IJHack / QtPass / 40416601267

93%

Build Type

push

github

Committed by web-flow

Commit Message

Security scan follow-ups: WSL signing key, decompression limit, templates, OTP seed, copy hints (#2051)

* Security scan follow-ups: WSL signing key, decompression limit, templates

From a CodeRabbit security scan of e5ea4ec16, each finding checked
against the code:

- WSL (Medium): the signing key never reached pass running in WSL, so
  pass there did not check .gpg-id.sig. WSLENV now forwards
  PASSWORD_STORE_SIGNING_KEY, and the length and character set get /u:
  their /w meant "from WSL out", so pass in WSL never saw them either.
- Decompression bombs (Low, 2 findings): every gpg decryption QtPass
  runs (show, re-encrypt and its check, content search) passes
  --max-output 64 MiB, and the pass backend gets the same through
  PASSWORD_STORE_GPG_OPTS after the user's own options. A small
  compressed entry in a shared store could expand to gigabytes.
- Template files (Low): .templates and .default_template are opened
  with Util::openRegularFile (no links, devices or FIFOs) and refused
  above 64 KiB; a link to /dev/zero made QtPass read forever on the GUI
  thread.
- otpauth seed (Low): a bare otpauth:// line is never split into a
  field, also not when the template lists "otpauth"; the scheme-less
  value was shown seed and all.
- Copy out of a shown entry (Low): the field values and the rest of the
  entry are SecretTextBrowsers, which put the same secret hints on
  whatever leaves them (Ctrl+C, context menu, drag, X11 selection) as
  ClipboardManager does, and report it; ClipboardManager::trackCopied()
  clears it with the rest, beside the copied password, not instead of
  it.

The sixth finding (a signed list replayed from another store that uses
the same signing key) is a design limitation: SECURITY.md documents it
with the advice of one signing key per store, and #2050 has the design
options. CHANGELOG: security entries, and an upgrade note that WSL users
with a signing key need a signed .gpg-id and the key inside WSL.

A test per fix; the o... (continued)

Coverage Stats

113 of 129 new or added lines in 10 files covered. (87.6%)

37 existing lines in 3 files now uncovered.

9298 of 10046 relevant lines covered (92.55%)

200.43 hits per line