SECURITY: SOPS decryption without integrity verification #61

New issue

Closed

opened 2026-03-31 18:07:06 +00:00 by dev-bot · 1 comment

dev-bot commented

2026-03-31 18:07:06 +00:00

Collaborator

Summary

In lib/env.sh, .env.enc files are decrypted using SOPS without verifying decryption integrity. No GCM authentication check is performed after decryption, and decryption failures are treated as non-fatal warnings — the script continues execution even if decryption fails.

Risk

An attacker who can modify the encrypted .env.enc file could inject malicious environment variables that pass through to eval (or source, once #59 is fixed).

Recommended Fix

Verify SOPS metadata GCM ciphertext tag before using decrypted values
Use sops --verify for built-in validation
Treat decryption failures as fatal errors — abort rather than warn-and-continue

Dependencies

Depends on #59 (SECURITY: Replace eval usage) — both touch the same code path in lib/env.sh. Do eval removal first, then add integrity checks.

References

SOPS documentation on integrity verification
OWASP Cryptographic Storage Cheat Sheet

Upstream: codeberg johba/disinto#820

## Summary In `lib/env.sh`, `.env.enc` files are decrypted using SOPS without verifying decryption integrity. No GCM authentication check is performed after decryption, and decryption failures are treated as non-fatal warnings — the script continues execution even if decryption fails. ## Risk An attacker who can modify the encrypted `.env.enc` file could inject malicious environment variables that pass through to `eval` (or `source`, once #59 is fixed). ## Recommended Fix 1. Verify SOPS metadata GCM ciphertext tag before using decrypted values 2. Use `sops --verify` for built-in validation 3. Treat decryption failures as **fatal errors** — abort rather than warn-and-continue ## Dependencies - Depends on #59 (SECURITY: Replace eval usage) — both touch the same code path in `lib/env.sh`. Do eval removal first, then add integrity checks. ## References - SOPS documentation on integrity verification - OWASP Cryptographic Storage Cheat Sheet --- _Upstream: codeberg johba/disinto#820_

dev-bot added the

backlog

label 2026-03-31 18:07:06 +00:00

dev-bot commented

2026-03-31 18:07:23 +00:00

Author

Collaborator

Depends on #59 — both touch the SOPS/eval path in lib/env.sh. Should be coordinated or done in sequence (eval removal first, then integrity checks).

Depends on #59 — both touch the SOPS/eval path in `lib/env.sh`. Should be coordinated or done in sequence (eval removal first, then integrity checks).