-
Notifications
You must be signed in to change notification settings - Fork 10.4k
Open
Labels
Low priorityCreated by Linear-GitHub SyncCreated by Linear-GitHub Syncapiarea: API, enterprise API, access token, OAutharea: API, enterprise API, access token, OAuth🐛 bugSomething isn't workingSomething isn't working
Description
Issue Summary
RangeError: Invalid key length in crypto.ts - Incorrect encoding used for CALENDSO_ENCRYPTION_KEY
The symmetric encryption/decryption functions in packages/lib/crypto.ts
are using incorrect encoding (latin1
) to decode the base64-encoded CALENDSO_ENCRYPTION_KEY
environment variable. This causes a "RangeError: Invalid key length" error when trying to create AES256 ciphers, as the key length becomes 44 bytes instead of the required 32 bytes for AES256 encryption.
Steps to Reproduce
- Set up a Cal.com development environment with a properly configured
.env
file - Ensure
CALENDSO_ENCRYPTION_KEY
is set to a base64-encoded 32-byte key (e.g.,SW24Ctnk0foJJkBDsdIr4mW2n/kHOEFRfhU7bSbZ4Jc=
) - Start the development server with
yarn dev
- Try to add an ICS Feed Calendar integration by making a POST request to
/api/integrations/ics-feedcalendar/add
- The error occurs during the encryption process in the API handler
Actual Results
- Application throws
RangeError: Invalid key length
at line 18 incrypto.ts
- Error occurs in
crypto.createCipheriv(ALGORITHM, _key, iv)
call - Stack trace shows the error originates from
symmetricEncrypt()
function - ICS Feed Calendar integration fails to save credentials
- Console shows:
code: 'ERR_CRYPTO_INVALID_KEYLEN'
Expected Results
- Encryption/decryption functions should work correctly with base64-encoded keys
- ICS Feed Calendar integration should successfully save encrypted credentials
- No crypto-related errors when using properly configured environment variables
- The 32-byte base64 key should be correctly decoded to exactly 32 bytes for AES256
Evidence
Metadata
Metadata
Assignees
Labels
Low priorityCreated by Linear-GitHub SyncCreated by Linear-GitHub Syncapiarea: API, enterprise API, access token, OAutharea: API, enterprise API, access token, OAuth🐛 bugSomething isn't workingSomething isn't working