From 1d28f71a7d6b28ab7e8f0ba694e67c813a29b881 Mon Sep 17 00:00:00 2001 From: Felix Fontein Date: Sat, 20 Jun 2026 20:34:30 +0200 Subject: [PATCH 1/3] Fix error message (missing space). Signed-off-by: Felix Fontein --- sops.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sops.go b/sops.go index c20959cffc..956a9a3351 100644 --- a/sops.go +++ b/sops.go @@ -418,8 +418,8 @@ func (branch TreeBranch) walkBranch(in TreeBranch, path []string, commentsStack } key, ok := item.Key.(string) if !ok { - return nil, fmt.Errorf("Tree contains a non-string key (type %T): %s. Only string keys are"+ - "supported", item.Key, item.Key) + return nil, fmt.Errorf( + "Tree contains a non-string key (type %T): %s. Only string keys are supported", item.Key, item.Key) } newV, err := branch.walkValue(item.Value, append(path, key), commentsStack, onLeaves) if err != nil { From d1c031eafa67b5efecfc7200f0c6836a632e3abb Mon Sep 17 00:00:00 2001 From: Felix Fontein Date: Sat, 20 Jun 2026 20:35:23 +0200 Subject: [PATCH 2/3] Check some string casts and improve code quality. Signed-off-by: Felix Fontein --- sops.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/sops.go b/sops.go index 956a9a3351..b95d31d4d6 100644 --- a/sops.go +++ b/sops.go @@ -554,6 +554,8 @@ func (tree Tree) Encrypt(key []byte, cipher Cipher) (string, error) { if ok && tree.Metadata.UnencryptedCommentRegex != "" { // If an encrypted comment matches tree.Metadata.UnencryptedCommentRegex, decryption will fail // as the MAC does not match, and the commented value will not be decrypted. + // Note that cipher.Encrypt() returns a string, but we stored the result in an interface{} + // variable, so we have to cast it back. matched, _ := regexp.Match(tree.Metadata.UnencryptedCommentRegex, []byte(in.(string))) if matched { return nil, fmt.Errorf("Encrypted comment %q matches UnencryptedCommentRegex! Make sure that UnencryptedCommentRegex cannot match an encrypted comment.", in) @@ -595,13 +597,13 @@ func (tree Tree) Decrypt(key []byte, cipher Cipher) (string, error) { } walk := func(branch TreeBranch) error { _, err := branch.walkBranch(branch, make([]string, 0), make([][]string, 0), func(in interface{}, path []string, commentsStack [][]string) (interface{}, error) { - c, ok := in.(Comment) - encrypted := tree.shouldBeEncrypted(path, commentsStack, ok) + c, isComment := in.(Comment) + encrypted := tree.shouldBeEncrypted(path, commentsStack, isComment) var v interface{} if encrypted { var err error pathString := strings.Join(path, ":") + ":" - if ok { + if isComment { v, err = cipher.Decrypt(c.Value, key, pathString) if err != nil { // Assume the comment was not encrypted in the first place @@ -623,7 +625,7 @@ func (tree Tree) Decrypt(key []byte, cipher Cipher) (string, error) { } if !tree.Metadata.MACOnlyEncrypted || encrypted { // Only add to MAC if not a comment - if _, ok := v.(Comment); !ok { + if !isComment { bytes, err := ToBytes(v) if err != nil { return nil, fmt.Errorf("Could not convert %s to bytes: %s", in, err) From 4ed1e46bb23ee732a322e33a2a0d06728b72be3e Mon Sep 17 00:00:00 2001 From: Felix Fontein Date: Sat, 20 Jun 2026 20:35:42 +0200 Subject: [PATCH 3/3] Correctly handle non-strings when expecting encrypted data. Signed-off-by: Felix Fontein --- sops.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sops.go b/sops.go index b95d31d4d6..797ba08d80 100644 --- a/sops.go +++ b/sops.go @@ -614,11 +614,13 @@ func (tree Tree) Decrypt(key []byte, cipher Cipher) (string, error) { "SOPS.") v = c } - } else { - v, err = cipher.Decrypt(in.(string), key, pathString) + } else if inStr, inIsStr := in.(string); inIsStr { + v, err = cipher.Decrypt(inStr, key, pathString) if err != nil { return nil, fmt.Errorf("Could not decrypt value: %s", err) } + } else { + return nil, fmt.Errorf("Expected encrypted value as string, but got %T", in) } } else { v = in