Commit Graph

188 Commits

Author SHA1 Message Date
lockbitchat
4a3249b2a6 test 2025-10-20 12:39:55 -04:00
lockbitchat
456545f055 Add GitHub Actions workflow to mirror repository to PrivacyGuides 2025-10-20 12:34:10 -04:00
lockbitchat
40381cc0a1 Increase session timeout to 60min and inactivity to 30min
Fix sendMessage isUnlocked check to prevent immediate lock
Move session extension logic to SecureMasterKeyManager
Improve error messages
Keep validation of crypto keys before encryption
2025-10-20 02:06:42 -04:00
lockbitchat
0d7835cfa2 fix: resolve incomplete multi-character sanitization in sanitizeMessage
Use stable replacement loop for all multi-character patterns to prevent malicious input from reappearing after sanitization.
2025-10-20 01:20:02 -04:00
lockbitchat
7604381584 fix: eliminate division on crypto random in getSafeRandomFloat 2025-10-20 01:10:25 -04:00
lockbitchat
a7a5861e0a fix: replace modulo with bitwise mask in crypto random 2025-10-20 01:02:07 -04:00
lockbitchat
63a19e6a4c fix: resolve CodeQL biased crypto random warning
Use unsigned right shift (>>>) to properly handle 32-bit random values and eliminate statistical bias.
2025-10-20 00:51:03 -04:00
lockbitchat
b18e943abd Fix cryptographic random bias in fingerprint mask generation 2025-10-20 00:42:12 -04:00
lockbitchat
9c1258cd1e Fix cryptographic random bias in fingerprint mask generation 2025-10-20 00:42:03 -04:00
lockbitchat
60e4bb6b8a Fix cryptographic random bias in getUnbiasedRandomInRange
Reworked getUnbiasedRandomInRange() to eliminate modulo bias by using
rejection sampling combined with bucket indexing instead of the `%` operator.
Added getUnbiasedRandomFloat() to safely generate unbiased floats for
sizeVariation and sizeMultiplier.
2025-10-20 00:34:17 -04:00
lockbitchat
4233ba3d7e Fix cryptographic random bias (CodeQL js/biased-cryptographic-random)
Reimplemented getUnbiasedRandomInRange() using rejection sampling for all range sizes to eliminate modulo bias and ensure uniform cryptographically secure randomness.
2025-10-20 00:25:50 -04:00
lockbitchat
333c4b87b5 fix: improve sanitization to prevent XSS
- Now the sanitization function protects against:
  - Nested script tags: <scrip<script>alert("XSS")</script>t>
  - HTML comments containing scripts: <!-- <script>alert("XSS")</script> -->
  - Multiple overlapping tags: <script><script>alert("XSS")</script></script>
  - Attributes in closing tags: </script foo="bar">
  - Complex nested structures combining different tags
  - All known XSS vectors
2025-10-19 23:55:41 -04:00
lockbitchat
5096a09811 fix: improve sanitization to prevent XSS
- Now the sanitization function protects against:
  - Nested script tags: <scrip<script>alert("XSS")</script>t>
  - HTML comments containing scripts: <!-- <script>alert("XSS")</script> -->
  - Multiple overlapping tags: <script><script>alert("XSS")</script></script>
  - Attributes in closing tags: </script foo="bar">
  - Complex nested structures combining different tags
  - All known XSS vectors
2025-10-19 23:54:26 -04:00
lockbitchat
5c658cdd6c Security updates for CodeQL 2025-10-19 23:39:14 -04:00
lockbitchat
e209d3e6f5 fix: improve sanitization to prevent XSS
- Now the sanitization function protects against:
  - Nested script tags: <scrip<script>alert("XSS")</script>t>
  - HTML comments containing scripts: <!-- <script>alert("XSS")</script> -->
  - Multiple overlapping tags: <script><script>alert("XSS")</script></script>
  - Attributes in closing tags: </script foo="bar">
  - Complex nested structures combining different tags
  - All known XSS vectors
2025-10-19 23:23:58 -04:00
lockbitchat
49e5a054cb fix: security and build improvements
- Fixed biased cryptographic random with modulo operations
- Corrected biased cryptographic random with addition operations
- Resolved infinite page loading issue
- Rebuilt all distribution files
2025-10-19 23:05:24 -04:00
lockbitchat
9d0372484a Add CodeQL security scanning workflow 2025-10-19 22:08:31 -04:00
lockbitchat
69fa5ffc28 Add CodeQL security scanning workflow 2025-10-19 22:04:07 -04:00
lockbitchat
ed169b4c8c Add CodeQL security scanning workflow 2025-10-19 22:02:28 -04:00
lockbitchat
906562333e fix(ios): prevent chat crash when Notifications API is unavailable on iPhones
- Guarded all Notification API usage to avoid ReferenceError on iOS Safari.
- Set default permission to 'denied' when Notification is undefined.
- Added early return in notification flow when Notifications API is unavailable.
- Wrapped Notification.permission, requestPermission(), and new Notification(...) with typeof checks.
- Updated SecureNotificationManager and app.jsx to degrade gracefully.
- Verified build passes and chat loads correctly on iOS without notifications.
2025-10-19 20:51:44 -04:00
lockbitchat
4e7f5867b5 feat: implement automatic key generation on channel creation
- Remove manual "Create secure keys" button requirement
- Add automatic key generation trigger when "Create channel" is clicked
- Implement loading state with spinner animation during key generation
- Add isGeneratingKeys state management across components
- Pass handleCreateOffer function as prop to EnhancedConnectionSetup
- Update UI to show "Generating secure keys..." message during process
- Ensure proper state cleanup on disconnect and data clearing
- Improve user experience by eliminating extra click step in channel creation flow
2025-10-19 15:23:02 -04:00
lockbitchat
5ddfd1f5b3 fix(ios): prevent chat crash when Notifications API is unavailable on iPhones
- Guarded all Notification API usage to avoid ReferenceError on iOS Safari.
- Set default permission to 'denied' when Notification is undefined.
- Added early return in notification flow when Notifications API is unavailable.
- Wrapped Notification.permission, requestPermission(), and new Notification(...) with typeof checks.
- Updated SecureNotificationManager and app.jsx to degrade gracefully.
- Verified build passes and chat loads correctly on iOS without notifications.
2025-10-17 03:49:33 -04:00
lockbitchat
1acbc12a92 update version to v4.4.18 2025-10-15 20:23:50 -04:00
lockbitchat
3ed8766fc9 v4.3.120 update 2025-10-15 20:15:41 -04:00
lockbitchat
b087adfecc feat: implement secure browser notifications system
- Added SecureNotificationManager with cross-browser support (Chrome, Firefox, Safari, Edge)
- Integrated WebRTC message notifications with tab visibility detection
- Implemented XSS protection, URL validation, and rate limiting
- Notifications shown only when chat tab is inactive
- Enforced HTTPS and user gesture requirements
2025-10-15 19:58:28 -04:00
lockbitchat
5b5cc67fdc Push to Codeberg 2025-10-15 04:55:22 -04:00
lockbitchat
93e4b7ad19 test 2025-10-15 04:51:48 -04:00
lockbitchat
fce18d27a5 Push to PrivacyGuides 2025-10-15 04:41:05 -04:00
lockbitchat
03e06f59dc Push to Codeberg 2025-10-15 04:30:18 -04:00
lockbitchat
5df6cb0d16 test ssh 2025-10-15 04:25:49 -04:00
lockbitchat
3730f46a08 test remote 2025-10-15 04:23:51 -04:00
lockbitchat
abd6f9a7f5 Test mirror 2025-10-15 04:21:20 -04:00
lockbitchat
99469e5bd5 Remove experimental Bluetooth key transfer module
- Deleted BluetoothKeyTransfer.js and related classes
- Removed BluetoothKeyTransfer.jsx UI component
- Cleaned up Bluetooth imports from app-boot.js and bootstrap-modules.js
- Removed Bluetooth buttons and handlers from main app
- Eliminated all Bluetooth functionality due to Web Bluetooth API limitations
- Browsers cannot create GATT servers or advertise devices
- Reduced bundle size by ~78KB
- Application now focuses on supported browser technologies (QR codes, manual key exchange, WebRTC)
2025-10-15 04:13:14 -04:00
lockbitchat
2306b32482 Remove experimental Bluetooth key transfer module
- Deleted BluetoothKeyTransfer.js and related classes
- Removed BluetoothKeyTransfer.jsx UI component
- Cleaned up Bluetooth imports from app-boot.js and bootstrap-modules.js
- Removed Bluetooth buttons and handlers from main app
- Eliminated all Bluetooth functionality due to Web Bluetooth API limitations
- Browsers cannot create GATT servers or advertise devices
- Reduced bundle size by ~78KB
- Application now focuses on supported browser technologies (QR codes, manual key exchange, WebRTC)
2025-10-15 01:47:28 -04:00
lockbitchat
cbb6a8fa31 Remove experimental Bluetooth key transfer module
- Deleted BluetoothKeyTransfer.js and related classes
- Removed BluetoothKeyTransfer.jsx UI component
- Cleaned up Bluetooth imports from app-boot.js and bootstrap-modules.js
- Removed Bluetooth buttons and handlers from main app
- Eliminated all Bluetooth functionality due to Web Bluetooth API limitations
- Browsers cannot create GATT servers or advertise devices
- Reduced bundle size by ~78KB
- Application now focuses on supported browser technologies (QR codes, manual key exchange, WebRTC)
2025-10-15 01:46:54 -04:00
lockbitchat
4be6fc55f5 Remove experimental Bluetooth key transfer module
- Deleted BluetoothKeyTransfer.js and related classes
- Removed BluetoothKeyTransfer.jsx UI component
- Cleaned up Bluetooth imports from app-boot.js and bootstrap-modules.js
- Removed Bluetooth buttons and handlers from main app
- Eliminated all Bluetooth functionality due to Web Bluetooth API limitations
- Browsers cannot create GATT servers or advertise devices
- Reduced bundle size by ~78KB
- Application now focuses on supported browser technologies (QR codes, manual key exchange, WebRTC)
2025-10-15 01:46:36 -04:00
lockbitchat
cb62d8eb3b fix: resolve ReferenceError issues and improve disconnect functionality
- Add missing sessionTimeLeft state variable to fix ReferenceError in handleDisconnect
- Fix ReferenceError in handleCreateAnswer by correcting variable scope (e.target.value -> answerInput)
- Add type checking for answerData.trim() to prevent TypeError in shouldPreserveAnswerData
- Standardize data types by replacing null assignments with empty strings for offerData/answerData
- Improve handleDisconnect function with proper error handling and comprehensive state cleanup
- Add try-catch wrapper around disconnect operations for better error handling
- Ensure complete metadata removal and connection termination on disconnect
- Fix Bluetooth transfer modal opening with proper role-based event dispatching
2025-10-14 22:51:48 -04:00
lockbitchat
ea8cf47118 Table update 2025-10-13 11:54:05 -04:00
lockbitchat
d292c84829 session bug fix 2025-10-13 11:13:11 -04:00
lockbitchat
45de8ce285 refactor: implement minimal PWA caching strategy
- Cache only essential PWA assets (manifest, icons, core scripts)
- Use Network First for all other requests
- Remove aggressive caching of UI components and styles
- Preserve PWA installation while minimizing cache footprint
2025-10-13 01:38:41 -04:00
lockbitchat
7af8f528ff refactor: implement minimal PWA caching strategy
- Cache only essential PWA assets (manifest, icons, core scripts)
- Use Network First for all other requests
- Remove aggressive caching of UI components and styles
- Preserve PWA installation while minimizing cache footprint
2025-10-13 01:35:32 -04:00
lockbitchat
d24d578321 feat: Add comprehensive iOS PWA splash screen support
- Add complete splash screen configuration for all iOS devices
- Support iPhone 17 Pro Max through iPhone 6 series
- Support all iPad models with landscape/portrait orientations
- Use proper media queries and generated splash images
- Fix iOS splash screen caching and display issues
2025-10-09 20:49:04 -04:00
lockbitchat
dd9f13ab59 Add Browser Extension block 2025-10-09 05:09:17 -04:00
lockbitchat
2e5b078bc2 UX/UI updates and bug fixes 2025-10-08 17:23:54 -04:00
lockbitchat
75fa1cd27d Qr generator create bug fix 2025-10-08 01:24:04 -04:00
lockbitchat
60db79d2ae v4.3.120 update 2025-10-08 00:17:53 -04:00
lockbitchat
204e1edd9a Update version to 4.3.120 UX/UI 4.3.120 2025-10-08 00:08:13 -04:00
lockbitchat
5b557102b4 Fix QR scanner multi-chunk processing and binary data handling
- Fix duplicate chunk detection by using data hash instead of index
- Add comprehensive logging for QR scanner debugging
- Implement proper buffer cleanup when scanner is closed
- Preserve original binary data instead of decoding to JSON
- Add deduplication logic to prevent same QR code being processed multiple times
- Improve error handling and scanner state management
- Fix binary chunk reconstruction to maintain SB1:bin: prefix format
2025-10-07 23:58:54 -04:00
lockbitchat
e6d6576d70 Render loading state if not ready 2025-10-06 14:35:13 -04:00
lockbitchat
d2830b9c46 Optimize JSON and QR codes
- Replaced original JSON with minimized binary format (gzip + base64).
- Adjusted rendering and QR code generation for compatibility.
- Reduced payload size for improved efficiency.
2025-10-05 06:21:14 -04:00