Fix crash when KV store has a zero-length key. (#9881)

* Fix crash when KV store has a zero-length key.
* Add PR to changelog.

CHANGELOG.md

@@ -10,6 +10,7 @@ BUG FIXES:
 
 * core: Fix resource leak in plugin API (plugin-dependent, not all plugins impacted) [[GH-9557](https://github.com/hashicorp/vault/pull/9557)]
 * core: Fix race involved in enabling certain features via a license change
+* core: Fix crash when metrics collection encounters zero-length keys in KV store [[GH-9811](https://github.com/hashicorp/vault/pull/9881)]
 * replication (enterprise): Only write failover cluster addresses if they've changed
 * secrets/database: Fix handling of TLS options in mongodb connection strings [[GH-9519](https://github.com/hashicorp/vault/pull/9519)]
 * secrets/gcp: Ensure that the IAM policy version is appropriately set after a roleset's bindings have changed. [[GH-93](https://github.com/hashicorp/vault-plugin-secrets-gcp/pull/93)]

vault/core_metrics.go

@@ -294,7 +294,7 @@ func (c *Core) walkKvMountSecrets(ctx context.Context, m *kvMount) {
 			return
 		}
 		for _, path := range keys {
-			if path[len(path)-1] == '/' {
+			if len(path) > 0 && path[len(path)-1] == '/' {
 				subdirectories = append(subdirectories, currentDirectory+path)
 			} else {
 				m.NumSecrets += 1

vault/core_metrics_test.go

@@ -140,6 +140,63 @@ func TestCoreMetrics_KvSecretGauge(t *testing.T) {
 	}
 }
 
+func TestCoreMetrics_KvSecretGauge_BadPath(t *testing.T) {
+	// Use the real KV implementation instead of Passthrough
+	AddTestLogicalBackend("kv", logicalKv.Factory)
+	// Clean up for the next test.
+	defer func() {
+		delete(testLogicalBackends, "kv")
+	}()
+	core, _, _ := TestCoreUnsealed(t)
+
+	me := &MountEntry{
+		Table:   mountTableType,
+		Path:    sanitizePath("kv1"),
+		Type:    "kv",
+		Options: map[string]string{"version": "1"},
+	}
+	ctx := namespace.RootContext(nil)
+	err := core.mount(ctx, me)
+	if err != nil {
+		t.Fatalf("mount error: %v", err)
+	}
+
+	// I don't think there's any remaining way to create a zero-length
+	// key via the API, so we'll fake it by talking to the storage layer directly.
+	fake_entry := &logical.StorageEntry{
+		Key:   "logical/" + me.UUID + "/foo/",
+		Value: []byte{1},
+	}
+	err = core.barrier.Put(ctx, fake_entry)
+	if err != nil {
+		t.Fatalf("put error: %v", err)
+	}
+
+	values, err := core.kvSecretGaugeCollector(ctx)
+	if err != nil {
+		t.Fatalf("collector error: %v", err)
+	}
+	t.Logf("Values: %v", values)
+	found := false
+	var count float32 = -1
+	for _, glv := range values {
+		for _, l := range glv.Labels {
+			if l.Name == "mount_point" && l.Value == "kv1/" {
+				found = true
+				count = glv.Value
+				break
+			}
+		}
+	}
+	if found {
+		if count != 1.0 {
+			t.Errorf("bad secret count for kv1/")
+		}
+	} else {
+		t.Errorf("no secret count for kv1/")
+	}
+}
+
 func TestCoreMetrics_KvSecretGaugeError(t *testing.T) {
 	core, _, _, sink := TestCoreUnsealedWithMetrics(t)
 	ctx := namespace.RootContext(nil)