CVE-2021-38599: Improper Check for Unusual or Exceptional Conditions (CWE-754)
value: WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."
CWE description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CVSS v3 base score: 7.5
Published: 2021-08-12T16:15Z
Repository: https://github.com/wal-g/wal-g
Language: YAML
Files changed: .github/workflows/release.yml, .github/workflows/unittests.yml, internal/configure_crypter.go
Commit date: 2021-08-12 11:29:13 +0500
Commit message: Fix libsodium missing from GitHub Releases (#1062)

* Fix release GitHub action to enable libsodium

* Exit with failure if keys are detected but not compiled with libsodium support

Adds a check for the existence of libsodium keys in non-libsodium builds. If keys are detected then
exit with failure as the user likely wanted to encrypt all file activity but it is not possible as
the application was not compiled with support for libsodium.

Previously, wal-g would continue to operate as if no encryption was requested.

* Add option to manually trigger GitHub Action CI
Diff: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e143005f..a3c7d67d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,10 +5,11 @@ on:
     tags:
       - 'v*' # Push events to matching v*, i.e. v0.2.19, v0.2.14a
 
 env:
   GO_VERSION: 1.15
+  USE_LIBSODIUM: 1
 
 jobs:
   release-ubuntu:
     strategy:
       matrix:
diff --git a/.github/workflows/unittests.yml b/.github/workflows/unittests.yml
index 38a71516..6370876c 100644
--- a/.github/workflows/unittests.yml
+++ b/.github/workflows/unittests.yml
@@ -1,8 +1,9 @@
 name: Unit tests
 
 on:
+  workflow_dispatch:
   push:
     branches: [ master ]
   pull_request:
     branches: [ master ]
 
diff --git a/internal/configure_crypter.go b/internal/configure_crypter.go
index 62b9fefe..e25814d0 100644
--- a/internal/configure_crypter.go
+++ b/internal/configure_crypter.go
@@ -12,11 +12,21 @@ package internal
 // }
 // will never be met.
 // If there is a tag, we can configure the correct implementation of crypter.
 
 import (
+	"github.com/spf13/viper"
+	"github.com/wal-g/tracelog"
 	"github.com/wal-g/wal-g/internal/crypto"
 )
 
 func configureLibsodiumCrypter() crypto.Crypter {
+	if viper.IsSet(LibsodiumKeySetting) {
+		tracelog.ErrorLogger.Fatalf("non-empty WALG_LIBSODIUM_KEY but wal-g was not compiled with libsodium")
+	}
+
+	if viper.IsSet(LibsodiumKeyPathSetting) {
+		tracelog.ErrorLogger.Fatalf("non-empty WALG_LIBSODIUM_KEY_PATH but wal-g was not compiled with libsodium")
+	}
+
 	return nil
 }

Fixed code:   USE_LIBSODIUM: 1
  workflow_dispatch:
	"github.com/spf13/viper"
	"github.com/wal-g/tracelog"
	if viper.IsSet(LibsodiumKeySetting) {
		tracelog.ErrorLogger.Fatalf("non-empty WALG_LIBSODIUM_KEY but wal-g was not compiled with libsodium")
	}

	if viper.IsSet(LibsodiumKeyPathSetting) {
		tracelog.ErrorLogger.Fatalf("non-empty WALG_LIBSODIUM_KEY_PATH but wal-g was not compiled with libsodium")
	}