IJHack / QtPass / 35597732343

93%

Build Type

push

github

Committed by web-flow

Commit Message

Users dialog: with a signing key, preselect only a list that verifies (#1872)

* Users dialog: with a signing key, preselect only a list that verifies

UsersDialog::loadRecipients() read .gpg-id as it was on disk and ticked
its recipients, and OK writes and signs the selection. With a signing key
that is a confused deputy: someone who can write to the store appends
themselves to the list, cannot re-sign it, and the next Users -> OK by a
key holder signs them in. The rollback refusal from #1869, which sends the
user to that dialog, made the path more likely to be walked.

Pass::recipientsForEditing(dir, passStore, warning) is what the dialog
loads now. Without a signing key: the list as it is, as before. With one:
only a list whose signature verifies is preselected. One that does not
verify preselects nothing and the dialog shows why (saving then writes and
signs a fresh selection). One that verifies but is older than the
generation record is authentic and is preselected, with the reason shown
as a banner so the user reviews who is ticked before saving. The store the
folder belongs to comes from the dialog, not the backend: a profile being
set up is not the active store.

Tests: a bytes-bound verifying fake gpg (VALIDSIG only when stdin equals
the signed copy); an appended member is not ticked and the banner says the
list does not verify, the untouched list is ticked with no banner, without
a signing key the tampered list is taken as before; a verified older list
is ticked with the rollback banner.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc

* Users dialog: preselect only what accept() accepts, the authentic rollback excepted

The external review of the first commit: recipientsForEditing() treated
every accept() failure as "warn and preselect anyway", so a verified list
written for another folder (the relocation #1869 closed), a malformed one,
or one without a record to... (continued)

Coverage Stats

80 of 82 new or added lines in 5 files covered. (97.56%)

10 existing lines in 2 files now uncovered.

7281 of 9218 relevant lines covered (78.99%)

76.33 hits per line