IJHack / QtPass / 35459543851

93%

Build Type

push

github

Committed by web-flow

Commit Message

Hardening round two: output allow list, exclusive temp file, literal search (#1844)

* Hardening round two: output allow list, exclusive temp file, literal search

The generic finishedAnyWithPid signal, which feeds the process output
panel, is an allow list now; the deny list it was let any process kind
added later broadcast its output, while the comment above it claimed the
opposite. Re-encryption creates its temporary ciphertext file itself,
exclusively and unguessably named, next to the original; the fixed
<file>.reencrypt.tmp could be pre-created by anyone with write access to
the store. The debug log redacts passphrase-shaped option values and
otpauth URIs. gpg's VALIDSIG is parsed with 64-character fingerprints too,
and a fingerprint from an fpr record is only accepted when shaped like one.
RealPass::Init asks PathValidator whether the folder is inside the store
instead of comparing string prefixes. The search box matches words
literally and in order instead of compiling the input as a regular
expression. The import dialog says what importing does and does not mean;
SECURITY.md and PathValidator state the threat model.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc

* Review: hooks arrive with a .git, not a clone; 40 or 64 in the signer's contract

textlint wanted VPN upper-cased in the changelog example, so the example
is mail now.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc

* Test: a planted <file>.reencrypt.tmp is never written through

A symlink at the old predictable name points at a canary; after the run
the canary is untouched, gpg wrote to QtPass's own temporary, and no
temporary or backup is left behind.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc

---------

Co-authored-by: Claude Opus 5 <nore... (continued)

Coverage Stats

41 of 46 new or added lines in 6 files covered. (89.13%)

1 existing line in 1 file now uncovered.

6759 of 8667 relevant lines covered (77.99%)

74.56 hits per line