@google/gemini-cli-core 0.54.0-nightly.20260727.g3818efbbf → 0.54.0-preview.0

package/dist/src/services/gcmTruncationReproduction.test.js

@@ -0,0 +1,135 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import * as crypto from 'node:crypto';
+import { FileKeychain } from './fileKeychain.js';
+describe('AES-GCM Tag Length Verification', () => {
+    let tempDir;
+    beforeEach(async () => {
+        // Create a unique temporary directory for test isolation
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'gemini-test-keychain-'));
+        vi.stubEnv('GEMINI_CLI_HOME', tempDir);
+    });
+    afterEach(async () => {
+        vi.unstubAllEnvs();
+        // Clean up the temporary directory
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    it('should use a secure 128-bit (16-byte) AES-GCM authentication tag and standard 12-byte IV', async () => {
+        const keychain = new FileKeychain();
+        const service = 'test-service';
+        const account = 'test-account';
+        const password = 'secure-password-123';
+        // 1. Save credentials to trigger encryption and file write
+        await keychain.setPassword(service, account, password);
+        // 2. Read the raw encrypted file from disk
+        const credentialsFilePath = path.join(tempDir, '.gemini', 'gemini-credentials.json');
+        const rawEncryptedData = await fs.readFile(credentialsFilePath, 'utf-8');
+        // 3. Parse the encrypted data format (iv:authTag:encrypted)
+        const parts = rawEncryptedData.split(':');
+        expect(parts).toHaveLength(3);
+        const ivHex = parts[0];
+        const authTagHex = parts[1];
+        // 4. Verify the lengths of the components
+        const ivBuffer = Buffer.from(ivHex, 'hex');
+        const authTagBuffer = Buffer.from(authTagHex, 'hex');
+        // IV should be exactly 12 bytes (96 bits) by default
+        expect(ivBuffer.length).toBe(12);
+        expect(ivHex.length).toBe(24);
+        // Authentication Tag should be exactly 16 bytes (128 bits)
+        expect(authTagBuffer.length).toBe(16);
+        expect(authTagHex.length).toBe(32); // 32 hex characters
+        // Assert that the tag is NOT truncated to 4 bytes (32 bits)
+        expect(authTagBuffer.length).not.toBe(4);
+        expect(authTagHex.length).not.toBe(8); // 8 hex characters
+        // 5. Verify that decryption works correctly with the 16-byte tag
+        const decryptedPassword = await keychain.getPassword(service, account);
+        expect(decryptedPassword).toBe(password);
+    });
+    it('should support both 12-byte and 16-byte IVs for backward compatibility', async () => {
+        const keychain = new FileKeychain();
+        const service = 'test-service';
+        const account = 'test-account';
+        const password = 'secure-password-123';
+        // 1. Save credentials to trigger encryption and file write (generates 12-byte IV)
+        await keychain.setPassword(service, account, password);
+        // 2. Verify 12-byte IV decryption works
+        let decryptedPassword = await keychain.getPassword(service, account);
+        expect(decryptedPassword).toBe(password);
+        // 3. Manually simulate a legacy 16-byte IV credentials file
+        const credentialsFilePath = path.join(tempDir, '.gemini', 'gemini-credentials.json');
+        const legacyIv = crypto.randomBytes(16);
+        const encryptionKey = keychain
+            .encryptionKey;
+        const cipher = crypto.createCipheriv('aes-256-gcm', encryptionKey, legacyIv, {
+            authTagLength: 16,
+        });
+        let encrypted = cipher.update(JSON.stringify({ [service]: { [account]: password } }), 'utf8', 'hex');
+        encrypted += cipher.final('hex');
+        const authTag = cipher.getAuthTag();
+        const legacyPayload = legacyIv.toString('hex') +
+            ':' +
+            authTag.toString('hex') +
+            ':' +
+            encrypted;
+        await fs.writeFile(credentialsFilePath, legacyPayload, 'utf-8');
+        // 4. Verify 16-byte IV decryption works successfully (backward compatibility)
+        decryptedPassword = await keychain.getPassword(service, account);
+        expect(decryptedPassword).toBe(password);
+    });
+    it('should reject decryption of a credentials file with a truncated tag', async () => {
+        const keychain = new FileKeychain();
+        const service = 'test-service';
+        const account = 'test-account';
+        const password = 'secure-password-123';
+        // 1. Save credentials to trigger encryption and file write
+        await keychain.setPassword(service, account, password);
+        // 2. Read the raw encrypted file from disk
+        const credentialsFilePath = path.join(tempDir, '.gemini', 'gemini-credentials.json');
+        const rawEncryptedData = await fs.readFile(credentialsFilePath, 'utf-8');
+        // 3. Parse the encrypted data format (iv:authTag:encrypted)
+        const parts = rawEncryptedData.split(':');
+        expect(parts).toHaveLength(3);
+        const ivHex = parts[0];
+        const authTagHex = parts[1];
+        const encryptedHex = parts[2];
+        // 4. Create a truncated 4-byte tag (8 hex characters)
+        const truncatedTagHex = authTagHex.substring(0, 8);
+        const truncatedEncryptedData = `${ivHex}:${truncatedTagHex}:${encryptedHex}`;
+        // 5. Overwrite the credentials file with the truncated-tag payload
+        await fs.writeFile(credentialsFilePath, truncatedEncryptedData, 'utf-8');
+        // 6. Attempt to retrieve the password and verify it throws a clear, handled validation error
+        await expect(keychain.getPassword(service, account)).rejects.toThrow('Corrupted credentials file detected');
+    });
+    it('should reject decryption of a credentials file with a truncated IV', async () => {
+        const keychain = new FileKeychain();
+        const service = 'test-service';
+        const account = 'test-account';
+        const password = 'secure-password-123';
+        // 1. Save credentials to trigger encryption and file write
+        await keychain.setPassword(service, account, password);
+        // 2. Read the raw encrypted file from disk
+        const credentialsFilePath = path.join(tempDir, '.gemini', 'gemini-credentials.json');
+        const rawEncryptedData = await fs.readFile(credentialsFilePath, 'utf-8');
+        // 3. Parse the encrypted data format (iv:authTag:encrypted)
+        const parts = rawEncryptedData.split(':');
+        expect(parts).toHaveLength(3);
+        const ivHex = parts[0];
+        const authTagHex = parts[1];
+        const encryptedHex = parts[2];
+        // 4. Create a truncated 4-byte IV (8 hex characters)
+        const truncatedIvHex = ivHex.substring(0, 8);
+        const truncatedEncryptedData = `${truncatedIvHex}:${authTagHex}:${encryptedHex}`;
+        // 5. Overwrite the credentials file with the truncated-IV payload
+        await fs.writeFile(credentialsFilePath, truncatedEncryptedData, 'utf-8');
+        // 6. Attempt to retrieve the password and verify it throws a clear, handled validation error
+        await expect(keychain.getPassword(service, account)).rejects.toThrow('Corrupted credentials file detected');
+    });
+});
+//# sourceMappingURL=gcmTruncationReproduction.test.js.map

package/dist/src/services/gcmTruncationReproduction.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcmTruncationReproduction.test.js","sourceRoot":"","sources":["../../../src/services/gcmTruncationReproduction.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,yDAAyD;QACzD,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAC5E,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,mCAAmC;QACnC,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,cAAc,CAAC;QAC/B,MAAM,OAAO,GAAG,cAAc,CAAC;QAC/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC;QAEvC,2DAA2D;QAC3D,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvD,2CAA2C;QAC3C,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CACnC,OAAO,EACP,SAAS,EACT,yBAAyB,CAC1B,CAAC;QACF,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAEzE,4DAA4D;QAC5D,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAE9B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAE5B,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAErD,qDAAqD;QACrD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE9B,2DAA2D;QAC3D,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB;QAExD,4DAA4D;QAC5D,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB;QAE1D,iEAAiE;QACjE,MAAM,iBAAiB,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACvE,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,cAAc,CAAC;QAC/B,MAAM,OAAO,GAAG,cAAc,CAAC;QAC/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC;QAEvC,kFAAkF;QAClF,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvD,wCAAwC;QACxC,IAAI,iBAAiB,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEzC,4DAA4D;QAC5D,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CACnC,OAAO,EACP,SAAS,EACT,yBAAyB,CAC1B,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,aAAa,GAAI,QAAiD;aACrE,aAAa,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAClC,aAAa,EACb,aAAa,EACb,QAAQ,EACR;YACE,aAAa,EAAE,EAAE;SAClB,CACF,CAAC;QAEF,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAC3B,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,EACtD,MAAM,EACN,KAAK,CACN,CAAC;QACF,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,MAAM,aAAa,GACjB,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YACxB,GAAG;YACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvB,GAAG;YACH,SAAS,CAAC;QACZ,MAAM,EAAE,CAAC,SAAS,CAAC,mBAAmB,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAEhE,8EAA8E;QAC9E,iBAAiB,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,cAAc,CAAC;QAC/B,MAAM,OAAO,GAAG,cAAc,CAAC;QAC/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC;QAEvC,2DAA2D;QAC3D,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvD,2CAA2C;QAC3C,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CACnC,OAAO,EACP,SAAS,EACT,yBAAyB,CAC1B,CAAC;QACF,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAEzE,4DAA4D;QAC5D,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAE9B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAE9B,sDAAsD;QACtD,MAAM,eAAe,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,sBAAsB,GAAG,GAAG,KAAK,IAAI,eAAe,IAAI,YAAY,EAAE,CAAC;QAE7E,mEAAmE;QACnE,MAAM,EAAE,CAAC,SAAS,CAAC,mBAAmB,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAC;QAEzE,6FAA6F;QAC7F,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAClE,qCAAqC,CACtC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,cAAc,CAAC;QAC/B,MAAM,OAAO,GAAG,cAAc,CAAC;QAC/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC;QAEvC,2DAA2D;QAC3D,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvD,2CAA2C;QAC3C,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CACnC,OAAO,EACP,SAAS,EACT,yBAAyB,CAC1B,CAAC;QACF,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAEzE,4DAA4D;QAC5D,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAE9B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAE9B,qDAAqD;QACrD,MAAM,cAAc,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,sBAAsB,GAAG,GAAG,cAAc,IAAI,UAAU,IAAI,YAAY,EAAE,CAAC;QAEjF,kEAAkE;QAClE,MAAM,EAAE,CAAC,SAAS,CAAC,mBAAmB,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAC;QAEzE,6FAA6F;QAC7F,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAClE,qCAAqC,CACtC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}