fix: Decode secret fix on add update oss (#5695)

* ValidateEncodedDataByDecoding in case add or update secret

* wire fix from main

* minor refactor

* comment

Author: prakash100198

cmd/external-app/wire_gen.go

@@ -34,7 +34,9 @@ import (
 	util2 "github.com/devtron-labs/devtron/util"
 	"github.com/go-pg/pg"
 	"go.uber.org/zap"
+	"net/http"
 	"regexp"
+	"strconv"
 	"time"
 )
 
@@ -504,12 +506,19 @@ func (impl ConfigMapServiceImpl) CSGlobalAddUpdate(configMapRequest *bean.Config
 		return nil, fmt.Errorf("invalid request multiple config found for add or update")
 	}
 	configData := configMapRequest.ConfigData[0]
+	// validating config/secret data at service layer since this func is consumed in multiple flows, hence preventing code duplication
 	valid, err := impl.validateConfigData(configData)
 	if err != nil && !valid {
 		impl.logger.Errorw("error in validating", "error", err)
 		return configMapRequest, err
 	}
 
+	valid, err = impl.validateConfigDataForSecretsOnly(configData)
+	if err != nil && !valid {
+		impl.logger.Errorw("error in validating secrets only data", "error", err)
+		return configMapRequest, err
+	}
+
 	valid, err = impl.validateExternalSecretChartCompatibility(configMapRequest.AppId, configMapRequest.EnvironmentId, configData)
 	if err != nil && !valid {
 		impl.logger.Errorw("error in validating", "error", err)
@@ -704,11 +713,17 @@ func (impl ConfigMapServiceImpl) CSEnvironmentAddUpdate(configMapRequest *bean.C
 	}
 
 	configData := configMapRequest.ConfigData[0]
+	// validating config/secret data at service layer since this func is consumed in multiple flows, hence preventing code duplication
 	valid, err := impl.validateConfigData(configData)
 	if err != nil && !valid {
 		impl.logger.Errorw("error in validating", "error", err)
 		return configMapRequest, err
 	}
+	valid, err = impl.validateConfigDataForSecretsOnly(configData)
+	if err != nil && !valid {
+		impl.logger.Errorw("error in validating secrets only data", "error", err)
+		return configMapRequest, err
+	}
 
 	valid, err = impl.validateExternalSecretChartCompatibility(configMapRequest.AppId, configMapRequest.EnvironmentId, configData)
 	if err != nil && !valid {
@@ -795,13 +810,6 @@ func (impl ConfigMapServiceImpl) CSEnvironmentAddUpdate(configMapRequest *bean.C
 		}
 		configMapRequest.Id = configMap.Id
 	}
-	//VARIABLE_MAPPING_UPDATE
-	//sl := bean.SecretsList{}
-	//data, err := sl.GetTransformedDataForSecretList(model.SecretData, util2.DecodeSecret)
-	//if err != nil {
-	//	return nil, err
-	//}
-	//err = impl.extractAndMapVariables(data, model.Id, repository5.EntityTypeSecretEnvLevel, configMapRequest.UserId)
 	err = impl.scopedVariableManager.CreateVariableMappingsForSecretEnv(model)
 	if err != nil {
 		return nil, err
@@ -1545,6 +1553,26 @@ func (impl ConfigMapServiceImpl) validateConfigData(configData *bean.ConfigData)
 	return true, nil
 }
 
+func (impl ConfigMapServiceImpl) validateConfigDataForSecretsOnly(configData *bean.ConfigData) (bool, error) {
+
+	// check encoding in base64 for secret data
+	if len(configData.Data) > 0 {
+		dataMap := make(map[string]string)
+		err := json.Unmarshal(configData.Data, &dataMap)
+		if err != nil {
+			impl.logger.Errorw("error while unmarshalling secret data ", "error", err)
+			return false, err
+		}
+		err = util2.ValidateEncodedDataByDecoding(dataMap)
+		if err != nil {
+			impl.logger.Errorw("error in decoding secret data", "error", err)
+			return false, util.NewApiError().WithHttpStatusCode(http.StatusUnprocessableEntity).WithCode(strconv.Itoa(http.StatusUnprocessableEntity)).
+				WithUserMessage("error in decoding data, make sure the secret data is encoded properly")
+		}
+	}
+	return true, nil
+}
+
 func (impl ConfigMapServiceImpl) updateConfigData(configData *bean.ConfigData, syncRequest *bean.BulkPatchRequest) (*bean.ConfigData, error) {
 	dataMap := make(map[string]string)
 	var updatedData json.RawMessage

pkg/pipeline/ConfigMapService.go

@@ -53,3 +53,13 @@ func GetDecodedAndEncodedData(data json.RawMessage, transformer SecretTransformM
 	}
 	return marshal, nil
 }
+
+func ValidateEncodedDataByDecoding(dataMap map[string]string) error {
+	for _, value := range dataMap {
+		_, err := base64.StdEncoding.DecodeString(value)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}