Skip to content

Redact encryption master key from config validation error messages #239

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lgomezma merged 1 commit into from
Jun 4, 2026
Merged

Redact encryption master key from config validation error messages #239

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions lib/config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,10 +40,10 @@ function Config(options) {
throw new Error("encryptionMasterKey must be a string")
}
if (options.encryptionMasterKey.length !== 32) {
// Security: never include the key value in the error message — the key is a
// secret and error messages can propagate to logs, error trackers, or HTTP responses.
throw new Error(
"encryptionMasterKey must be 32 bytes long, but the string '" +
options.encryptionMasterKey +
"' is " +
"encryptionMasterKey must be 32 bytes long, but the provided key is " +
options.encryptionMasterKey.length +
" bytes long"
)
Expand All @@ -63,10 +63,10 @@ function Config(options) {

const decodedKey = Buffer.from(options.encryptionMasterKeyBase64, "base64")
if (decodedKey.length !== 32) {
// Security: never include the key value in the error message — the key is a
// secret and error messages can propagate to logs, error trackers, or HTTP responses.
throw new Error(
"encryptionMasterKeyBase64 must decode to 32 bytes, but the string " +
options.encryptionMasterKeyBase64 +
"' decodes to " +
"encryptionMasterKeyBase64 must decode to 32 bytes, but the provided key decodes to " +
decodedKey.length +
" bytes"
)
Expand Down