IJHack / QtPass / 34832052805

93%

push

github

Stop dropping .gpg-id recipients gpg would accept (#1682) (#1684) (#1710)

Pass::getRecipientList filtered every .gpg-id line through
Util::isValidKeyId, which only accepted 8-40 hex characters, anything
containing '@', or an @ / # & routing prefix. A v6 fingerprint (64 hex),
a plain user-ID substring ("Alice Example"), an exact-match selector
("=Name <mail>") or anything else gpg happily resolves was skipped with
no message. UsersDialog then rebuilt .gpg-id from the surviving list on
accept, so one trip through the dialog erased those recipients and the
next re-encrypt no longer targeted them.

Follow pass' own rule instead: every non-empty token after comment
stripping is passed to gpg, which is the authority on what a selector
is. The only shape still refused is a token starting with '-', because
the same list is also handed positionally to `gpg --list-keys`, where it
would be parsed as an option. Rejected lines are now reported with a
qWarning that names the file and token rather than vanishing silently.

Tests updated: getRecipientListInvalidKeyId now expects "invalid" to be
kept, and new cases cover v6 fingerprints, spaced and exact-match user
IDs surviving a .gpg-id round trip, and the dash guard.

Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc


(cherry picked from commit 66caea1a6)

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

7 of 7 new or added lines in 2 files covered. (100.0%)

4658 of 7229 relevant lines covered (64.43%)

61.0 hits per line