fix(crypto): reject plaintext fallback without crypto (#4391)

* fix(crypto): reject plaintext fallback without crypto

* test(crypto): gate no-feature regression under cfg

crates/crypto/src/encdec.rs

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#[cfg(not(feature = "fips"))]
+#[cfg(all(any(test, feature = "crypto"), not(feature = "fips")))]
 mod aes;
 
 #[cfg(any(test, feature = "crypto"))]

crates/crypto/src/encdec/decrypt.rs

@@ -53,6 +53,6 @@ fn decrypt<T: aes_gcm::aead::Aead>(stream: T, nonce: &[u8], data: &[u8]) -> Resu
 }
 
 #[cfg(not(any(test, feature = "crypto")))]
-pub fn decrypt_data(_password: &[u8], data: &[u8]) -> Result<Vec<u8>, crate::Error> {
-    Ok(data.to_vec())
+pub fn decrypt_data(_password: &[u8], _data: &[u8]) -> Result<Vec<u8>, crate::Error> {
+    Err(crate::Error::ErrCryptoDisabled)
 }

crates/crypto/src/encdec/encrypt.rs

@@ -75,6 +75,6 @@ fn encrypt<T: aes_gcm::aead::Aead>(
 }
 
 #[cfg(not(any(test, feature = "crypto")))]
-pub fn encrypt_data(_password: &[u8], data: &[u8]) -> Result<Vec<u8>, crate::Error> {
-    Ok(data.to_vec())
+pub fn encrypt_data(_password: &[u8], _data: &[u8]) -> Result<Vec<u8>, crate::Error> {
+    Err(crate::Error::ErrCryptoDisabled)
 }

crates/crypto/src/error.rs

@@ -26,6 +26,9 @@ pub enum Error {
     #[error("invalid key length")]
     ErrInvalidKeyLength,
 
+    #[error("crypto feature is disabled")]
+    ErrCryptoDisabled,
+
     #[cfg(any(test, feature = "crypto"))]
     #[error("{0}")]
     ErrInvalidLength(#[from] sha2::digest::InvalidLength),