Commit Graph

183 Commits

Author SHA1 Message Date
lockbitchat
a7a5861e0a fix: replace modulo with bitwise mask in crypto random 2025-10-20 01:02:07 -04:00
lockbitchat
63a19e6a4c fix: resolve CodeQL biased crypto random warning
Use unsigned right shift (>>>) to properly handle 32-bit random values and eliminate statistical bias.
2025-10-20 00:51:03 -04:00
lockbitchat
b18e943abd Fix cryptographic random bias in fingerprint mask generation 2025-10-20 00:42:12 -04:00
lockbitchat
9c1258cd1e Fix cryptographic random bias in fingerprint mask generation 2025-10-20 00:42:03 -04:00
lockbitchat
60e4bb6b8a Fix cryptographic random bias in getUnbiasedRandomInRange
Reworked getUnbiasedRandomInRange() to eliminate modulo bias by using
rejection sampling combined with bucket indexing instead of the `%` operator.
Added getUnbiasedRandomFloat() to safely generate unbiased floats for
sizeVariation and sizeMultiplier.
2025-10-20 00:34:17 -04:00
lockbitchat
4233ba3d7e Fix cryptographic random bias (CodeQL js/biased-cryptographic-random)
Reimplemented getUnbiasedRandomInRange() using rejection sampling for all range sizes to eliminate modulo bias and ensure uniform cryptographically secure randomness.
2025-10-20 00:25:50 -04:00
lockbitchat
333c4b87b5 fix: improve sanitization to prevent XSS
- Now the sanitization function protects against:
  - Nested script tags: <scrip<script>alert("XSS")</script>t>
  - HTML comments containing scripts: <!-- <script>alert("XSS")</script> -->
  - Multiple overlapping tags: <script><script>alert("XSS")</script></script>
  - Attributes in closing tags: </script foo="bar">
  - Complex nested structures combining different tags
  - All known XSS vectors
2025-10-19 23:55:41 -04:00
lockbitchat
5096a09811 fix: improve sanitization to prevent XSS
- Now the sanitization function protects against:
  - Nested script tags: <scrip<script>alert("XSS")</script>t>
  - HTML comments containing scripts: <!-- <script>alert("XSS")</script> -->
  - Multiple overlapping tags: <script><script>alert("XSS")</script></script>
  - Attributes in closing tags: </script foo="bar">
  - Complex nested structures combining different tags
  - All known XSS vectors
2025-10-19 23:54:26 -04:00
lockbitchat
5c658cdd6c Security updates for CodeQL 2025-10-19 23:39:14 -04:00
lockbitchat
e209d3e6f5 fix: improve sanitization to prevent XSS
- Now the sanitization function protects against:
  - Nested script tags: <scrip<script>alert("XSS")</script>t>
  - HTML comments containing scripts: <!-- <script>alert("XSS")</script> -->
  - Multiple overlapping tags: <script><script>alert("XSS")</script></script>
  - Attributes in closing tags: </script foo="bar">
  - Complex nested structures combining different tags
  - All known XSS vectors
2025-10-19 23:23:58 -04:00
lockbitchat
49e5a054cb fix: security and build improvements
- Fixed biased cryptographic random with modulo operations
- Corrected biased cryptographic random with addition operations
- Resolved infinite page loading issue
- Rebuilt all distribution files
2025-10-19 23:05:24 -04:00
lockbitchat
9d0372484a Add CodeQL security scanning workflow 2025-10-19 22:08:31 -04:00
lockbitchat
69fa5ffc28 Add CodeQL security scanning workflow 2025-10-19 22:04:07 -04:00
lockbitchat
ed169b4c8c Add CodeQL security scanning workflow 2025-10-19 22:02:28 -04:00
lockbitchat
906562333e fix(ios): prevent chat crash when Notifications API is unavailable on iPhones
- Guarded all Notification API usage to avoid ReferenceError on iOS Safari.
- Set default permission to 'denied' when Notification is undefined.
- Added early return in notification flow when Notifications API is unavailable.
- Wrapped Notification.permission, requestPermission(), and new Notification(...) with typeof checks.
- Updated SecureNotificationManager and app.jsx to degrade gracefully.
- Verified build passes and chat loads correctly on iOS without notifications.
2025-10-19 20:51:44 -04:00
lockbitchat
4e7f5867b5 feat: implement automatic key generation on channel creation
- Remove manual "Create secure keys" button requirement
- Add automatic key generation trigger when "Create channel" is clicked
- Implement loading state with spinner animation during key generation
- Add isGeneratingKeys state management across components
- Pass handleCreateOffer function as prop to EnhancedConnectionSetup
- Update UI to show "Generating secure keys..." message during process
- Ensure proper state cleanup on disconnect and data clearing
- Improve user experience by eliminating extra click step in channel creation flow
2025-10-19 15:23:02 -04:00
lockbitchat
5ddfd1f5b3 fix(ios): prevent chat crash when Notifications API is unavailable on iPhones
- Guarded all Notification API usage to avoid ReferenceError on iOS Safari.
- Set default permission to 'denied' when Notification is undefined.
- Added early return in notification flow when Notifications API is unavailable.
- Wrapped Notification.permission, requestPermission(), and new Notification(...) with typeof checks.
- Updated SecureNotificationManager and app.jsx to degrade gracefully.
- Verified build passes and chat loads correctly on iOS without notifications.
2025-10-17 03:49:33 -04:00
lockbitchat
1acbc12a92 update version to v4.4.18 2025-10-15 20:23:50 -04:00
lockbitchat
3ed8766fc9 v4.3.120 update 2025-10-15 20:15:41 -04:00
lockbitchat
b087adfecc feat: implement secure browser notifications system
- Added SecureNotificationManager with cross-browser support (Chrome, Firefox, Safari, Edge)
- Integrated WebRTC message notifications with tab visibility detection
- Implemented XSS protection, URL validation, and rate limiting
- Notifications shown only when chat tab is inactive
- Enforced HTTPS and user gesture requirements
2025-10-15 19:58:28 -04:00
lockbitchat
5b5cc67fdc Push to Codeberg 2025-10-15 04:55:22 -04:00
lockbitchat
93e4b7ad19 test 2025-10-15 04:51:48 -04:00
lockbitchat
fce18d27a5 Push to PrivacyGuides 2025-10-15 04:41:05 -04:00
lockbitchat
03e06f59dc Push to Codeberg 2025-10-15 04:30:18 -04:00
lockbitchat
5df6cb0d16 test ssh 2025-10-15 04:25:49 -04:00
lockbitchat
3730f46a08 test remote 2025-10-15 04:23:51 -04:00
lockbitchat
abd6f9a7f5 Test mirror 2025-10-15 04:21:20 -04:00
lockbitchat
99469e5bd5 Remove experimental Bluetooth key transfer module
- Deleted BluetoothKeyTransfer.js and related classes
- Removed BluetoothKeyTransfer.jsx UI component
- Cleaned up Bluetooth imports from app-boot.js and bootstrap-modules.js
- Removed Bluetooth buttons and handlers from main app
- Eliminated all Bluetooth functionality due to Web Bluetooth API limitations
- Browsers cannot create GATT servers or advertise devices
- Reduced bundle size by ~78KB
- Application now focuses on supported browser technologies (QR codes, manual key exchange, WebRTC)
2025-10-15 04:13:14 -04:00
lockbitchat
2306b32482 Remove experimental Bluetooth key transfer module
- Deleted BluetoothKeyTransfer.js and related classes
- Removed BluetoothKeyTransfer.jsx UI component
- Cleaned up Bluetooth imports from app-boot.js and bootstrap-modules.js
- Removed Bluetooth buttons and handlers from main app
- Eliminated all Bluetooth functionality due to Web Bluetooth API limitations
- Browsers cannot create GATT servers or advertise devices
- Reduced bundle size by ~78KB
- Application now focuses on supported browser technologies (QR codes, manual key exchange, WebRTC)
2025-10-15 01:47:28 -04:00
lockbitchat
cbb6a8fa31 Remove experimental Bluetooth key transfer module
- Deleted BluetoothKeyTransfer.js and related classes
- Removed BluetoothKeyTransfer.jsx UI component
- Cleaned up Bluetooth imports from app-boot.js and bootstrap-modules.js
- Removed Bluetooth buttons and handlers from main app
- Eliminated all Bluetooth functionality due to Web Bluetooth API limitations
- Browsers cannot create GATT servers or advertise devices
- Reduced bundle size by ~78KB
- Application now focuses on supported browser technologies (QR codes, manual key exchange, WebRTC)
2025-10-15 01:46:54 -04:00
lockbitchat
4be6fc55f5 Remove experimental Bluetooth key transfer module
- Deleted BluetoothKeyTransfer.js and related classes
- Removed BluetoothKeyTransfer.jsx UI component
- Cleaned up Bluetooth imports from app-boot.js and bootstrap-modules.js
- Removed Bluetooth buttons and handlers from main app
- Eliminated all Bluetooth functionality due to Web Bluetooth API limitations
- Browsers cannot create GATT servers or advertise devices
- Reduced bundle size by ~78KB
- Application now focuses on supported browser technologies (QR codes, manual key exchange, WebRTC)
2025-10-15 01:46:36 -04:00
lockbitchat
cb62d8eb3b fix: resolve ReferenceError issues and improve disconnect functionality
- Add missing sessionTimeLeft state variable to fix ReferenceError in handleDisconnect
- Fix ReferenceError in handleCreateAnswer by correcting variable scope (e.target.value -> answerInput)
- Add type checking for answerData.trim() to prevent TypeError in shouldPreserveAnswerData
- Standardize data types by replacing null assignments with empty strings for offerData/answerData
- Improve handleDisconnect function with proper error handling and comprehensive state cleanup
- Add try-catch wrapper around disconnect operations for better error handling
- Ensure complete metadata removal and connection termination on disconnect
- Fix Bluetooth transfer modal opening with proper role-based event dispatching
2025-10-14 22:51:48 -04:00
lockbitchat
ea8cf47118 Table update 2025-10-13 11:54:05 -04:00
lockbitchat
d292c84829 session bug fix 2025-10-13 11:13:11 -04:00
lockbitchat
45de8ce285 refactor: implement minimal PWA caching strategy
- Cache only essential PWA assets (manifest, icons, core scripts)
- Use Network First for all other requests
- Remove aggressive caching of UI components and styles
- Preserve PWA installation while minimizing cache footprint
2025-10-13 01:38:41 -04:00
lockbitchat
7af8f528ff refactor: implement minimal PWA caching strategy
- Cache only essential PWA assets (manifest, icons, core scripts)
- Use Network First for all other requests
- Remove aggressive caching of UI components and styles
- Preserve PWA installation while minimizing cache footprint
2025-10-13 01:35:32 -04:00
lockbitchat
d24d578321 feat: Add comprehensive iOS PWA splash screen support
- Add complete splash screen configuration for all iOS devices
- Support iPhone 17 Pro Max through iPhone 6 series
- Support all iPad models with landscape/portrait orientations
- Use proper media queries and generated splash images
- Fix iOS splash screen caching and display issues
2025-10-09 20:49:04 -04:00
lockbitchat
dd9f13ab59 Add Browser Extension block 2025-10-09 05:09:17 -04:00
lockbitchat
2e5b078bc2 UX/UI updates and bug fixes 2025-10-08 17:23:54 -04:00
lockbitchat
75fa1cd27d Qr generator create bug fix 2025-10-08 01:24:04 -04:00
lockbitchat
60db79d2ae v4.3.120 update 2025-10-08 00:17:53 -04:00
lockbitchat
204e1edd9a Update version to 4.3.120 UX/UI 4.3.120 2025-10-08 00:08:13 -04:00
lockbitchat
5b557102b4 Fix QR scanner multi-chunk processing and binary data handling
- Fix duplicate chunk detection by using data hash instead of index
- Add comprehensive logging for QR scanner debugging
- Implement proper buffer cleanup when scanner is closed
- Preserve original binary data instead of decoding to JSON
- Add deduplication logic to prevent same QR code being processed multiple times
- Improve error handling and scanner state management
- Fix binary chunk reconstruction to maintain SB1:bin: prefix format
2025-10-07 23:58:54 -04:00
lockbitchat
e6d6576d70 Render loading state if not ready 2025-10-06 14:35:13 -04:00
lockbitchat
d2830b9c46 Optimize JSON and QR codes
- Replaced original JSON with minimized binary format (gzip + base64).
- Adjusted rendering and QR code generation for compatibility.
- Reduced payload size for improved efficiency.
2025-10-05 06:21:14 -04:00
lockbitchat
ec04bebf22 Update UX/UI slider 2025-10-03 00:07:11 -04:00
lockbitchat
8cd78a2aba Update slider UX/UI 2025-10-02 21:34:45 -04:00
lockbitchat
4359e5fab1 Add Testimonials section with user feedback 2025-10-02 19:39:40 -04:00
lockbitchat
78769b58ef UX/UI update 2025-10-02 16:58:09 -04:00
lockbitchat
afc873761f update 2025-10-02 16:52:42 -04:00