lastpass 1.3.0 → 1.4.0

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+Version 1.4.0
+-------------
+
+- Added device id (IMEI/UUID) support
+- Log out after fetching the blob to close the newly open session on LP server to prevent triggering anti-hacking logic (hopefully)
+- Verify that the recieved blob is marked with ENDM chunk and hasn't been truncated in the process
+
+
 Version 1.3.0
 -------------
 

data/example/example.rb

@@ -7,6 +7,8 @@
 require "lastpass"
 require "yaml"
 
+DEVICE_ID = "example.rb"
+
 credentials = YAML.load_file File.join File.dirname(__FILE__), "credentials.yaml"
 
 username = credentials["username"]
@@ -14,21 +16,21 @@ password = credentials["password"]
 
 begin
     # First try without a multifactor password
-    vault = LastPass::Vault.open_remote username, password
+    vault = LastPass::Vault.open_remote username, password, nil, DEVICE_ID
 rescue LastPass::LastPassIncorrectGoogleAuthenticatorCodeError => e
     # Get the code
     puts "Enter Google Authenticator code:"
     multifactor_password = gets.chomp
 
     # And now retry with the code
-    vault = LastPass::Vault.open_remote username, password, multifactor_password
+    vault = LastPass::Vault.open_remote username, password, multifactor_password, DEVICE_ID
 rescue LastPass::LastPassIncorrectYubikeyPasswordError => e
     # Get the password
     puts "Enter Yubikey password:"
     multifactor_password = gets.chomp
 
     # And now retry with the Yubikey password
-    vault = LastPass::Vault.open_remote username, password, multifactor_password
+    vault = LastPass::Vault.open_remote username, password, multifactor_password, DEVICE_ID
 end
 
 vault.accounts.each_with_index do |i, index|

data/lib/lastpass/fetcher.rb

@@ -3,9 +3,16 @@
 
 module LastPass
     class Fetcher
-        def self.login username, password, multifactor_password = nil
+        def self.login username, password, multifactor_password = nil, client_id = nil
             key_iteration_count = request_iteration_count username
-            request_login username, password, key_iteration_count, multifactor_password
+            request_login username, password, key_iteration_count, multifactor_password, client_id
+        end
+
+        def self.logout session, web_client = http
+            response = web_client.get "https://lastpass.com/logout.php?mobile=1",
+                                      cookies: {"PHPSESSID" => URI.encode(session.id)}
+
+            raise NetworkError unless response.response.is_a? Net::HTTPOK
         end
 
         def self.fetch session, web_client = http
@@ -39,6 +46,7 @@ module LastPass
                                password,
                                key_iteration_count,
                                multifactor_password = nil,
+                               client_id = nil,
                                web_client = http
 
             body = {
@@ -51,6 +59,7 @@ module LastPass
             }
 
             body[:otp] = multifactor_password if multifactor_password
+            body[:imei] = client_id if client_id
 
             response = web_client.post "https://lastpass.com/login.php",
                                        format: :xml,

data/lib/lastpass/http.rb

@@ -2,7 +2,7 @@
 # Licensed under the terms of the MIT license. See LICENCE for details.
 
 module LastPass
-  class HTTP
-    include HTTParty
-  end
+    class HTTP
+        include HTTParty
+    end
 end

data/lib/lastpass/parser.rb

@@ -48,14 +48,14 @@ module LastPass
 
                 # Parse secure note
                 if secure_note == "1"
-                    17.times { skip_item io }
-                    secure_note_type = read_item io
-
-                    if !ALLOWED_SECURE_NOTE_TYPES.key? secure_note_type
+                    parsed = parse_secure_note_server notes
+                    if !ALLOWED_SECURE_NOTE_TYPES.key? parsed[:type]
                         return nil
                     end
 
-                    url, username, password = parse_secure_note_server notes
+                    url = parsed[:url] if parsed.key? :url
+                    username = parsed[:username] if parsed.key? :username
+                    password = parsed[:password] if parsed.key? :password
                 end
 
                 Account.new id, name, username, password, url, group
@@ -113,23 +113,23 @@ module LastPass
         end
 
         def self.parse_secure_note_server notes
-            url = nil
-            username = nil
-            password = nil
+            info = {}
 
             notes.split("\n").each do |i|
                 key, value = i.split ":", 2
                 case key
+                when "NoteType"
+                    info[:type] = value
                 when "Hostname"
-                    url = value
+                    info[:url] = value
                 when "Username"
-                    username = value
+                    info[:username] = value
                 when "Password"
-                    password = value
+                    info[:password] = value
                 end
             end
 
-            [url, username, password]
+            info
         end
 
         # Reads one chunk from a stream and creates a Chunk object with the data read.

data/lib/lastpass/vault.rb

@@ -6,13 +6,15 @@ module LastPass
         attr_reader :accounts
 
         # Fetches a blob from the server and creates a vault
-        def self.open_remote username, password, multifactor_password = nil
-            open Vault.fetch_blob(username, password, multifactor_password), username, password
+        def self.open_remote username, password, multifactor_password = nil, client_id = nil
+            blob = Vault.fetch_blob username, password, multifactor_password, client_id
+            open blob, username, password
         end
 
         # Creates a vault from a locally stored blob
         def self.open_local blob_filename, username, password
             # TODO: read the blob here
+            raise NotImplementedError
         end
 
         # Creates a vault from a blob object
@@ -21,24 +23,41 @@ module LastPass
         end
 
         # Just fetches the blob, could be used to store it locally
-        def self.fetch_blob username, password, multifactor_password = nil
-            Fetcher.fetch Fetcher.login username, password, multifactor_password
+        def self.fetch_blob username, password, multifactor_password = nil, client_id = nil
+            session = Fetcher.login username, password, multifactor_password, client_id
+            blob = Fetcher.fetch session
+            Fetcher.logout session
+
+            blob
         end
 
         # This more of an internal method, use one of the static constructors instead
         def initialize blob, encryption_key
-            @accounts = []
+            chunks = Parser.extract_chunks blob
+            if !complete? chunks
+                raise InvalidResponseError, "Blob is truncated"
+            end
+
+            @accounts = parse_accounts chunks, encryption_key
+        end
+
+        def complete? chunks
+            !chunks.empty? && chunks.last.id == "ENDM" && chunks.last.payload == "OK"
+        end
+
+        def parse_accounts chunks, encryption_key
+            accounts = []
 
             key = encryption_key
             rsa_private_key = nil
 
-            Parser.extract_chunks(blob).each do |i|
+            chunks.each do |i|
                 case i.id
                 when "ACCT"
                     # TODO: Put shared folder name as group in the account
                     account = Parser.parse_ACCT i, key
                     if account
-                        @accounts << account
+                        accounts << account
                     end
                 when "PRIK"
                     rsa_private_key = Parser.parse_PRIK i, encryption_key
@@ -47,6 +66,8 @@ module LastPass
                     key = Parser.parse_SHAR(i, encryption_key, rsa_private_key)[:encryption_key]
                 end
             end
+
+            accounts
         end
     end
 end

data/lib/lastpass/version.rb

@@ -2,5 +2,5 @@
 # Licensed under the terms of the MIT license. See LICENCE for details.
 
 module LastPass
-    VERSION = "1.3.0"
+    VERSION = "1.4.0"
 end

data/spec/fetcher_spec.rb

@@ -23,12 +23,31 @@ describe LastPass::Fetcher do
                              hash: hash,
                              iterations: key_iteration_count} }
 
+    let(:device_id) { "492378378052455" }
+    let(:login_post_data_with_device_id) { login_post_data.merge({imei: device_id}) }
+
     let(:google_authenticator_code) { "123456" }
     let(:yubikey_password) { "emdbwzemyisymdnevznyqhqnklaqheaxszzvtnxjrmkb" }
 
-    let(:login_post_data_with_google_authenticator_code) { login_post_data.merge({otp: google_authenticator_code})}
+    let(:login_post_data_with_google_authenticator_code) { login_post_data.merge({otp: google_authenticator_code}) }
     let(:login_post_data_with_yubikey_password) { login_post_data.merge({otp: yubikey_password}) }
 
+    describe ".logout" do
+        it "makes a GET request" do
+            web_client = double "web_client"
+            expect(web_client).to receive(:get)
+                .with("https://lastpass.com/logout.php?mobile=1", cookies: {"PHPSESSID" => session_id})
+                .and_return(http_ok "")
+            LastPass::Fetcher.logout session, web_client
+        end
+
+        it "raises an exception on HTTP error" do
+            expect {
+                LastPass::Fetcher.logout session, double("web_client", get: http_error)
+            }.to raise_error LastPass::NetworkError
+        end
+    end
+
     describe ".request_iteration_count" do
         it "makes a POST request" do
             expect(web_client = double("web_client")).to receive(:post)
@@ -75,7 +94,7 @@ describe LastPass::Fetcher do
     end
 
     describe ".request_login" do
-        def verify_post_request multifactor_password, post_data
+        def verify_post_request multifactor_password, device_id, post_data
             web_client = double("web_client")
             expect(web_client).to receive(:post)
                 .with("https://lastpass.com/login.php", format: :xml, body: post_data)
@@ -85,19 +104,24 @@ describe LastPass::Fetcher do
                                             password,
                                             key_iteration_count,
                                             multifactor_password,
+                                            device_id,
                                             web_client
         end
 
         it "makes a POST request" do
-            verify_post_request nil, login_post_data
+            verify_post_request nil, nil, login_post_data
+        end
+
+        it "makes a POST request with device id" do
+            verify_post_request nil, device_id, login_post_data_with_device_id
         end
 
         it "makes a POST request with Google Authenticator code" do
-            verify_post_request google_authenticator_code, login_post_data_with_google_authenticator_code
+            verify_post_request google_authenticator_code, nil, login_post_data_with_google_authenticator_code
         end
 
         it "makes a POST request with Yubikey password" do
-            verify_post_request yubikey_password, login_post_data_with_yubikey_password
+            verify_post_request yubikey_password, nil, login_post_data_with_yubikey_password
         end
 
         it "returns a session" do
@@ -277,6 +301,7 @@ describe LastPass::Fetcher do
                                         password,
                                         key_iteration_count,
                                         nil,
+                                        nil,
                                         double("web_client", post: response)
     end
 end

data/spec/http_spec.rb

@@ -4,14 +4,22 @@
 require "spec_helper"
 
 describe LastPass::HTTP do
-  let(:http) { LastPass::HTTP }
+    let(:http) { LastPass::HTTP }
 
-  it 'can set the proxy options' do
-    http.http_proxy('proxy.fazbearentertainment.com', 1987, 'ffazbear', 'itsme')
-    options = http.instance_variable_get(:@default_options)
-    expect(options[:http_proxyaddr]).to eq('proxy.fazbearentertainment.com')
-    expect(options[:http_proxyport]).to eq(1987)
-    expect(options[:http_proxyuser]).to eq('ffazbear')
-    expect(options[:http_proxypass]).to eq('itsme')
-  end
+    describe "#http_proxy" do
+        let(:url) { "https://proxy.example.com" }
+        let(:port) { 12345 }
+        let(:username) { "username" }
+        let(:password) { "password" }
+
+        it "sets the proxy options" do
+            http.http_proxy url, port, username, password
+
+            options = http.instance_variable_get :@default_options
+            expect(options[:http_proxyaddr]).to eq url
+            expect(options[:http_proxyport]).to eq port
+            expect(options[:http_proxyuser]).to eq username
+            expect(options[:http_proxypass]).to eq password
+        end
+    end
 end

data/spec/parser_spec.rb

@@ -186,16 +186,17 @@ describe LastPass::Parser do
     end
 
     describe ".parse_secure_note_server" do
+        let(:type) { "type"}
         let(:url) { "url" }
         let(:username) { "username" }
         let(:password) { "password" }
-        let(:notes) { "Hostname:#{url}\nUsername:#{username}\nPassword:#{password}" }
+        let(:notes) { "NoteType:#{type}\nHostname:#{url}\nUsername:#{username}\nPassword:#{password}" }
 
         it "returns parsed values" do
             result = LastPass::Parser.parse_secure_note_server notes
-            expect(result[0]).to eq url
-            expect(result[1]).to eq username
-            expect(result[2]).to eq password
+
+            expect(result).to be_instance_of Hash
+            expect(result).to eq(type: type, url: url, username: username, password: password)
         end
     end
 

data/spec/vault_spec.rb

@@ -10,6 +10,18 @@ describe LastPass::Vault do
                             TEST_ENCRYPTION_KEY
     }
 
+    describe ".new" do
+        it "raises an exception on trucated blob" do
+            [1, 2, 3, 4, 5, 10, 100, 1000].each do |i|
+                expect {
+                    blob = TEST_BLOB[0..(-1 - i)]
+                    LastPass::Vault.new LastPass::Blob.new(blob, TEST_KEY_ITERATION_COUNT),
+                                        TEST_ENCRYPTION_KEY
+                }.to raise_error LastPass::InvalidResponseError, "Blob is truncated"
+            end
+        end
+    end
+
     describe "#accounts" do
         context "returned accounts" do
             it { expect(vault.accounts).to be_instance_of Array }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lastpass
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.4.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-12-03 00:00:00.000000000 Z
+date: 2015-01-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: httparty