the other SDK samples.
         final FileInputStream in = new FileInputStream(fileName + ".encrypted");
         final FileOutputStream out = new FileOutputStream(fileName + ".decrypted");
-        final CryptoOutputStream<?> decryptingStream = crypto.createDecryptingStream(provider, out);
+        // Since we are using a signing algorithm suite, we avoid streaming decryption directly to the output file,
+        // to ensure that the trailing signature is verified before writing any untrusted plaintext to disk.
+        final ByteArrayOutputStream plaintextBuffer = new ByteArrayOutputStream();
+        final CryptoOutputStream<?> decryptingStream = crypto.createDecryptingStream(provider, plaintextBuffer);
         IOUtils.copy(in, decryptingStream);
         in.close();
         decryptingStream.close();
+        final ByteArrayInputStream plaintextReader = new ByteArrayInputStream(plaintextBuffer.toByteArray());
+        IOUtils.copy(plaintextReader, out);
+        out.close();
     }
 
     private static void escrowDecrypt(final String fileName) throws Exception {