Skip to content

Commit 69d403d

Browse files
committed
fix(core): be tolerant of decryption issue
If we cannot decrupt outputs, let's ignore the outpot and log a warning. This may only happen on configuratin mismatch between nodes.
1 parent f7d6493 commit 69d403d

File tree

2 files changed

+8
-4
lines changed

2 files changed

+8
-4
lines changed

Diff for: core/src/main/java/io/kestra/core/encryption/EncryptionService.java

+3-1
Original file line numberDiff line numberDiff line change
@@ -64,8 +64,10 @@ public static byte[] encrypt(String key, byte[] plainText) throws GeneralSecurit
6464
* The IV is recovered from the beginning of the string.
6565
*
6666
* @see #decrypt(String, byte[])
67+
* @throws IllegalArgumentException when the cipherText cannot be BASE64 decoded.
68+
* This may indicate that the cipherText was not encrypted at first so a caller may use this as an indication as it tries to decode a text that was not encoded.
6769
*/
68-
public static String decrypt(String key, String cipherText) throws GeneralSecurityException {
70+
public static String decrypt(String key, String cipherText) throws GeneralSecurityException, IllegalArgumentException {
6971
if (cipherText == null || cipherText.isEmpty()) {
7072
return cipherText;
7173
}

Diff for: core/src/main/java/io/kestra/core/runners/Secret.java

+5-3
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
import io.kestra.core.encryption.EncryptionService;
44
import io.kestra.core.models.tasks.common.EncryptedString;
5-
import jakarta.annotation.Nullable;
65
import org.slf4j.Logger;
76

87
import java.security.GeneralSecurityException;
@@ -50,8 +49,11 @@ Map<String, Object> decrypt(final Map<String, Object> data) {
5049
try {
5150
String decoded = decrypt((String) map.get("value"));
5251
decryptedMap.put(entry.getKey(), decoded);
53-
} catch (GeneralSecurityException e) {
54-
throw new RuntimeException(e);
52+
} catch (GeneralSecurityException | IllegalArgumentException e) {
53+
// NOTE: in rare cases, if for ex a Worker didn't have the encryption but an Executor has it,
54+
// we can have a non-encrypted output that we try to decrypt, this will lead to an IllegalArgumentException.
55+
// As it could break the executor, the best is to do nothing in this case and only log an error.
56+
logger.get().warn("Unable to decrypt the output", e);
5557
}
5658
} else {
5759
decryptedMap.put(entry.getKey(), decrypt((Map<String, Object>) map));

0 commit comments

Comments
 (0)