Skip to content

ConfigServerConfigDataLocationResolver still has reference to "spring-security-rsa" #1477

Open
@hviranicitco

Description

@hviranicitco

Describe the bug
As part of #1398 the dependency for "spring-security-rsa" was removed.

However, ConfigServerConfigDataLocationResolver class still refers to RsaSecretEncryptor from spring-security-rsa package.

   static final boolean RSA_IS_PRESENT = ClassUtils.isPresent("org.springframework.security.rsa.crypto.RsaSecretEncryptor", (ClassLoader)null);

Note that org.springframework.security.rsa.crypto.RsaSecretEncryptor is part of "spring-security-rsa". I think it should change to use org.springframework.security.crypto.encrypt.RsaSecretEncryptor which is from "spring-security-crypto"

The above bug causes, RSA_IS_PRESENT to be false and then fails to decrypt the secret from cloud-config server and causes NullPointerException since it goes to branch which uses EncryptorFactory instead of using TextEncryptorUtils

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions