Chef Vault warns and leaks secrets when vault json contains properly encoded special characters

[decoyjoe]

Version:

• Affects latest version: v4.1.13
• Introduced in: v4.0.13 (Fixed problem escaping string in JSON by sanga1794 · Pull Request #347 · chef/chef-vault)
• Last good version: v4.0.12

Environment:

Any environment.

Scenario:

When a JSON file containing valid JSON with properly encoded special characters (like null bytes) is processed by Chef Vault, the system incorrectly flags these characters as non-printable. This results in unnecessary warnings and exposure of sensitive data in logs or console output.

Steps to Reproduce:

1. Create a valid JSON file named test.json:

   {
     "id": "test",
     "data": "secret_with_null->\u0000<-byte"
   }
   

2. Use this JSON file to create or update a vault:

   $ knife vault create chef-vault-415 test --mode client --json ./test.json

3. Output contains warning and exposes vault secret:

   WARN: Value 'secret_with_null-> <-byte' of key 'data' contains non-printable characters. Check that backslashes are escaped with another backslash (e.g. C:\Windows) in double-quoted strings.

Expected Result:

Chef Vault processes the vault item without warnings since the JSON is valid and the special characters are properly encoded.

Actual Result:

Chef Vault logs a warning indicating that the vault item contains non-printable characters and exposes the sensitive vault content.

Reccommendation

Chef Vault should be agnostic to the content of the vault item JSON. As long as the JSON is valid, which is the responsibility of the JSON parser, it should proceed with uploading the item to the server.