I overlooked that KeyException is a subclass of `GeneralSecurityExc…

…eption`. This causes us to continue with `KeyException` which then fails the message matching test. As the underlying Tink code throws the GeneralSecurityException first, we check the type of the last exception.
corona-warn-app · Oct 19, 2020 · 76d89dc · 76d89dc
1 parent 47af324
commit 76d89dc
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 2 deletions.
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/security/EncryptionErrorResetTool.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/security/EncryptionErrorResetTool.kt
@@ -72,8 +72,8 @@ class EncryptionErrorResetTool @Inject constructor(
         }
         isResetWindowConsumed = true
 
-        val keyException = error.causes().singleOrNull { it is GeneralSecurityException }
-        if (keyException == null) {
+        val keyException = error.causes().lastOrNull()
+        if (keyException == null || keyException !is GeneralSecurityException) {
             Timber.v("Error has no GeneralSecurityException as cause -> no reset.")
             return false
         }

diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/security/EncryptionResetToolTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/security/EncryptionResetToolTest.kt
@@ -15,6 +15,7 @@ import testhelpers.BaseIOTest
 import testhelpers.preferences.MockSharedPreferences
 import java.io.File
 import java.security.GeneralSecurityException
+import java.security.KeyException
 import java.security.KeyStoreException
 
 class EncryptionResetToolTest : BaseIOTest() {
@@ -169,6 +170,33 @@ class EncryptionResetToolTest : BaseIOTest() {
         }
     }
 
+    @Test
+    fun `nested exception may have the same base exception type, GeneralSecurityException`() {
+        // https://github.com/corona-warn-app/cwa-app-android/issues/642#issuecomment-712188157
+        createMockFiles()
+
+        createInstance().tryResetIfNecessary(
+            CwaSecurityException(
+                KeyException( // subclass of GeneralSecurityException
+                    "Permantly failed to instantiate encrypted preferences",
+                    SecurityException(
+                        "Could not decrypt key. decryption failed",
+                        GeneralSecurityException("decryption failed")
+                    )
+                )
+            )
+        ) shouldBe true
+
+        encryptedPrefsFile.exists() shouldBe false
+        encryptedDatabaseFile.exists() shouldBe false
+
+        mockPreferences.dataMapPeek.apply {
+            this["ea1851.reset.performedAt"] shouldNotBe null
+            this["ea1851.reset.windowconsumed"] shouldBe true
+            this["ea1851.reset.shownotice"] shouldBe true
+        }
+    }
+
     @Test
     fun `we want only a specific type of GeneralSecurityException`() {
         createMockFiles()