lockbitchat
6152a77b51
A security review of the transport and verification layers. Every item is a fix
to how untrusted peer input is handled; no features changed.
- SAS verification could be bypassed. `verification_both_confirmed` is an
unauthenticated frame on a channel that is not yet trusted, but it was taken as
proof that both sides had compared their codes — so a peer who completed the
signalling exchange could send it right after the data channel opened and drive
the other side to a "verified" session while the user never looked at the code.
It is now only an acknowledgement: refused unless this side already confirmed
locally, and _setVerifiedStatus() independently rejects any SAS-based
transition without a local confirmation. Holding ECDH-derived keys was never
proof of identity — a MITM has those too.
- Unauthenticated frames could be injected into the chat. A bare
{type:"message"} frame, a raw non-JSON frame and a binary frame were each
decoded and rendered, bypassing decryption, the HMAC check and the verification
gate; the injected text was indistinguishable from a genuine message. Chat
content now reaches the UI only through the authenticated enhanced_message
path.
- A peer could supply the verification code. `sas_code` announcements were
adopted verbatim when no local SAS had been derived yet. They may now only
corroborate the locally derived code.
- Anti-replay never ran. The sequence-number and AAD validators were defined on
SecureKeyStorage instead of the connection manager, so every call site failed
with a TypeError and the sliding replay window was dead code. Moved onto the
manager, wired into the live chat path, and a missing or non-numeric sequence
number now fails closed instead of sailing through the range checks.
- File transfers are gated on verification in both directions. Control frames are
written straight to the data channel by the transfer system; sending was
already gated, receiving now is too.
- Tighter CSP: connect-src and img-src no longer allow arbitrary https: hosts
(nothing in the app talks to a third party), plus base-uri 'none'.
- The SAS is no longer written to logs, and is compared in constant time on every
path. Fixed SecureMasterKeyManager.isUnlocked() testing a field renamed long
ago, so it never actually gated anything.
- Fixed the header showing "Secure undefined%": getRealSecurityLevel() became
reachable for the first time by the move above and returned only per-feature
booleans, while the header renders `level` and `score` directly. It now runs
the same verified scoring as every other consumer.
Adds regression tests for the verification gate, inbound frame authentication and
the security-level shape.
88 lines
3.1 KiB
JavaScript
88 lines
3.1 KiB
JavaScript
// The header renders `level` and `score` straight from whatever the security
|
|
// getter returns:
|
|
//
|
|
// sec.level || 'Secure' -> label
|
|
// sec.score + '%' -> score badge
|
|
//
|
|
// so any getter the header may call must carry both fields. A getter that
|
|
// returned only per-feature booleans rendered as "Secure undefined%".
|
|
// These tests pin the shape for every branch of the header's fallback chain.
|
|
|
|
import assert from 'node:assert/strict';
|
|
|
|
globalThis.window = globalThis.window || {};
|
|
|
|
const { EnhancedSecureWebRTCManager } = await import('../src/network/EnhancedSecureWebRTCManager.js');
|
|
const P = EnhancedSecureWebRTCManager.prototype;
|
|
|
|
const SCORED = {
|
|
level: 'HIGH',
|
|
score: 90,
|
|
color: 'green',
|
|
isRealData: true,
|
|
passedChecks: 9,
|
|
totalChecks: 10
|
|
};
|
|
|
|
function createManager(overrides = {}) {
|
|
return Object.assign({
|
|
ecdhKeyPair: {},
|
|
ecdsaKeyPair: {},
|
|
encryptionKey: {},
|
|
hmacKey: {},
|
|
replayProtectionEnabled: true,
|
|
expectedDTLSFingerprint: 'aa:bb',
|
|
verificationCode: '1234567',
|
|
connectionId: 'conn-1',
|
|
keyFingerprint: 'ff:ee',
|
|
_secureLog() {},
|
|
calculateAndReportSecurityLevel: async () => ({ ...SCORED }),
|
|
getRealSecurityLevel: P.getRealSecurityLevel
|
|
}, overrides);
|
|
}
|
|
|
|
// ── the scored fields survive, alongside the feature flags ───────────────────
|
|
{
|
|
const data = await createManager().getRealSecurityLevel();
|
|
|
|
assert.equal(typeof data.score, 'number', 'score must be numeric (renders as `score + "%"`)');
|
|
assert.equal(typeof data.level, 'string', 'level must be a string (renders as the label)');
|
|
assert.equal(data.score, 90);
|
|
assert.equal(data.level, 'HIGH');
|
|
assert.equal(data.isRealData, true);
|
|
assert.equal(data.passedChecks, 9);
|
|
assert.equal(data.totalChecks, 10);
|
|
|
|
// Feature flags are still exposed for the detailed security panel.
|
|
assert.equal(data.ecdhKeyExchange, true);
|
|
assert.equal(data.sasCode, true);
|
|
assert.equal(data.replayProtection, true);
|
|
|
|
// What the header would actually paint.
|
|
assert.equal(String(data.level || 'Secure'), 'HIGH');
|
|
assert.equal(data.score + '%', '90%');
|
|
}
|
|
|
|
// ── not-ready path is flagged, not rendered as a real measurement ────────────
|
|
{
|
|
// calculateAndReportSecurityLevel returns null when the session is not yet
|
|
// connected/verified or the keys are missing.
|
|
const data = await createManager({
|
|
calculateAndReportSecurityLevel: async () => null
|
|
}).getRealSecurityLevel();
|
|
|
|
assert.equal(data.isRealData, false, 'UI keeps its previous value when isRealData is false');
|
|
assert.equal(typeof data.score, 'number');
|
|
assert.equal(typeof data.level, 'string');
|
|
assert.notEqual(data.score + '%', 'undefined%');
|
|
}
|
|
|
|
// ── the header's other fallback branch keeps the same contract ───────────────
|
|
{
|
|
const data = await createManager().calculateAndReportSecurityLevel();
|
|
assert.equal(typeof data.score, 'number');
|
|
assert.equal(typeof data.level, 'string');
|
|
}
|
|
|
|
console.log('Security level shape tests passed');
|