@onekeyfe/hd-core 1.2.8 → 1.2.10-alpha.2

package/__tests__/logBlockEvent.test.ts

@@ -4,7 +4,18 @@ import {
   formatLogMethodLabel,
   getLogBlockLabel,
   getSafeLogPayload,
+  getSafeLogTask,
 } from '../src/events';
+import { getLog, initLog, setLoggerPostMessage } from '../src/utils/logger';
+import MoneroGetAddress from '../src/api/monero/MoneroGetAddress';
+import ZcashGetAddress from '../src/api/zcash/ZcashGetAddress';
+
+import type { Device } from '../src/device/Device';
+
+jest.mock('../src/data/config', () => ({
+  getSDKVersion: jest.fn(() => '1.0.0'),
+  DEFAULT_DOMAIN: 'https://jssdk.onekey.so/1.0.0/',
+}));
 
 describe('getLogBlockLabel', () => {
   it('keeps existing sensitive UI response blocking', () => {
@@ -52,11 +63,17 @@ describe('getLogBlockLabel', () => {
     }
   );
 
-  it('logs signing requests and responses as-is', () => {
+  it.each([false, true])('redacts btcSignMessage logs with debug=%s', enabled => {
+    const method = 'btcSignMessage';
+    const prefix = `sensitive-btc-sign-message-${enabled}`;
+    const logger = initLog(prefix, enabled);
+    const postMessage = jest.fn();
+    setLoggerPostMessage(postMessage);
+    const consoleLog = jest.spyOn(console, 'log').mockImplementation(() => undefined);
     const request = {
-      method: 'btcSignMessage',
+      method,
       path: "m/44'/0'/0'/0/0",
-      messageHex: '68656c6c6f',
+      messageHex: Buffer.from('synthetic-message-marker').toString('hex'),
       coin: 'Bitcoin',
     };
     const iframeRequest = {
@@ -66,15 +83,39 @@ describe('getLogBlockLabel', () => {
     const response = {
       success: true,
       payload: {
-        signature: 'signature-bytes',
-        address: 'bc1qexample',
+        signature: 'synthetic-signature-marker',
+        address: 'synthetic-address-marker',
       },
     };
+    const task = { id: 7, method: { name: method, payload: request } };
+    const originals = JSON.stringify([request, iframeRequest, response, task]);
+    const blockLabel = getLogBlockLabel(iframeRequest);
 
-    expect(getLogBlockLabel(request)).toBeUndefined();
-    expect(getLogBlockLabel(iframeRequest)).toBeUndefined();
-    expect(getSafeLogPayload(request)).toBe(request);
-    expect(getSafeLogPayload(response)).toBe(response);
+    try {
+      expect(getLogBlockLabel(request)).toBe(method);
+      expect(blockLabel).toBe(method);
+      logger.debug('request:', getSafeLogPayload(iframeRequest, blockLabel));
+      logger.debug('response:', getSafeLogPayload(response, blockLabel));
+      logger.debug('Cancel Api connect task: ', getSafeLogTask(task));
+
+      const cached = getLog().filter(entry => entry.prefix === prefix);
+      expect(cached.map(entry => entry.message[1])).toEqual([
+        { method, payload: '[REDACTED]' },
+        { method, payload: '[REDACTED]' },
+        { id: task.id, method, payload: '[REDACTED]' },
+      ]);
+      expect(postMessage).toHaveBeenCalledTimes(3);
+      expect(consoleLog).toHaveBeenCalledTimes(enabled ? 3 : 0);
+      for (const output of [cached, postMessage.mock.calls, consoleLog.mock.calls]) {
+        const serialized = JSON.stringify(output);
+        expect(serialized).not.toContain('synthetic-');
+        expect(serialized).not.toContain(request.messageHex);
+      }
+      expect(JSON.stringify([request, iframeRequest, response, task])).toBe(originals);
+    } finally {
+      consoleLog.mockRestore();
+      setLoggerPostMessage(jest.fn());
+    }
   });
 
   it('keeps ordinary API requests and responses visible', () => {
@@ -96,4 +137,285 @@ describe('getLogBlockLabel', () => {
   it('does not classify events without an API method as method calls', () => {
     expect(getLogBlockLabel({ event: 'DEVICE_EVENT', type: 'device-connect' })).toBeUndefined();
   });
+
+  it.each(['zcashGetAddress', 'zcashGetFullViewingKey', 'zcashSignPczt'])(
+    'keeps %s wallet data out of logger caches and events with debug disabled',
+    method => {
+      const postMessage = jest.fn();
+      const prefix = `sensitive-zcash-${method}`;
+      const logger = initLog(prefix, false);
+      setLoggerPostMessage(postMessage);
+      const request = {
+        event: 'iframe-call',
+        payload: { method, pczt: 'synthetic-pczt-marker', path: 'synthetic-path-marker' },
+      };
+      const response = {
+        success: true,
+        payload: [
+          {
+            ufvk: 'synthetic-viewing-key-marker',
+            seedFingerprint: 'synthetic-fingerprint-marker',
+            pczt: 'synthetic-signed-pczt-marker',
+          },
+        ],
+      };
+      const blockLabel = getLogBlockLabel(request);
+
+      expect(blockLabel).toBe(method);
+      expect(getLogBlockLabel(request.payload)).toBe(method);
+      logger.debug('request:', getSafeLogPayload(request, blockLabel));
+      logger.debug('response:', getSafeLogPayload(response, blockLabel));
+
+      const cached = getLog().filter(entry => entry.prefix === prefix);
+      expect(cached.map(entry => entry.message[1])).toEqual([
+        { method, payload: '[REDACTED]' },
+        { method, payload: '[REDACTED]' },
+      ]);
+      expect(postMessage).toHaveBeenCalledTimes(2);
+      for (const output of [JSON.stringify(cached), JSON.stringify(postMessage.mock.calls)]) {
+        expect(output).not.toContain('synthetic-');
+        expect(output).toContain('[REDACTED]');
+      }
+      expect(response.payload[0].ufvk).toBe('synthetic-viewing-key-marker');
+    }
+  );
+
+  it.each(['moneroGetAddress', 'moneroGetWatchKey'])(
+    'keeps %s addresses and view keys out of logger caches',
+    method => {
+      const prefix = `sensitive-monero-${method}`;
+      const logger = initLog(prefix, false);
+      setLoggerPostMessage(jest.fn());
+      const request = { event: 'iframe-call', payload: { method, path: "m/44'/128'/0'" } };
+      const response = {
+        success: true,
+        payload: { address: 'synthetic-address-marker', watchKey: 'synthetic-view-key-marker' },
+      };
+      const blockLabel = getLogBlockLabel(request);
+
+      expect(blockLabel).toBe(method);
+      logger.debug('response:', getSafeLogPayload(response, blockLabel));
+
+      const cached = getLog().filter(entry => entry.prefix === prefix);
+      expect(cached.map(entry => entry.message[1])).toEqual([{ method, payload: '[REDACTED]' }]);
+      expect(JSON.stringify(cached)).not.toContain('synthetic-');
+    }
+  );
+
+  it('keeps moneroKeyImageSync transfers and key images out of logger caches', () => {
+    const method = 'moneroKeyImageSync';
+    const prefix = 'sensitive-monero-key-image-sync';
+    const logger = initLog(prefix, false);
+    setLoggerPostMessage(jest.fn());
+    const request = {
+      event: 'iframe-call',
+      payload: {
+        method,
+        path: "m/44'/128'/0'",
+        transfers: [{ outKey: 'synthetic-out-key-marker', txPubKey: 'synthetic-tx-key-marker' }],
+      },
+    };
+    const response = {
+      success: true,
+      payload: {
+        encKey: 'synthetic-enc-key-marker',
+        keyImages: [{ iv: 'synthetic-iv-marker', blob: 'synthetic-key-image-marker' }],
+      },
+    };
+    const blockLabel = getLogBlockLabel(request);
+
+    expect(blockLabel).toBe(method);
+    logger.debug('request:', getSafeLogPayload(request, blockLabel));
+    logger.debug('response:', getSafeLogPayload(response, blockLabel));
+
+    const cached = getLog().filter(entry => entry.prefix === prefix);
+    expect(cached.map(entry => entry.message[1])).toEqual([
+      { method, payload: '[REDACTED]' },
+      { method, payload: '[REDACTED]' },
+    ]);
+    expect(JSON.stringify(cached)).not.toContain('synthetic-');
+  });
+
+  // The request reveals the real ring member, masks and amounts; the result
+  // carries the key that opens the signatures.
+  it('keeps moneroSignTransaction inputs and the opening key out of logger caches', () => {
+    const method = 'moneroSignTransaction';
+    const prefix = 'sensitive-monero-sign-transaction';
+    const logger = initLog(prefix, false);
+    setLoggerPostMessage(jest.fn());
+    const payload = {
+      method,
+      path: "m/44'/128'/0'",
+      tsxData: { fee: 'synthetic-fee-marker', outputs: [{ amount: 'synthetic-amount-marker' }] },
+      inputs: [{ real_output: 'synthetic-real-index-marker', mask: 'synthetic-mask-marker' }],
+    };
+    const response = {
+      success: true,
+      payload: {
+        signatures: ['synthetic-sealed-signature-marker'],
+        openingKey: 'synthetic-opening-key-marker',
+      },
+    };
+    const blockLabel = getLogBlockLabel({ event: 'iframe-call', payload });
+
+    expect(blockLabel).toBe(method);
+    logger.debug('request:', getSafeLogPayload(payload, blockLabel));
+    logger.debug('response:', getSafeLogPayload(response, blockLabel));
+    logger.debug('Cancel Api connect task: ', getSafeLogTask({ id: 9, method: { payload } }));
+
+    const cached = getLog().filter(entry => entry.prefix === prefix);
+    expect(cached.map(entry => entry.message[1])).toEqual([
+      { method, payload: '[REDACTED]' },
+      { method, payload: '[REDACTED]' },
+      { id: 9, method, payload: '[REDACTED]' },
+    ]);
+    expect(JSON.stringify(cached)).not.toContain('synthetic-');
+  });
+
+  // Cancel logs the queued task, which holds the method's raw payload.
+  it('redacts a queued Zcash task the same way, keeping its id', () => {
+    const postMessage = jest.fn();
+    const prefix = 'sensitive-zcash-cancel';
+    const logger = initLog(prefix, false);
+    setLoggerPostMessage(postMessage);
+    const task = {
+      id: 7,
+      method: {
+        name: 'zcashSignPczt',
+        payload: { method: 'zcashSignPczt', pczt: 'synthetic-pczt-marker' },
+        pczt: 'synthetic-pczt-marker',
+      },
+    };
+
+    logger.debug('Cancel Api connect task: ', getSafeLogTask(task));
+
+    const cached = getLog().filter(entry => entry.prefix === prefix);
+    expect(cached.map(entry => entry.message[1])).toEqual([
+      { id: 7, method: 'zcashSignPczt', payload: '[REDACTED]' },
+    ]);
+    expect(JSON.stringify([cached, postMessage.mock.calls])).not.toContain('synthetic-');
+  });
+
+  it('keeps Zcash and Monero results of an all-network call out of logs, others intact', () => {
+    const response = {
+      success: true,
+      payload: [
+        {
+          network: 'evm',
+          path: "m/44'/60'/0'/0/0",
+          success: true,
+          payload: { address: '0xabc', rootFingerprint: 1 },
+        },
+        {
+          network: 'zcash',
+          path: "m/32'/133'/0'",
+          success: true,
+          payload: {
+            address: 'u1-marker',
+            ufvk: 'synthetic-viewing-key-marker',
+            rootFingerprint: 1,
+          },
+        },
+        {
+          network: 'xmr',
+          path: "m/44'/128'/0'",
+          success: true,
+          payload: { address: 'synthetic-xmr-address-marker', rootFingerprint: 1 },
+        },
+        {
+          network: 'zcash',
+          path: "m/32'/133'/1'",
+          success: false,
+          payload: { error: 'Device not support', code: 416 },
+        },
+      ],
+    };
+
+    const safe = getSafeLogPayload(response) as typeof response;
+
+    expect(safe.payload[0]).toBe(response.payload[0]);
+    expect(safe.payload[1]).toEqual({ ...response.payload[1], payload: '[REDACTED]' });
+    expect(safe.payload[2]).toEqual({ ...response.payload[2], payload: '[REDACTED]' });
+    expect(safe.payload[3]).toBe(response.payload[3]);
+    expect(JSON.stringify(safe)).not.toContain('marker');
+    expect(response.payload[1].payload).toHaveProperty('ufvk');
+  });
+
+  it('redacts a privacy network result delivered one by one as a callback', () => {
+    const message = {
+      event: 'IFRAME_CALLBACK',
+      payload: {
+        callbackId: 'item',
+        data: {
+          network: 'zcash',
+          success: true,
+          payload: { ufvk: 'synthetic-viewing-key-marker' },
+          index: 0,
+        },
+      },
+    };
+
+    expect(JSON.stringify(getSafeLogPayload(message))).not.toContain('marker');
+  });
+
+  it.each([
+    {
+      method: 'moneroGetAddress',
+      create: () =>
+        new MoneroGetAddress({
+          id: 1,
+          payload: { method: 'moneroGetAddress', path: "m/44'/128'/0'" },
+        }),
+      reply: { address: Buffer.from('synthetic-xmr-address-marker').toString('hex') },
+    },
+    {
+      method: 'zcashGetAddress',
+      create: () =>
+        new ZcashGetAddress({
+          id: 1,
+          payload: { method: 'zcashGetAddress', path: "m/32'/133'/0'" },
+        }),
+      reply: { address: 'synthetic-zcash-address-marker' },
+    },
+  ])('keeps the $method previous-address event out of logs', async ({ method, create, reply }) => {
+    const instance = create();
+    instance.init();
+    const commands = { typedCall: jest.fn().mockResolvedValue({ message: reply }) };
+    instance.device = {
+      commands,
+      getCommands: () => commands,
+      toMessageObject: () => ({}),
+    } as unknown as Device;
+    const postMessage = jest.fn();
+    instance.postMessage = postMessage;
+    await instance.run();
+
+    const [[event]] = postMessage.mock.calls;
+    expect(event).toMatchObject({
+      type: UI_REQUEST.PREVIOUS_ADDRESS_RESULT,
+      payload: { method, data: { address: expect.stringContaining('synthetic-') } },
+    });
+    const blockLabel = getLogBlockLabel(event);
+    expect(blockLabel).toBe(method);
+    expect(JSON.stringify(getSafeLogPayload(event, blockLabel))).not.toContain('synthetic-');
+  });
+
+  it('keeps previous-address events of other methods visible', () => {
+    const event = {
+      event: 'UI_EVENT',
+      type: UI_REQUEST.PREVIOUS_ADDRESS_RESULT,
+      payload: { device: {}, method: 'btcGetAddress', data: { address: 'bc1qexample' } },
+    };
+    expect(getLogBlockLabel(event)).toBeUndefined();
+    expect(getSafeLogPayload(event)).toBe(event);
+  });
+
+  it('logs other queued tasks as before', () => {
+    const task = {
+      id: 8,
+      method: { name: 'getDeviceState', payload: { method: 'getDeviceState' } },
+    };
+    expect(getSafeLogTask(task)).toBe(task);
+    expect(getSafeLogTask(undefined)).toBeUndefined();
+  });
 });

package/__tests__/logger.test.ts

@@ -0,0 +1,18 @@
+import { LoggerNames, enableLog, getLogger } from '../src/utils/logger';
+
+describe('logger', () => {
+  afterEach(() => {
+    enableLog(false);
+    jest.restoreAllMocks();
+  });
+
+  test('enables method logs that share a prefix with common-connect-sdk', () => {
+    const consoleSpy = jest.spyOn(console, 'log').mockImplementation(() => undefined);
+    enableLog(true);
+
+    expect(getLogger(LoggerNames.Method)).toBe(getLogger(LoggerNames.HdCommonConnectSdk));
+    getLogger(LoggerNames.Method).debug('shared prefix message');
+
+    expect(consoleSpy).toHaveBeenCalledWith(LoggerNames.Method, 'shared prefix message');
+  });
+});

package/__tests__/monero-get-address.test.ts

@@ -0,0 +1,147 @@
+import MoneroGetAddress from '../src/api/monero/MoneroGetAddress';
+import MoneroGetWatchKey from '../src/api/monero/MoneroGetWatchKey';
+import { toHardened } from '../src/api/helpers/pathUtils';
+
+import type { Device } from '../src/device/Device';
+
+jest.mock('../src/data/config', () => ({
+  getSDKVersion: jest.fn(() => '1.0.0'),
+  DEFAULT_DOMAIN: 'https://jssdk.onekey.so/1.0.0/',
+}));
+
+// firmware-pro tests/device_tests/monero/test_getwatchkey.py, account 0.
+const ADDRESS =
+  '4Ahp23WfMrMFK3wYL2hLWQFGt87ZTeRkufS6JoQZu6MEFDokAQeGWmu9MA3GFq1yVLSJQbKJqVAn9F9DLYGpRzRAEXqAXKM';
+const WATCH_KEY = '8722520a581e2a50cc1adab4a1692401effd37b0d63b9d9b60fd7f34ea2b950e';
+const ascii = (value: string) => Buffer.from(value, 'utf-8').toString('hex');
+const ACCOUNT_0 = [toHardened(44), toHardened(128), toHardened(0)];
+
+const attachDevice = (method: MoneroGetAddress | MoneroGetWatchKey, typedCall: jest.Mock) => {
+  const commands = { typedCall };
+  method.device = {
+    commands,
+    getCommands: () => commands,
+    toMessageObject: () => ({}),
+  } as unknown as Device;
+  method.postMessage = jest.fn();
+};
+
+const createAddressMethod = (payload: Record<string, unknown>) =>
+  new MoneroGetAddress({ id: 1, payload: { method: 'moneroGetAddress', ...payload } });
+const createWatchKeyMethod = (payload: Record<string, unknown>) =>
+  new MoneroGetWatchKey({ id: 1, payload: { method: 'moneroGetWatchKey', ...payload } });
+
+describe('MoneroGetAddress', () => {
+  test('asks for the account address and decodes the ASCII reply', async () => {
+    const method = createAddressMethod({ path: "m/44'/128'/0'" });
+    method.init();
+    const typedCall = jest
+      .fn()
+      .mockResolvedValue({ type: 'MoneroAddress', message: { address: ascii(ADDRESS) } });
+    attachDevice(method, typedCall);
+
+    await expect(method.run()).resolves.toEqual({ path: "m/44'/128'/0'", address: ADDRESS });
+    expect(typedCall).toHaveBeenCalledWith('MoneroGetAddress', 'MoneroAddress', {
+      address_n: ACCOUNT_0,
+      network_type: 0,
+      show_display: true,
+    });
+  });
+
+  test('returns one entry per bundle item', async () => {
+    const method = createAddressMethod({
+      bundle: [
+        { path: "m/44'/128'/0'", showOnOneKey: false },
+        { path: "m/44'/128'/1'", showOnOneKey: false },
+      ],
+    });
+    method.init();
+    const typedCall = jest
+      .fn()
+      .mockResolvedValue({ type: 'MoneroAddress', message: { address: ascii(ADDRESS) } });
+    attachDevice(method, typedCall);
+
+    const result = await method.run();
+    expect(result).toHaveLength(2);
+    expect(typedCall.mock.calls[1][2]).toMatchObject({ show_display: false });
+  });
+
+  test('leaves which paths are allowed to the device', () => {
+    const method = createAddressMethod({ path: "m/44'/128'/0'/0/0" });
+    method.init();
+    expect(method.params[0].address_n).toEqual([...ACCOUNT_0, 0, 0]);
+  });
+
+  test('rejects an unknown network type', () => {
+    expect(() => createAddressMethod({ path: "m/44'/128'/0'", networkType: 3 }).init()).toThrow();
+  });
+
+  // Each of these would otherwise be sent as account 0'.
+  test.each([
+    ["m/44'/128'/2147483648'"],
+    ["m/44'/128'/4294967296'"],
+    ["m/44'/128'/0.5'"],
+    ["m/44'/128'/0x0'"],
+    ["m/44'/128'/0h"],
+    ["m/44'/128'/2147483648"],
+    [[...ACCOUNT_0.slice(0, 2), 0x100000000 + toHardened(0)]],
+    [[...ACCOUNT_0.slice(0, 2), toHardened(0) + 0.5]],
+  ])('rejects the account path %j instead of aliasing it to another account', path => {
+    for (const method of [createAddressMethod({ path }), createWatchKeyMethod({ path })]) {
+      expect(() => method.init()).toThrow('Not a valid path');
+    }
+  });
+
+  test.each([
+    ["m/44'/128'/2147483647'", [...ACCOUNT_0.slice(0, 2), 0xffffffff]],
+    [
+      [...ACCOUNT_0.slice(0, 2), 0xffffffff],
+      [...ACCOUNT_0.slice(0, 2), 0xffffffff],
+    ],
+  ])('accepts the largest hardened account %j', (path, addressN) => {
+    const method = createWatchKeyMethod({ path });
+    method.init();
+    expect(method.params[0].address_n).toEqual(addressN);
+  });
+
+  test('fails when the device omits the address', async () => {
+    const method = createAddressMethod({ path: "m/44'/128'/0'" });
+    method.init();
+    attachDevice(method, jest.fn().mockResolvedValue({ type: 'MoneroAddress', message: {} }));
+
+    await expect(method.run()).rejects.toThrow();
+  });
+});
+
+describe('MoneroGetWatchKey', () => {
+  test('returns the view key and the decoded address', async () => {
+    const method = createWatchKeyMethod({ path: "m/44'/128'/0'" });
+    method.init();
+    const typedCall = jest.fn().mockResolvedValue({
+      type: 'MoneroWatchKey',
+      message: { watch_key: WATCH_KEY, address: ascii(ADDRESS) },
+    });
+    attachDevice(method, typedCall);
+
+    await expect(method.run()).resolves.toEqual({
+      path: "m/44'/128'/0'",
+      watchKey: WATCH_KEY,
+      address: ADDRESS,
+    });
+    expect(typedCall).toHaveBeenCalledWith('MoneroGetWatchKey', 'MoneroWatchKey', {
+      address_n: ACCOUNT_0,
+      network_type: 0,
+    });
+  });
+
+  test('fails when the device omits the view key', async () => {
+    const method = createWatchKeyMethod({ path: "m/44'/128'/0'" });
+    method.init();
+    attachDevice(
+      method,
+      jest.fn().mockResolvedValue({ type: 'MoneroWatchKey', message: { address: ascii(ADDRESS) } })
+    );
+
+    await expect(method.run()).rejects.toThrow();
+  });
+});