do not enforce case insensitive uniqueness for piv_cac uuid or dn_signature #231
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mitchellhenke
added a commit
that referenced
this pull request
May 17, 2021
* Update hostdata version to support imdsv2 (#229) * Use identity-hostdata v3.2.0 Co-authored-by: Zach Margolis <zachary.margolis@gsa.gov> * Bump rexml from 3.2.4 to 3.2.5 (#230) Bumps [rexml](https://github.com/ruby/rexml) from 3.2.4 to 3.2.5. - [Release notes](https://github.com/ruby/rexml/releases) - [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md) - [Commits](ruby/rexml@v3.2.4...v3.2.5) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * do not enforce case insensitive uniqueness for piv_cac uuid or dn_signature (#231) * do not enforce case insensitive uniqueness for piv_cac uuid or dn_signature * update rails Co-authored-by: Brian Crissup <crissupb@amazon.com> Co-authored-by: Zach Margolis <zachary.margolis@gsa.gov> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The
piv_cacstable has case-sensitive indices ondn_signatureanduuid, but issues a query for a uniqueness check to for case insensitive equality in the form ofSELECT ? AS one FROM ? WHERE LOWER(?.?) = LOWER($?) LIMIT $?. That query is not indexed, and leads to table scans that have been getting slower over time.identity-pki/db/schema.rb
Lines 41 to 42 in b20063e
The initial implementation here attempted to have a case-insensitive check, but it was misconfigured by using:
This misconfiguration was fixed in the Rails 6.1 upgrade (#213), and we then started running the unindexed queries.
This change reverts it back to being case-sensitive, which should be safe since it previously operated this way. I believe this is also the correct behavior since
dn_signatureis Base64 encoded, where anais not the same as anA. Our UUIDs are always generated as being lowercase withSecureRandom.uuidas well.This PR also includes some dependency updates to patch GHSA-hjg4-8q5f-x6fm