-
-
+
+
{{ entry.issuer.split('::')[0] }}
{{ entry.account }}
@@ -93,6 +93,7 @@
Droid Sans Mono Copyright Steve Matteson. Licensed under the Apache License.
Font Awesome Copyright Dave Gandy. Licensed under the SIL OFL License 1.1.
Thanks to Mike Robinson <3
+
@@ -101,7 +102,7 @@
{{ i18n.add_secret }}
-
+
@@ -140,14 +141,9 @@
diff --git a/qrdebug.html b/qrdebug.html
new file mode 100644
index 00000000..bbdf7d11
--- /dev/null
+++ b/qrdebug.html
@@ -0,0 +1,16 @@
+
+
+
+ QR Debugging
+
+
+
+
+![]()
+
+
+
diff --git a/src/background.ts b/src/background.ts
index 2aba094b..755c855d 100644
--- a/src/background.ts
+++ b/src/background.ts
@@ -101,8 +101,13 @@ async function getTotp(text: string, passphrase: string) {
} else {
const encryption = new Encryption(passphrase);
const hash = CryptoJS.MD5(secret).toString();
- if (!/^[2-7a-z]+=*$/i.test(secret) && /^[0-9a-f]+$/i.test(secret)) {
+ if (!/^[2-7a-z]+=*$/i.test(secret) && /^[0-9a-f]+$/i.test(secret) &&
+ type === 'totp') {
type = 'hex';
+ } else if (
+ !/^[2-7a-z]+=*$/i.test(secret) && /^[0-9a-f]+$/i.test(secret) &&
+ type === 'hotp') {
+ type = 'hhex';
}
const entryData: {[hash: string]: OTPStorage} = {};
entryData[hash] = {
diff --git a/src/models/dropbox.ts b/src/models/dropbox.ts
index 2003b3c9..c240106d 100644
--- a/src/models/dropbox.ts
+++ b/src/models/dropbox.ts
@@ -4,39 +4,8 @@
/// we need correct the hash
+
+ // Do not correct hash, wrong password
+ // may not only 'Encrypted', but also
+ // other wrong secret. We cannot know
+ // if the hash doesn't match the correct
+ // secret
+
+ // Only correct invalid hash here
+
+ if (entry.secret !== 'Encrypted' &&
+ !/^[0-9a-f]{32}$/.test(hash)) {
const _hash = CryptoJS.MD5(entryData.secret).toString();
if (hash !== _hash) {
await this.remove(hash);
- hash = _hash;
- entryData.hash = hash;
+ entryData.hash = _hash;
needMigrate = true;
}
}
if (needMigrate) {
const _entry: {[hash: string]: OTPStorage} = {};
- _entry[hash] = entryData;
- _entry[hash].encrypted = false;
+ _entry[entryData.hash] = entryData;
+ _entry[entryData.hash].encrypted = false;
this.import(encryption, _entry);
}
}
@@ -336,6 +381,15 @@ class EntryStorage {
data.sort((a, b) => {
return a.index - b.index;
});
+
+ for (let i = 0; i < data.length; i++) {
+ if (data[i].index !== i) {
+ const exportData = await this.getExport(encryption);
+ await this.import(encryption, exportData);
+ break;
+ }
+ }
+
return resolve(data);
});
return;
diff --git a/src/qrdebug.ts b/src/qrdebug.ts
new file mode 100644
index 00000000..b1ea2bf3
--- /dev/null
+++ b/src/qrdebug.ts
@@ -0,0 +1,53 @@
+chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
+ if (message.action === 'position') {
+ if (!sender.tab) {
+ return;
+ }
+ getQrDebug(
+ sender.tab, message.info.left, message.info.top, message.info.width,
+ message.info.height, message.info.windowWidth, message.info.passphrase);
+ }
+});
+
+function getQrDebug(
+ tab: chrome.tabs.Tab, left: number, top: number, width: number,
+ height: number, windowWidth: number, passphrase: string) {
+ chrome.tabs.captureVisibleTab(tab.windowId, {format: 'png'}, (dataUrl) => {
+ const qr = new Image();
+ qr.src = dataUrl;
+ qr.onload = () => {
+ const captureCanvas = document.createElement('canvas');
+ captureCanvas.width = width;
+ captureCanvas.height = height;
+ const ctx = captureCanvas.getContext('2d');
+ if (!ctx) {
+ return;
+ }
+ ctx.drawImage(qr, left, top, width, height, 0, 0, width, height);
+ const url = captureCanvas.toDataURL();
+ const infoDom = document.getElementById('info');
+ if (infoDom) {
+ infoDom.innerHTML = 'Scan Data:
' + + `
` + + `Window Inner Width: ${windowWidth}
` + + `Width: ${width}
` + + `Height: ${height}
` + + `Left: ${left}
` + + `Top: ${top}
` + + `Screen Width: ${window.screen.width}
` + + `Screen Height: ${window.screen.height}
` + + `Capture Width: ${qr.width}
` + + `Capture Height: ${qr.height}
` + + `Device Pixel Ratio:${window.devicePixelRatio}
` + + `Tab ID: ${tab.id}
` + + '
' + + 'Captured Screenshot:'; + } + + const qrDom = document.getElementById('qr') as HTMLImageElement; + if (qrDom) { + qrDom.src = url; + } + }; + }); +} diff --git a/src/test/test.ts b/src/test/test.ts new file mode 100644 index 00000000..6270d2c9 --- /dev/null +++ b/src/test/test.ts @@ -0,0 +1,359 @@ +interface TestCase { + name: string; + data: { + /* tslint:disable-next-line:no-any */ + [hash: string]: { + /* tslint:disable-next-line:no-any */ + [key: string]: any + }; + }; +} + +const cases: TestCase[] = [ + { + name: 'Missing fields', + data: {'7733be61632fa6af88d31218e6c4afb2': {'secret': 'abcd2345'}} + }, + { + name: 'Bad hash in key', + data: { + 'badhash': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': '7733be61632fa6af88d31218e6c4afb2', + 'index': 0, + 'issuer': '', + 'secret': 'abcd2345', + 'type': 'totp' + } + } + }, + { + name: 'Bad hash', + data: { + 'badhash': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': 'badhash', + 'index': 0, + 'issuer': '', + 'secret': 'abcd2345', + 'type': 'totp' + } + } + }, + { + name: 'Bad type for HEX', + data: { + 'e19d5cd5af0378da05f63f891c7467af': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': 'e19d5cd5af0378da05f63f891c7467af', + 'index': 0, + 'issuer': '', + 'secret': 'abcd1234', + 'type': 'totp' + } + } + }, + { + name: 'Unicode in issuer', + data: { + '7733be61632fa6af88d31218e6c4afb2': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': '7733be61632fa6af88d31218e6c4afb2', + 'index': 0, + 'issuer': '✓ à la mode', + 'secret': 'abcd2345', + 'type': 'totp' + } + } + }, + { + name: 'Battle migrate', + data: { + '95c869de1221960c7f7e6892f78d7062': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': '95c869de1221960c7f7e6892f78d7062', + 'index': 0, + 'issuer': '', + 'secret': 'blz-abcd2345', + 'type': 'totp' + } + } + }, + { + name: 'Steam migrate', + data: { + '95c869de1221960c7f7e6892f78d7062': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': '95c869de1221960c7f7e6892f78d7062', + 'index': 0, + 'issuer': '', + 'secret': 'stm-abcd2345', + 'type': 'totp' + } + } + }, + { + name: 'Missing field with HEX secret', + data: {'e19d5cd5af0378da05f63f891c7467af': {'secret': 'abcd1234'}} + }, + { + name: 'Mess index', + data: { + '7733be61632fa6af88d31218e6c4afb2': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': '7733be61632fa6af88d31218e6c4afb2', + 'index': 6, + 'issuer': '', + 'secret': 'abcd2345', + 'type': 'totp' + }, + '770f51f23603ddae810e446630c2f673': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': '770f51f23603ddae810e446630c2f673', + 'index': 6, + 'issuer': '', + 'secret': 'abcd2346', + 'type': 'totp' + } + } + }, + { + name: 'Base32 with padding', + data: { + 'b905232a977347a0a113a7d1c924fb8d': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': 'b905232a977347a0a113a7d1c924fb8d', + 'index': 0, + 'issuer': '', + 'secret': 'DKCE3SQPHJRJQGBGI322QA7Z5E======', + 'type': 'totp' + } + } + }, + { + name: 'Incorrect but valid hash', + data: { + 'ffffffffffffffffffffffffffffffff': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': 'ffffffffffffffffffffffffffffffff', + 'index': 0, + 'issuer': '', + 'secret': 'abcd2345', + 'type': 'totp' + } + } + }, + { + name: 'HOTP with HEX secret', + data: { + '7c117a118e015b6232ff359958b9e270': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': '7c117a118e015b6232ff359958b9e270', + 'index': 0, + 'issuer': '', + 'secret': '2c52e8fcfac34091da63ef7b118f1cc50b925a42', + 'type': 'hhex' + } + } + } +]; + +let testCaseIndex = 0; +let testRes: Array<{pass: boolean, error: string}> = []; +let testResData: string[] = []; + +function testStart() { + if (document.getElementById('lock')) { + const checkbox = document.getElementById('lock') as HTMLInputElement; + if (!checkbox.checked) { + return; + } + } + const startBtn = document.getElementById('start'); + if (startBtn) { + startBtn.setAttribute('disabled', 'true'); + } + testCaseIndex = 0; + testRes = []; + test(); +} + +function testFinished() { + clear(); + console.log('Test finished.'); + for (const res of testRes) { + if (!res.pass) { + alert('Test failed!'); + return; + } + } + alert('Test passed!'); + return; +} + +async function clear() { + return new Promise((resolve: () => void, reject: (reason: Error) => void) => { + try { + chrome.storage.sync.clear(resolve); + } catch (error) { + reject(error); + } + }); +} + +async function get() {
+ return new Promise(
+ (resolve: (items: {[key: string]: T}) => void,
+ reject: (reason: Error) => void) => {
+ try {
+ chrome.storage.sync.get(resolve);
+ } catch (error) {
+ reject(error);
+ }
+ });
+}
+
+async function set(items: {[key: string]: {}}) {
+ /* tslint:disable-next-line:no-any */
+ return new Promise((resolve: () => void, reject: (reason: Error) => void) => {
+ try {
+ chrome.storage.sync.set(items, resolve);
+ } catch (error) {
+ reject(error);
+ }
+ });
+}
+
+async function test() {
+ if (testCaseIndex === cases.length * 2) {
+ testFinished();
+ return;
+ }
+
+ console.log(
+ cases[Math.floor(testCaseIndex / 2)].name,
+ testCaseIndex % 2 ? 'Reopen' : '');
+
+ if (testCaseIndex % 2 === 0) {
+ clear();
+ await set(cases[Math.floor(testCaseIndex / 2)].data);
+ }
+
+ if (document.getElementsByTagName('iframe') &&
+ document.getElementsByTagName('iframe')[0]) {
+ testRes[testCaseIndex] = {pass: true, error: ''};
+
+ document.getElementsByTagName('iframe')[0].src = 'popup.html';
+ document.getElementsByTagName('iframe')[0].onload = () => {
+ document.getElementsByTagName('iframe')[0].contentWindow.addEventListener(
+ 'unhandledrejection', event => {
+ const rejectionEvent = event as PromiseRejectionEvent;
+ testRes[testCaseIndex] = {
+ pass: false,
+ error: rejectionEvent.reason
+ };
+ });
+
+ document.getElementsByTagName('iframe')[0].contentWindow.onerror =
+ error => {
+ testRes[testCaseIndex] = {pass: false, error};
+ };
+ };
+ }
+
+ setTimeout(async () => {
+ const data = await get<{
+ /* tslint:disable-next-line:no-any */
+ [key: string]: any
+ }>();
+
+ testResData[testCaseIndex] = JSON.stringify(data, null, 2);
+
+ if (testRes[testCaseIndex].pass) {
+ if (Object.keys(data).length !==
+ Object.keys(cases[Math.floor(testCaseIndex / 2)].data).length) {
+ testRes[testCaseIndex] = {pass: false, error: `Missing data`};
+ } else {
+ for (const hash of Object.keys(data)) {
+ const item = data[hash];
+ const keys = [
+ 'issuer', 'account', 'secret', 'hash', 'index', 'type', 'counter',
+ 'encrypted'
+ ];
+ for (const key of keys) {
+ if (item[key] === undefined) {
+ testRes[testCaseIndex] = {
+ pass: false,
+ error: `Missing key<${key}>: ${JSON.stringify(item)}`
+ };
+ break;
+ }
+ }
+ }
+ }
+ }
+
+ showTestResult();
+ testCaseIndex++;
+
+ if (document.getElementsByTagName('iframe') &&
+ document.getElementsByTagName('iframe')[0]) {
+ document.getElementsByTagName('iframe')[0].src = 'about:blank';
+ }
+
+ await test();
+ }, 1000);
+}
+
+function showTestResult() {
+ const testResultContainer = document.getElementById('test');
+ if (!testResultContainer) {
+ return;
+ }
+
+ testResultContainer.innerHTML = '';
+ for (let i = 0; i < testRes.length; i++) {
+ const el = document.createElement('tr');
+ el.innerHTML = `[${testRes[i].pass ? 'Pass' : 'Fail'}] `;
+ el.innerHTML +=
+ `
, entries: OTPEntry[]) {
}
function isMatchedEntry(siteName: Array, entry: OTPEntry) {
+ if (!entry.issuer) {
+ return false;
+ }
+
const issuerHostMatches = entry.issuer.split('::');
const issuer = issuerHostMatches[0].replace(/[^0-9a-z]/ig, '').toLowerCase();
@@ -358,7 +363,7 @@ async function entry(_ui: UI) {
return;
},
nextCode: async (entry: OTPEntry) => {
- if (_ui.instance.class.hotpDiabled) {
+ if (_ui.instance.class.Diabled) {
return;
}
_ui.instance.class.hotpDiabled = true;
diff --git a/src/ui/info.ts b/src/ui/info.ts
index 9eab6d32..ee454a43 100644
--- a/src/ui/info.ts
+++ b/src/ui/info.ts
@@ -6,17 +6,12 @@ async function info(_ui: UI) {
const ui: UIConfig = {
data: {
info: '',
- dropboxCode: '',
- dropboxToken: localStorage.dropboxToken || ''
+ dropboxToken: localStorage.dropboxToken || '',
+ dropboxTokenUrl:
+ 'https://www.dropbox.com/oauth2/authorize?response_type=token&client_id=013qun2m82h9jim&redirect_uri=chrome-extension%3A%2F%2F' +
+ chrome.runtime.id + '%2Fdropboxtoken.html'
},
methods: {
- saveDropboxCode: async () => {
- const dropbox = new Dropbox();
- _ui.instance.dropboxToken =
- await dropbox.getToken(_ui.instance.dropboxCode);
- _ui.instance.closeInfo();
- return;
- },
showInfo: (tab: string) => {
if (tab === 'export' || tab === 'security') {
const entries = _ui.instance.entries as OTPEntry[];
diff --git a/src/ui/qr.ts b/src/ui/qr.ts
index ff754232..ad21bddf 100644
--- a/src/ui/qr.ts
+++ b/src/ui/qr.ts
@@ -10,13 +10,16 @@ async function getQrUrl(entry: OTPEntry) {
(resolve: (value: string) => void, reject: (reason: Error) => void) => {
const label =
entry.issuer ? (entry.issuer + ':' + entry.account) : entry.account;
- const type = entry.type === OTPType.hex ? OTPType[OTPType.totp] :
- OTPType[entry.type];
+ const type = entry.type === OTPType.hex ?
+ OTPType[OTPType.totp] :
+ (entry.type === OTPType.hhex ? OTPType[OTPType.hotp] :
+ OTPType[entry.type]);
const otpauth = 'otpauth://' + type + '/' + label +
'?secret=' + entry.secret +
(entry.issuer ? ('&issuer=' + entry.issuer.split('::')[0]) : '') +
- ((entry.type === OTPType.hotp) ? ('&counter=' + entry.counter) :
- '');
+ ((entry.type === OTPType.hotp || entry.type === OTPType.hhex) ?
+ ('&counter=' + entry.counter) :
+ '');
/* tslint:disable-next-line:no-unused-expression */
new QRCode(
'qr', {
diff --git a/test.html b/test.html
new file mode 100644
index 00000000..32ee585b
--- /dev/null
+++ b/test.html
@@ -0,0 +1,28 @@
+
+
+
+
+ Authenticator Tests
+
+
+
+
+ +
+
{{ i18n.dropbox_risk }}
-
-
- {{ i18n.ok }}
+ {{ i18n.dropbox_authorization }}
QR Scan Debugging Page
+ + ++
' + + `
` + + `Window Inner Width: ${windowWidth}
` + + `Width: ${width}
` + + `Height: ${height}
` + + `Left: ${left}
` + + `Top: ${top}
` + + `Screen Width: ${window.screen.width}
` + + `Screen Height: ${window.screen.height}
` + + `Capture Width: ${qr.width}
` + + `Capture Height: ${qr.height}
` + + `Device Pixel Ratio:${window.devicePixelRatio}
` + + `Tab ID: ${tab.id}
` + + '
' + + 'Captured Screenshot:'; + } + + const qrDom = document.getElementById('qr') as HTMLImageElement; + if (qrDom) { + qrDom.src = url; + } + }; + }); +} diff --git a/src/test/test.ts b/src/test/test.ts new file mode 100644 index 00000000..6270d2c9 --- /dev/null +++ b/src/test/test.ts @@ -0,0 +1,359 @@ +interface TestCase { + name: string; + data: { + /* tslint:disable-next-line:no-any */ + [hash: string]: { + /* tslint:disable-next-line:no-any */ + [key: string]: any + }; + }; +} + +const cases: TestCase[] = [ + { + name: 'Missing fields', + data: {'7733be61632fa6af88d31218e6c4afb2': {'secret': 'abcd2345'}} + }, + { + name: 'Bad hash in key', + data: { + 'badhash': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': '7733be61632fa6af88d31218e6c4afb2', + 'index': 0, + 'issuer': '', + 'secret': 'abcd2345', + 'type': 'totp' + } + } + }, + { + name: 'Bad hash', + data: { + 'badhash': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': 'badhash', + 'index': 0, + 'issuer': '', + 'secret': 'abcd2345', + 'type': 'totp' + } + } + }, + { + name: 'Bad type for HEX', + data: { + 'e19d5cd5af0378da05f63f891c7467af': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': 'e19d5cd5af0378da05f63f891c7467af', + 'index': 0, + 'issuer': '', + 'secret': 'abcd1234', + 'type': 'totp' + } + } + }, + { + name: 'Unicode in issuer', + data: { + '7733be61632fa6af88d31218e6c4afb2': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': '7733be61632fa6af88d31218e6c4afb2', + 'index': 0, + 'issuer': '✓ à la mode', + 'secret': 'abcd2345', + 'type': 'totp' + } + } + }, + { + name: 'Battle migrate', + data: { + '95c869de1221960c7f7e6892f78d7062': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': '95c869de1221960c7f7e6892f78d7062', + 'index': 0, + 'issuer': '', + 'secret': 'blz-abcd2345', + 'type': 'totp' + } + } + }, + { + name: 'Steam migrate', + data: { + '95c869de1221960c7f7e6892f78d7062': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': '95c869de1221960c7f7e6892f78d7062', + 'index': 0, + 'issuer': '', + 'secret': 'stm-abcd2345', + 'type': 'totp' + } + } + }, + { + name: 'Missing field with HEX secret', + data: {'e19d5cd5af0378da05f63f891c7467af': {'secret': 'abcd1234'}} + }, + { + name: 'Mess index', + data: { + '7733be61632fa6af88d31218e6c4afb2': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': '7733be61632fa6af88d31218e6c4afb2', + 'index': 6, + 'issuer': '', + 'secret': 'abcd2345', + 'type': 'totp' + }, + '770f51f23603ddae810e446630c2f673': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': '770f51f23603ddae810e446630c2f673', + 'index': 6, + 'issuer': '', + 'secret': 'abcd2346', + 'type': 'totp' + } + } + }, + { + name: 'Base32 with padding', + data: { + 'b905232a977347a0a113a7d1c924fb8d': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': 'b905232a977347a0a113a7d1c924fb8d', + 'index': 0, + 'issuer': '', + 'secret': 'DKCE3SQPHJRJQGBGI322QA7Z5E======', + 'type': 'totp' + } + } + }, + { + name: 'Incorrect but valid hash', + data: { + 'ffffffffffffffffffffffffffffffff': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': 'ffffffffffffffffffffffffffffffff', + 'index': 0, + 'issuer': '', + 'secret': 'abcd2345', + 'type': 'totp' + } + } + }, + { + name: 'HOTP with HEX secret', + data: { + '7c117a118e015b6232ff359958b9e270': { + 'account': 'test', + 'counter': 0, + 'encrypted': false, + 'hash': '7c117a118e015b6232ff359958b9e270', + 'index': 0, + 'issuer': '', + 'secret': '2c52e8fcfac34091da63ef7b118f1cc50b925a42', + 'type': 'hhex' + } + } + } +]; + +let testCaseIndex = 0; +let testRes: Array<{pass: boolean, error: string}> = []; +let testResData: string[] = []; + +function testStart() { + if (document.getElementById('lock')) { + const checkbox = document.getElementById('lock') as HTMLInputElement; + if (!checkbox.checked) { + return; + } + } + const startBtn = document.getElementById('start'); + if (startBtn) { + startBtn.setAttribute('disabled', 'true'); + } + testCaseIndex = 0; + testRes = []; + test(); +} + +function testFinished() { + clear(); + console.log('Test finished.'); + for (const res of testRes) { + if (!res.pass) { + alert('Test failed!'); + return; + } + } + alert('Test passed!'); + return; +} + +async function clear() { + return new Promise((resolve: () => void, reject: (reason: Error) => void) => { + try { + chrome.storage.sync.clear(resolve); + } catch (error) { + reject(error); + } + }); +} + +async function get
${cases[Math.floor(i / 2)].name}${ + i % 2 === 1 ? ' (Reopen)' : + ''}
${testRes[i].error}${
+ testResData[i]}This page is dangerous, if you do not know what this is close this immediately!
+ + All data will be destroyed!!! Check box to continue ++ +
+
+
+
+
+
+
diff --git a/tsconfig.json b/tsconfig.json
index dd0840a2..15280d2e 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -9,9 +9,7 @@
},
"include": [
"src/*.ts",
- "src/**/*.ts",
- "test/*.ts",
- "test/**/*.ts"
+ "src/**/*.ts"
],
"exclude": [
"node_modules"