From e502a9c5bc6435edbe7178762fb9a54ced905422 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20S=C3=A1nchez?= Date: Tue, 15 Sep 2026 13:43:17 -0600 Subject: [PATCH 1/3] fix[backend](modules-config): encrypt sensitive values before module config validation --- .../validators/UtmModuleConfigValidator.java | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/backend/src/main/java/com/park/utmstack/domain/application_modules/validators/UtmModuleConfigValidator.java b/backend/src/main/java/com/park/utmstack/domain/application_modules/validators/UtmModuleConfigValidator.java index e219a594c..10c89cbad 100644 --- a/backend/src/main/java/com/park/utmstack/domain/application_modules/validators/UtmModuleConfigValidator.java +++ b/backend/src/main/java/com/park/utmstack/domain/application_modules/validators/UtmModuleConfigValidator.java @@ -41,8 +41,9 @@ public boolean validate(UtmModule module, List keys UtmModuleGroupConfiguration override = findInKeys(keys, dbConf.getConfKey()); String value; if (override != null && !Constants.MASKED_VALUE.equals(override.getConfValue())) { - // User provided a new value — use it as plaintext - value = override.getConfValue(); + // User provided a new value — encrypt if sensitive so the plugin sees + // the same payload shape as the update flow (DB ciphertext). + value = encryptIfSensitive(override.getConfDataType(), override.getConfValue()); } else { // No override or masked value = dbConf.getConfValue(); @@ -58,7 +59,8 @@ public boolean validate(UtmModule module, List keys keys.stream() .filter(k -> !dbKeys.contains(k.getConfKey())) .filter(k -> !Constants.MASKED_VALUE.equals(k.getConfValue())) - .map(k -> new UtmModuleGroupConfDTO(k.getConfDataType(), k.getConfKey(), k.getConfValue())) + .map(k -> new UtmModuleGroupConfDTO(k.getConfDataType(), k.getConfKey(), + encryptIfSensitive(k.getConfDataType(), k.getConfValue()))) .forEach(configDTOs::add); UtmModuleGroupConfWrapperDTO body = new UtmModuleGroupConfWrapperDTO(configDTOs); @@ -66,6 +68,14 @@ public boolean validate(UtmModule module, List keys return utmStackConnectionService.validateModuleConfiguration(module.getModuleName().name(), body); } + private String encryptIfSensitive(String dataType, String value) { + if (value == null || value.isEmpty()) return value; + if (!Constants.CONF_TYPE_PASSWORD.equals(dataType) && !Constants.CONF_TYPE_FILE.equals(dataType)) { + return value; + } + return CipherUtil.encrypt(value, System.getenv(Constants.ENV_ENCRYPTION_KEY)); + } + private UtmModuleGroupConfiguration findInKeys(List keys, String confKey) { return keys.stream() .filter(k -> k.getConfKey().equals(confKey)) From ef0c79c65513079ec2c92f6dd0170305704f5695 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20S=C3=A1nchez?= Date: Tue, 15 Sep 2026 13:53:10 -0600 Subject: [PATCH 2/3] fix[plugins](modules-config): fail fast on decryption error --- plugins/modules-config/crypto/crypto.go | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/plugins/modules-config/crypto/crypto.go b/plugins/modules-config/crypto/crypto.go index d423762a4..d4ff7099b 100644 --- a/plugins/modules-config/crypto/crypto.go +++ b/plugins/modules-config/crypto/crypto.go @@ -21,7 +21,9 @@ func DecryptConfigurationSection(section *config.ConfigurationSection, key strin } for _, group := range section.ModuleGroups { - decryptGroupConfigurations(section.ModuleName, group, key) + if err := decryptGroupConfigurations(section.ModuleName, group, key); err != nil { + return err + } } return nil @@ -32,13 +34,12 @@ func DecryptModuleGroup(moduleName string, group *config.ModuleGroup, key string return nil } - decryptGroupConfigurations(moduleName, group, key) - return nil + return decryptGroupConfigurations(moduleName, group, key) } -func decryptGroupConfigurations(moduleName string, group *config.ModuleGroup, key string) { +func decryptGroupConfigurations(moduleName string, group *config.ModuleGroup, key string) error { if group == nil { - return + return nil } for _, cnf := range group.ModuleGroupConfigurations { @@ -48,18 +49,20 @@ func decryptGroupConfigurations(moduleName string, group *config.ModuleGroup, ke plain, err := safeAESDecrypt(cnf.ConfValue, key) if err != nil { - _ = catcher.Error("failed to decrypt configuration value", err, map[string]any{ + return catcher.Error("failed to decrypt configuration value", err, map[string]any{ "process": "plugin_com.utmstack.modules-config", "module": moduleName, "groupId": group.Id, "confKey": cnf.ConfKey, "confDataType": cnf.ConfDataType, + "cipherLen": len(cnf.ConfValue), }) - continue } cnf.ConfValue = plain } + + return nil } func safeAESDecrypt(cipherText, key string) (plain string, err error) { From 1c0bcd7ec9ecd40485321db37aef2fc75a4d6be9 Mon Sep 17 00:00:00 2001 From: Yadian Llada Lopez Date: Wed, 16 Sep 2026 09:03:31 -0400 Subject: [PATCH 3/3] fix(agent): revert version to 11.1.4 in version.json --- agent/version.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/agent/version.json b/agent/version.json index 8981e0f87..b60b61712 100644 --- a/agent/version.json +++ b/agent/version.json @@ -1,4 +1,4 @@ { - "version": "11.1.5", + "version": "11.1.4", "updater_version": "1.0.4" }