barbican secrets API doesn't validate bit length

[Steve Heyman]

Submitter Provided Data:

Found in: dev
Severity: Low
Description: secrets API doesn't enforce bit length restrictions
Reproduction Steps:

Create a secret with bit length of zero, or a bit length that is not
a multiple of 8. Should reject these values, but it currently accepts them.

  POST http://localhost:9311/v1/{{tenant_id}}/secrets with:

  {
  "name": "AES key",
  "algorithm": "aes",
  "bit_length": 0,
  "mode": "cbc",
  "payload": "bababooey",
  "payload_content_type": "text/plain"
  }

Same test with bit_length set to 7 gives the same result (201) when it should fail with 400.

Test Cases: Failing:
test_negative_creating_secret_w_bit_length_not_multiple_of_8
test_negative_creating_secret_w_bit_length_zero

Expected Behaviour: Should fail with HTTP 400
Actual Behavior: Succeds with HTTP 201 and secret is created in the database.

[Steve Heyman (sheyman)]

While other parameter values for secrets API aren't (or can't) be validated at secret creation time, this one can. The wiki indicates that the value, if used, must be a positive integer. In addition, the validation code for orders requires that a secret bit length must be a multiple of 8. That validation code isn't used on the secret create API path so these values are currently passed through to the database as-is.

[Steve Heyman (sheyman)]

Wiki has been updated to indicate that we do NOT validate for Secrets API but we DO validate for Orders API. Issue has been resolved.

[John Vrbanac (john.vrbanac)]

It was determined during the review that the zero case is not an issue. Outside of that, the remainder of this issue is fixed and released for M2.