tree 7e18749a60eaf408c7a6437a6191e3293d342db0
parent 2cf21319cb457a1464aade9862c27ceb9173c1b6
author Antonio Barone <syntonyze@gmail.com> 1661364434 +0100
committer Antonio Barone <syntonyze@gmail.com> 1663865346 +0200

Encrypt oauth token at rest

The oauth token provided by Github is used together with the
`github_oauth` schema, to generate a new external identity for the
Gerrit user.

The external-id is then persisted on disk as a note under the
`refs/meta/external-ids` ref of the `All-Users.git` repo, as documented
in [1].

All credentials should be stored encrypted and protected at-rest, as the
token could be used to impersonate the user associated with it.

This vulnerability has been exploited in the past on other OAuth-based
integrations [2].

Avoid using plaintext oauth tokens for storing github external-ids by
encrypting them first.

[1] https://gerrit-documentation.storage.googleapis.com/Documentation/3.6.1/config-accounts.html#external-ids
[2] https://github.blog/2022-04-15-security-alert-stolen-oauth-user-tokens/

Bug: Issue 16192
Change-Id: I69c2add9170159ab8b9a31098cf35f184e678401