@secrecy/lib 1.86.2-fix-metrics.1 → 1.86.2-fix-md5.1

package/dist/lib/client/SecrecyCloudClient.js

@@ -702,8 +702,10 @@ export class SecrecyCloudClient {
         const src = key
             ? await decrypt(key, encryptedContent, progressDecrypt, signal)
             : encryptedContent;
-        const md5Content = await md5(src);
-        if (md5Content !== dataContent.md5) {
+        // Encrypted data is authenticated by the stream: only public data has an md5.
+        if (!key &&
+            dataContent.md5 !== null &&
+            (await md5(src)) !== dataContent.md5) {
             throw new Error(`Content does not match`);
         }
         const decompressed = decompress(src);

package/dist/lib/client/data-link.js

@@ -1,14 +1,13 @@
 import z from 'zod';
 import { buildBytesFromDataLink } from '../crypto/domain';
 import { sodium } from '../sodium';
-import { derivePassword } from '../crypto/helpers';
-import { decryptSecretBox } from '../crypto';
+import { decryptKeyWithPassword } from '../crypto/helpers';
 import { decrypt } from '../worker/sodium';
-import { md5 } from '../worker/md5';
 import { decompress } from '../minify';
 const downloadDataLinkS3Schema = z.object({
     name: z.string(),
-    md5: z.string(),
+    // Only for unencrypted and legacy encrypted data.
+    md5: z.string().nullable(),
     md5Encrypted: z.string().nullable(),
     size: z.coerce.bigint().gte(0n),
     parts: z.array(z.object({ order: z.number(), md5: z.string(), contentUrl: z.string() })),
@@ -17,7 +16,8 @@ const downloadDataLinkS3Schema = z.object({
 });
 const downloadDataLinkLiteSchema = z.object({
     name: z.string(),
-    md5: z.string(),
+    // Only for unencrypted and legacy encrypted data.
+    md5: z.string().nullable(),
     md5Encrypted: z.string().nullable(),
     size: z.coerce.bigint().gte(0n),
     bytes: z.string(),
@@ -69,14 +69,8 @@ export async function downloadDataFromLink(opts) {
         throw new Error('Unable to read encrypted data without password!');
     }
     try {
-        const salt = sodium.crypto_generichash(sodium.crypto_pwhash_SALTBYTES, opts.crypto.password + dataLink.md5);
-        const derivedPassword = derivePassword(opts.crypto.password, salt);
-        const decryptedSharingDataKey = decryptSecretBox(sodium.from_hex(opts.crypto.key), derivedPassword);
+        const decryptedSharingDataKey = decryptKeyWithPassword(sodium.from_hex(opts.crypto.key), opts.crypto.password);
         const decryptedBytes = await decrypt(decryptedSharingDataKey, bytes, opts.decryptProgress, opts.signal);
-        const md5Content = await md5(decryptedBytes);
-        if (md5Content !== dataLink.md5) {
-            throw new Error(`Content does not match`);
-        }
         return decompress(decryptedBytes);
     }
     catch (err) {

package/dist/lib/client/helpers.js

@@ -9,7 +9,9 @@ export function parseInfos() {
     const hash = window.location.hash.substr(1);
     try {
         const res = JSON.parse(atob(hash));
-        window.location.hash = '';
+        // Replace (not push) the entry: the fragment holds the private keys and
+        // must not stay in the browser history.
+        window.history.replaceState(window.history.state, '', window.location.pathname + window.location.search);
         const data = secrecyUserApp.safeParse(res);
         return data.success ? data.data : null;
     }

package/dist/lib/client/upload.js

@@ -8,8 +8,8 @@ import { chunks, enumerate } from '../utils/array.js';
 import { getTrpcGuestClient, } from '../client.js';
 import axios from 'axios';
 import { encryptDataAndKey } from '../crypto/domain.js';
-import { derivePassword, generatePassword } from '../crypto/helpers.js';
-import { decryptCryptoBox, encryptSecretBox } from '../crypto/index.js';
+import { encryptKeyWithPassword, generatePassword } from '../crypto/helpers.js';
+import { decryptCryptoBox } from '../crypto/index.js';
 export async function uploadData({ storageType, data, password, forcePassword = false, encrypted = true, encryptProgress, uploadProgress, signal, meta, currentIdentity, keyPairs, apiClient, }) {
     if (!encrypted && (password || forcePassword)) {
         throw new Error('Cannot share unencrypted data with a password!');
@@ -40,7 +40,10 @@ export async function uploadData({ storageType, data, password, forcePassword =
         throw new Error('Cold storage is only for logged users!');
     }
     const compressed = encrypted ? compress(dataBuffer) : dataBuffer;
-    let { encryptedData, encryptedDataKey, dataKey, md5Data, md5Encrypted } = encrypted
+    // Only unencrypted (public) data sends the md5 of its content, computed in
+    // the requests below: for encrypted data it would let the server
+    // fingerprint the plaintext.
+    let { encryptedData, encryptedDataKey, dataKey, md5Encrypted } = encrypted
         ? await encryptDataAndKey({
             data: compressed,
             progress: encryptProgress,
@@ -52,7 +55,6 @@ export async function uploadData({ storageType, data, password, forcePassword =
             encryptedData: compressed,
             encryptedDataKey: null,
             dataKey: null,
-            md5Data: await md5(compressed),
             md5Encrypted: null,
         };
     await uploadProgress?.({
@@ -63,8 +65,6 @@ export async function uploadData({ storageType, data, password, forcePassword =
     const createSharing = ({ data, }) => {
         if (dataKey && (password || forcePassword)) {
             password ??= generatePassword();
-            const salt = sodium.crypto_generichash(sodium.crypto_pwhash_SALTBYTES, password + md5Data);
-            const derivedPassword = derivePassword(password, salt);
             let key;
             if (data.type === 'guest' ||
                 (data.type === 'authed' &&
@@ -88,7 +88,7 @@ export async function uploadData({ storageType, data, password, forcePassword =
             // NOTE: Process to create a sharing for a auth client (todo: endpoint)
             return {
                 password,
-                encryptedDataKey: sodium.to_hex(encryptSecretBox(key, derivedPassword)),
+                encryptedDataKey: sodium.to_hex(encryptKeyWithPassword(key, password)),
             };
         }
         return null;
@@ -102,14 +102,13 @@ export async function uploadData({ storageType, data, password, forcePassword =
                 size: BigInt(dataBuffer.byteLength),
                 key: encryptedDataKey ? sodium.to_hex(encryptedDataKey) : undefined,
                 md5Encrypted,
-                md5: md5Data,
                 fromIdentityPubKey: currentIdentity?.identityPubKey,
                 ...filetype,
             }
             : {
                 type: 'unencrypted',
                 content: Buffer.from(encryptedData),
-                md5: md5Data,
+                md5: await md5(compressed),
                 size: BigInt(dataBuffer.byteLength),
                 fromIdentityPubKey: currentIdentity?.identityPubKey,
                 ...filetype,
@@ -124,7 +123,7 @@ export async function uploadData({ storageType, data, password, forcePassword =
         const localData = {
             id: uploadData.id,
             storageType: 'lite',
-            md5: uploadDataArgs.md5,
+            md5: uploadDataArgs.type === 'unencrypted' ? uploadDataArgs.md5 : null,
             size: uploadDataArgs.size,
             sizeEncrypted: uploadDataArgs.type === 'encrypted'
                 ? uploadDataArgs.sizeEncrypted
@@ -146,13 +145,12 @@ export async function uploadData({ storageType, data, password, forcePassword =
                 size: BigInt(dataBuffer.byteLength),
                 key: encryptedDataKey ? sodium.to_hex(encryptedDataKey) : undefined,
                 md5Encrypted,
-                md5: md5Data,
                 fromIdentityPubKey: currentIdentity?.identityPubKey,
                 ...filetype,
             }
             : {
                 type: 'unencrypted',
-                md5: md5Data,
+                md5: await md5(compressed),
                 size: BigInt(dataBuffer.byteLength),
                 fromIdentityPubKey: currentIdentity?.identityPubKey,
                 ...filetype,
@@ -173,7 +171,7 @@ export async function uploadData({ storageType, data, password, forcePassword =
             const localData = {
                 id: uploadData.id,
                 storageType: storageType,
-                md5: uploadDataArgs.md5,
+                md5: uploadDataArgs.type === 'unencrypted' ? uploadDataArgs.md5 : null,
                 size: uploadDataArgs.size,
                 sizeEncrypted: uploadDataArgs.type === 'encrypted'
                     ? uploadDataArgs.sizeEncrypted
@@ -257,7 +255,7 @@ export async function uploadData({ storageType, data, password, forcePassword =
         const localData = {
             id: uploadData.id,
             storageType: storageType,
-            md5: uploadDataArgs.md5,
+            md5: uploadDataArgs.type === 'unencrypted' ? uploadDataArgs.md5 : null,
             size: uploadDataArgs.size,
             sizeEncrypted: uploadDataArgs.type === 'encrypted'
                 ? uploadDataArgs.sizeEncrypted

package/dist/lib/crypto/data.js

@@ -1,6 +1,5 @@
 import { setup, sodium } from '../sodium.js';
 import SparkMD5 from 'spark-md5';
-import { chunks } from '../utils/array.js';
 function assert(c, message) {
     if (!c) {
         throw new Error(message);
@@ -9,7 +8,19 @@ function assert(c, message) {
 export function secretStreamKeygen() {
     return sodium.crypto_secretstream_xchacha20poly1305_keygen();
 }
+function assertKey(key) {
+    assert(key.byteLength === sodium.crypto_secretstream_xchacha20poly1305_KEYBYTES, `key must be KEYBYTES (${sodium.crypto_secretstream_xchacha20poly1305_KEYBYTES}) long`);
+}
+// The wrappers return the secretstream state as a raw address in the wasm
+// heap and never release it: wipe it (it holds the stream key) and free it.
+function wipeState(state) {
+    const lib = sodium.libsodium;
+    const size = lib._crypto_secretstream_xchacha20poly1305_statebytes();
+    lib.HEAPU8.fill(0, state, state + size);
+    lib._free(state);
+}
 function encrypt(key) {
+    assertKey(key);
     let destroyed = false;
     const { state, header } = sodium.crypto_secretstream_xchacha20poly1305_init_push(key);
     const encrypt = (tag, plaintext) => {
@@ -19,6 +30,7 @@ function encrypt(key) {
     function destroy() {
         assert(!destroyed, 'state already destroyed');
         destroyed = true;
+        wipeState(state);
     }
     return {
         encrypt,
@@ -27,9 +39,9 @@ function encrypt(key) {
     };
 }
 function decrypt(header, key) {
-    assert(header.byteLength >=
-        sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES, `header must be at least HEADERBYTES (${sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES}) long`);
-    assert(key.byteLength >= sodium.crypto_secretstream_xchacha20poly1305_KEYBYTES, `key must be at least KEYBYTES (${sodium.crypto_secretstream_xchacha20poly1305_KEYBYTES}) long`);
+    assert(header.byteLength ===
+        sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES, `header must be HEADERBYTES (${sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES}) long`);
+    assertKey(key);
     let destroyed = false;
     const state = sodium.crypto_secretstream_xchacha20poly1305_init_pull(header, key);
     const decrypt = (ciphertext) => {
@@ -39,6 +51,7 @@ function decrypt(header, key) {
     function destroy() {
         assert(!destroyed, 'state already destroyed');
         destroyed = true;
+        wipeState(state);
     }
     return {
         decrypt,
@@ -46,104 +59,146 @@ function decrypt(header, key) {
     };
 }
 export const CHUNK_SIZE = 8192;
+/**
+ * Encrypt `data` as a secretstream: the header followed by one authenticated
+ * chunk per CHUNK_SIZE bytes of plaintext. The last chunk (an empty one for
+ * empty data) is always tagged `TAG_FINAL` so that truncation is detected.
+ */
 export async function encryptSecretStream(key, data, progress, signal) {
     await setup();
     const { encrypt: crypt, destroy, header } = encrypt(key);
-    const encryptedChunk = CHUNK_SIZE + sodium.crypto_secretstream_xchacha20poly1305_ABYTES;
-    const max = Math.ceil(data.byteLength / CHUNK_SIZE) * encryptedChunk + header.byteLength;
-    void progress?.({
-        percent: 0,
-        total: max,
-        current: 0,
-    });
-    const final = new Uint8Array(max);
-    const sparkEncrypted = new SparkMD5.ArrayBuffer();
-    const spark = new SparkMD5.ArrayBuffer();
-    final.set(header);
-    sparkEncrypted.append(header.buffer);
-    let total = header.byteLength;
-    void progress?.({
-        percent: total / max,
-        total: max,
-        current: total,
-    });
-    let lastPercent = total / max;
-    for (const chunk of chunks(data, CHUNK_SIZE)) {
-        if (signal?.aborted === true) {
-            throw new Error(`Encrypt aborted`);
-        }
-        spark.append(chunk.buffer);
-        const tag = chunk.length < CHUNK_SIZE
-            ? sodium.crypto_secretstream_xchacha20poly1305_TAG_FINAL
-            : sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE;
-        const encrypted = crypt(tag, chunk);
-        sparkEncrypted.append(encrypted.buffer);
-        final.set(encrypted, total);
-        total += encrypted.byteLength;
-        const percent = total / max;
-        if (percent > lastPercent + 0.01) {
-            void progress?.({
-                percent,
-                total: max,
-                current: total,
-            });
-            lastPercent = percent;
+    try {
+        const chunkCount = Math.max(1, Math.ceil(data.byteLength / CHUNK_SIZE));
+        const max = header.byteLength +
+            data.byteLength +
+            chunkCount * sodium.crypto_secretstream_xchacha20poly1305_ABYTES;
+        void progress?.({
+            percent: 0,
+            total: max,
+            current: 0,
+        });
+        const final = new Uint8Array(max);
+        const sparkEncrypted = new SparkMD5.ArrayBuffer();
+        final.set(header);
+        sparkEncrypted.append(header.buffer);
+        let total = header.byteLength;
+        void progress?.({
+            percent: total / max,
+            total: max,
+            current: total,
+        });
+        let lastPercent = total / max;
+        for (let i = 0; i < chunkCount; i++) {
+            if (signal?.aborted === true) {
+                throw new Error(`Encrypt aborted`);
+            }
+            const chunk = data.subarray(i * CHUNK_SIZE, (i + 1) * CHUNK_SIZE);
+            const tag = i === chunkCount - 1
+                ? sodium.crypto_secretstream_xchacha20poly1305_TAG_FINAL
+                : sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE;
+            const encrypted = crypt(tag, chunk);
+            sparkEncrypted.append(encrypted.buffer);
+            final.set(encrypted, total);
+            total += encrypted.byteLength;
+            const percent = total / max;
+            if (percent > lastPercent + 0.01) {
+                void progress?.({
+                    percent,
+                    total: max,
+                    current: total,
+                });
+                lastPercent = percent;
+            }
         }
+        void progress?.({
+            percent: 1,
+            total,
+            current: total,
+        });
+        return {
+            data: final,
+            md5Encrypted: sparkEncrypted.end(),
+        };
+    }
+    finally {
+        destroy();
     }
-    destroy();
-    void progress?.({
-        percent: 1,
-        total,
-        current: total,
-    });
-    return {
-        data: final.slice(0, total),
-        md5Encrypted: sparkEncrypted.end(),
-        md5: spark.end(),
-    };
 }
+/**
+ * Decrypt a secretstream produced by `encryptSecretStream`. Throws if any
+ * chunk fails authentication, if data follows the `TAG_FINAL` chunk, or if the
+ * stream ends without it (truncation).
+ */
 export async function decryptSecretStream(key, data, progress, signal) {
     await setup();
-    const header = data.slice(0, sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES);
-    data = data.slice(sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES);
-    const { decrypt: decryptFn, destroy } = decrypt(header, key);
+    const headerBytes = sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES;
     const chunkSize = CHUNK_SIZE + sodium.crypto_secretstream_xchacha20poly1305_ABYTES;
-    const max = Math.ceil(data.byteLength / chunkSize) * CHUNK_SIZE;
-    void progress?.({
-        percent: 0,
-        total: max,
-        current: 0,
-    });
-    const final = new Uint8Array(max);
-    let total = 0;
-    let lastPercent = total / max;
-    for (const chunk of chunks(data, chunkSize)) {
-        if (signal?.aborted === true) {
-            throw new Error(`Decrypt aborted`);
-        }
-        const messageTag = decryptFn(chunk);
-        if (typeof messageTag === 'boolean') {
-            throw new Error('Unable to decrypt the data!');
+    // A valid stream always holds at least one (possibly empty) chunk.
+    if (data.byteLength <
+        headerBytes + sodium.crypto_secretstream_xchacha20poly1305_ABYTES) {
+        throw new Error('Unable to decrypt the data: the data is too short!');
+    }
+    const header = data.slice(0, headerBytes);
+    const body = data.subarray(headerBytes);
+    const chunkCount = Math.ceil(body.byteLength / chunkSize);
+    const max = body.byteLength -
+        chunkCount * sodium.crypto_secretstream_xchacha20poly1305_ABYTES;
+    const { decrypt: decryptFn, destroy } = decrypt(header, key);
+    try {
+        void progress?.({
+            percent: 0,
+            total: max,
+            current: 0,
+        });
+        const final = new Uint8Array(max);
+        let total = 0;
+        let finalTagSeen = false;
+        let lastPercent = total / max;
+        for (let i = 0; i < chunkCount; i++) {
+            if (signal?.aborted === true) {
+                throw new Error(`Decrypt aborted`);
+            }
+            const chunk = body.subarray(i * chunkSize, (i + 1) * chunkSize);
+            if (finalTagSeen) {
+                throw new Error('Unable to decrypt the data: unexpected data after the final chunk!');
+            }
+            const messageTag = decryptFn(chunk);
+            if (typeof messageTag === 'boolean') {
+                throw new Error('Unable to decrypt the data!');
+            }
+            if (messageTag.tag ===
+                sodium.crypto_secretstream_xchacha20poly1305_TAG_FINAL) {
+                finalTagSeen = true;
+            }
+            else if (messageTag.tag !==
+                sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE) {
+                throw new Error('Unable to decrypt the data: unexpected chunk tag!');
+            }
+            final.set(messageTag.message, total);
+            total += messageTag.message.byteLength;
+            const percent = total / max;
+            if (percent > lastPercent + 0.01) {
+                void progress?.({
+                    percent,
+                    total: max,
+                    current: total,
+                });
+                lastPercent = percent;
+            }
         }
-        final.set(messageTag.message, total);
-        total += messageTag.message.byteLength;
-        const percent = total / max;
-        if (percent > lastPercent + 0.01) {
-            void progress?.({
-                percent,
-                total: max,
-                current: total,
-            });
-            lastPercent = percent;
+        if (!finalTagSeen) {
+            throw new Error('Unable to decrypt the data: the data is truncated!');
         }
+        void progress?.({
+            percent: 1,
+            total,
+            current: total,
+        });
+        return final;
+    }
+    finally {
+        destroy();
     }
-    destroy();
-    void progress?.({
-        percent: 1,
-        total,
-        current: total,
-    });
-    return final.slice(0, total);
 }
 // async function mainSecretStream(random: Uint8Array): Promise<vo id> {
 //   const key = secretstreamKeygen();

package/dist/lib/crypto/domain.js

@@ -11,12 +11,11 @@ import { concatenate } from '../utils/array.js';
  */
 export async function encryptDataAndKey({ data, currentIdentity, keyPairs, progress, signal, }) {
     const dataKey = secretStreamKeygen();
-    const { data: encryptedData, md5: md5Data, md5Encrypted, } = await encrypt(dataKey, data, progress, signal);
+    const { data: encryptedData, md5Encrypted } = await encrypt(dataKey, data, progress, signal);
     if (!currentIdentity || !keyPairs) {
         return {
             encryptedData,
             dataKey,
-            md5Data,
             md5Encrypted,
         };
     }
@@ -29,7 +28,6 @@ export async function encryptDataAndKey({ data, currentIdentity, keyPairs, progr
         encryptedDataKey: encDataKey,
         encryptedData,
         dataKey,
-        md5Data,
         md5Encrypted,
     };
 }

package/dist/lib/crypto/helpers.js

@@ -1,5 +1,6 @@
-import { encryptCryptoBox } from '.';
+import { decryptSecretBox, encryptCryptoBox, encryptSecretBox } from '.';
 import { sodium } from '../sodium';
+import { concatenate } from '../utils/array.js';
 import { encryptSecretStream, secretStreamKeygen } from './data';
 export function generatePassword() {
     return sodium.randombytes_buf(16, 'hex');
@@ -7,6 +8,27 @@ export function generatePassword() {
 export function derivePassword(password, salt) {
     return sodium.crypto_pwhash(sodium.crypto_secretbox_KEYBYTES, password, salt, sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE, sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE, sodium.crypto_pwhash_ALG_ARGON2ID13, 'hex');
 }
+const PASSWORD_KEY_VERSION = 1;
+/**
+ * Wrap a data key under a password, with a random salt:
+ * `version (1 byte) || salt || nonce || secretbox(key)`.
+ */
+export function encryptKeyWithPassword(key, password) {
+    const salt = sodium.randombytes_buf(sodium.crypto_pwhash_SALTBYTES);
+    return concatenate(new Uint8Array([PASSWORD_KEY_VERSION]), salt, encryptSecretBox(key, derivePassword(password, salt)));
+}
+/** Unwrap a data key produced by `encryptKeyWithPassword`. */
+export function decryptKeyWithPassword(wrapped, password) {
+    const boxBytes = sodium.crypto_secretbox_NONCEBYTES +
+        sodium.crypto_secretbox_MACBYTES +
+        sodium.crypto_secretstream_xchacha20poly1305_KEYBYTES;
+    if (wrapped.byteLength === 1 + sodium.crypto_pwhash_SALTBYTES + boxBytes &&
+        wrapped[0] === PASSWORD_KEY_VERSION) {
+        const salt = wrapped.slice(1, 1 + sodium.crypto_pwhash_SALTBYTES);
+        return decryptSecretBox(wrapped.slice(1 + sodium.crypto_pwhash_SALTBYTES), derivePassword(password, salt));
+    }
+    throw new Error('Unsupported password protected key format');
+}
 export async function encryptName(name, nameKey) {
     const { data } = await encryptSecretStream(sodium.from_hex(nameKey), sodium.from_string(name));
     return sodium.to_hex(data);

package/dist/lib/crypto/index.js

@@ -10,7 +10,7 @@ export function generateCryptoBoxKeyPair() {
 }
 export function decryptCryptoBox(data, publicKeyAlice, privateKeyBob) {
     if (data.length < sodium.crypto_box_NONCEBYTES + sodium.crypto_box_MACBYTES) {
-        throw 'data too short';
+        throw new Error('data too short');
     }
     const nonce = data.slice(0, sodium.crypto_box_NONCEBYTES);
     const cipher = data.slice(sodium.crypto_box_NONCEBYTES);
@@ -27,7 +27,7 @@ export function encryptSecretBox(data, key) {
 export function decryptSecretBox(data, key) {
     if (data.length <
         sodium.crypto_secretbox_NONCEBYTES + sodium.crypto_secretbox_MACBYTES) {
-        throw 'data too short';
+        throw new Error('data too short');
     }
     const nonce = data.slice(0, sodium.crypto_secretbox_NONCEBYTES);
     const cipher = data.slice(sodium.crypto_secretbox_NONCEBYTES);

package/dist/lib/utils/popup-tools.js

@@ -100,21 +100,30 @@ function popupExecute(execute, url, name, options, callback) {
             //
         };
     const optionsString = optionsToString(popupOptions);
+    // Only the page we opened may answer: the popup name is predictable, so
+    // without these checks any window could inject a response (e.g. an
+    // attacker's session and keys on login).
+    const expectedOrigin = new URL(url, window.location.href).origin;
     const win = execute(url, popupName, optionsString);
     let isMessageSent = false;
     let interval;
     function popupCallbackOnce(err, data) {
         if (!isMessageSent) {
             isMessageSent = true;
+            window.removeEventListener('message', onMessage);
+            clearInterval(interval);
             popupCallback(err, data);
         }
     }
     function onMessage(message) {
-        const data = message !== undefined ? message.data : undefined;
-        if (data !== undefined && data.id === popupName) {
+        if (win === null ||
+            message.source !== win ||
+            message.origin !== expectedOrigin) {
+            return;
+        }
+        const data = message.data;
+        if (data !== undefined && data !== null && data.id === popupName) {
             popupCallbackOnce(undefined, data.data);
-            window.removeEventListener('message', onMessage);
-            clearInterval(interval);
         }
     }
     window.addEventListener('message', onMessage, false);
@@ -172,9 +181,12 @@ export function popupWithPost(url, postData, name, options, callback) {
  * Return html that when executed, will trigger the popup to callback with a response
  *
  * @param  {Object}
+ * @param  {String} targetOrigin origin of the opener allowed to receive `data`
  * @return {String}
  */
-export function popupResponse(id, data) {
-    const jsonData = JSON.stringify({ id, data });
-    return `<script>window.opener.postMessage(${jsonData}, "*");setTimeout(function() { window.close(); }, 50);</script>`;
+export function popupResponse(id, data, targetOrigin) {
+    // Escape "<" so the payload cannot close the script tag.
+    const jsonData = JSON.stringify({ id, data }).replaceAll('<', '\\u003c');
+    const origin = JSON.stringify(targetOrigin).replaceAll('<', '\\u003c');
+    return `<script>window.opener.postMessage(${jsonData}, ${origin});setTimeout(function() { window.close(); }, 50);</script>`;
 }

package/dist/lib/worker/generated/md5.js

@@ -0,0 +1,2 @@
+// Generated by scripts/build-workers.ts, do not edit.
+export const workerMd5Script = "(()=>{var D=Object.create;var{getPrototypeOf:E,defineProperty:F,getOwnPropertyNames:G}=Object;var v=Object.prototype.hasOwnProperty;function H(o){return this[o]}var K,N,R=(o,u,s)=>{var _=o!=null&&typeof o===\"object\";if(_){var y=u?K??=new WeakMap:N??=new WeakMap,b=y.get(o);if(b)return b}s=o!=null?D(E(o)):{};let l=u||!o||!o.__esModule||!v.call(o,\"default\")?F(s,\"default\",{value:o,enumerable:!0}):s;if(o&&typeof o===\"object\"||typeof o===\"function\"){for(let g of G(o))if(!v.call(l,g))F(l,g,{get:H.bind(o,g),enumerable:!0})}if(_)y.set(o,l);return l};var Z=(o,u)=>()=>(u||o((u={exports:{}}).exports,u),u.exports);var S=Z(function(w,U){(function(o){if(typeof w===\"object\")U.exports=o();else if(typeof define===\"function\"&&define.amd)define(o);else{var u;try{u=window}catch(s){u=self}u.SparkMD5=o()}})(function(o){var u=function(i,f){return i+f&4294967295},s=[\"0\",\"1\",\"2\",\"3\",\"4\",\"5\",\"6\",\"7\",\"8\",\"9\",\"a\",\"b\",\"c\",\"d\",\"e\",\"f\"];function _(i,f,r,t,n,e){return f=u(u(f,i),u(t,e)),u(f<<n|f>>>32-n,r)}function y(i,f){var r=i[0],t=i[1],n=i[2],e=i[3];r+=(t&n|~t&e)+f[0]-680876936|0,r=(r<<7|r>>>25)+t|0,e+=(r&t|~r&n)+f[1]-389564586|0,e=(e<<12|e>>>20)+r|0,n+=(e&r|~e&t)+f[2]+606105819|0,n=(n<<17|n>>>15)+e|0,t+=(n&e|~n&r)+f[3]-1044525330|0,t=(t<<22|t>>>10)+n|0,r+=(t&n|~t&e)+f[4]-176418897|0,r=(r<<7|r>>>25)+t|0,e+=(r&t|~r&n)+f[5]+1200080426|0,e=(e<<12|e>>>20)+r|0,n+=(e&r|~e&t)+f[6]-1473231341|0,n=(n<<17|n>>>15)+e|0,t+=(n&e|~n&r)+f[7]-45705983|0,t=(t<<22|t>>>10)+n|0,r+=(t&n|~t&e)+f[8]+1770035416|0,r=(r<<7|r>>>25)+t|0,e+=(r&t|~r&n)+f[9]-1958414417|0,e=(e<<12|e>>>20)+r|0,n+=(e&r|~e&t)+f[10]-42063|0,n=(n<<17|n>>>15)+e|0,t+=(n&e|~n&r)+f[11]-1990404162|0,t=(t<<22|t>>>10)+n|0,r+=(t&n|~t&e)+f[12]+1804603682|0,r=(r<<7|r>>>25)+t|0,e+=(r&t|~r&n)+f[13]-40341101|0,e=(e<<12|e>>>20)+r|0,n+=(e&r|~e&t)+f[14]-1502002290|0,n=(n<<17|n>>>15)+e|0,t+=(n&e|~n&r)+f[15]+1236535329|0,t=(t<<22|t>>>10)+n|0,r+=(t&e|n&~e)+f[1]-165796510|0,r=(r<<5|r>>>27)+t|0,e+=(r&n|t&~n)+f[6]-1069501632|0,e=(e<<9|e>>>23)+r|0,n+=(e&t|r&~t)+f[11]+643717713|0,n=(n<<14|n>>>18)+e|0,t+=(n&r|e&~r)+f[0]-373897302|0,t=(t<<20|t>>>12)+n|0,r+=(t&e|n&~e)+f[5]-701558691|0,r=(r<<5|r>>>27)+t|0,e+=(r&n|t&~n)+f[10]+38016083|0,e=(e<<9|e>>>23)+r|0,n+=(e&t|r&~t)+f[15]-660478335|0,n=(n<<14|n>>>18)+e|0,t+=(n&r|e&~r)+f[4]-405537848|0,t=(t<<20|t>>>12)+n|0,r+=(t&e|n&~e)+f[9]+568446438|0,r=(r<<5|r>>>27)+t|0,e+=(r&n|t&~n)+f[14]-1019803690|0,e=(e<<9|e>>>23)+r|0,n+=(e&t|r&~t)+f[3]-187363961|0,n=(n<<14|n>>>18)+e|0,t+=(n&r|e&~r)+f[8]+1163531501|0,t=(t<<20|t>>>12)+n|0,r+=(t&e|n&~e)+f[13]-1444681467|0,r=(r<<5|r>>>27)+t|0,e+=(r&n|t&~n)+f[2]-51403784|0,e=(e<<9|e>>>23)+r|0,n+=(e&t|r&~t)+f[7]+1735328473|0,n=(n<<14|n>>>18)+e|0,t+=(n&r|e&~r)+f[12]-1926607734|0,t=(t<<20|t>>>12)+n|0,r+=(t^n^e)+f[5]-378558|0,r=(r<<4|r>>>28)+t|0,e+=(r^t^n)+f[8]-2022574463|0,e=(e<<11|e>>>21)+r|0,n+=(e^r^t)+f[11]+1839030562|0,n=(n<<16|n>>>16)+e|0,t+=(n^e^r)+f[14]-35309556|0,t=(t<<23|t>>>9)+n|0,r+=(t^n^e)+f[1]-1530992060|0,r=(r<<4|r>>>28)+t|0,e+=(r^t^n)+f[4]+1272893353|0,e=(e<<11|e>>>21)+r|0,n+=(e^r^t)+f[7]-155497632|0,n=(n<<16|n>>>16)+e|0,t+=(n^e^r)+f[10]-1094730640|0,t=(t<<23|t>>>9)+n|0,r+=(t^n^e)+f[13]+681279174|0,r=(r<<4|r>>>28)+t|0,e+=(r^t^n)+f[0]-358537222|0,e=(e<<11|e>>>21)+r|0,n+=(e^r^t)+f[3]-722521979|0,n=(n<<16|n>>>16)+e|0,t+=(n^e^r)+f[6]+76029189|0,t=(t<<23|t>>>9)+n|0,r+=(t^n^e)+f[9]-640364487|0,r=(r<<4|r>>>28)+t|0,e+=(r^t^n)+f[12]-421815835|0,e=(e<<11|e>>>21)+r|0,n+=(e^r^t)+f[15]+530742520|0,n=(n<<16|n>>>16)+e|0,t+=(n^e^r)+f[2]-995338651|0,t=(t<<23|t>>>9)+n|0,r+=(n^(t|~e))+f[0]-198630844|0,r=(r<<6|r>>>26)+t|0,e+=(t^(r|~n))+f[7]+1126891415|0,e=(e<<10|e>>>22)+r|0,n+=(r^(e|~t))+f[14]-1416354905|0,n=(n<<15|n>>>17)+e|0,t+=(e^(n|~r))+f[5]-57434055|0,t=(t<<21|t>>>11)+n|0,r+=(n^(t|~e))+f[12]+1700485571|0,r=(r<<6|r>>>26)+t|0,e+=(t^(r|~n))+f[3]-1894986606|0,e=(e<<10|e>>>22)+r|0,n+=(r^(e|~t))+f[10]-1051523|0,n=(n<<15|n>>>17)+e|0,t+=(e^(n|~r))+f[1]-2054922799|0,t=(t<<21|t>>>11)+n|0,r+=(n^(t|~e))+f[8]+1873313359|0,r=(r<<6|r>>>26)+t|0,e+=(t^(r|~n))+f[15]-30611744|0,e=(e<<10|e>>>22)+r|0,n+=(r^(e|~t))+f[6]-1560198380|0,n=(n<<15|n>>>17)+e|0,t+=(e^(n|~r))+f[13]+1309151649|0,t=(t<<21|t>>>11)+n|0,r+=(n^(t|~e))+f[4]-145523070|0,r=(r<<6|r>>>26)+t|0,e+=(t^(r|~n))+f[11]-1120210379|0,e=(e<<10|e>>>22)+r|0,n+=(r^(e|~t))+f[2]+718787259|0,n=(n<<15|n>>>17)+e|0,t+=(e^(n|~r))+f[9]-343485551|0,t=(t<<21|t>>>11)+n|0,i[0]=r+i[0]|0,i[1]=t+i[1]|0,i[2]=n+i[2]|0,i[3]=e+i[3]|0}function b(i){var f=[],r;for(r=0;r<64;r+=4)f[r>>2]=i.charCodeAt(r)+(i.charCodeAt(r+1)<<8)+(i.charCodeAt(r+2)<<16)+(i.charCodeAt(r+3)<<24);return f}function l(i){var f=[],r;for(r=0;r<64;r+=4)f[r>>2]=i[r]+(i[r+1]<<8)+(i[r+2]<<16)+(i[r+3]<<24);return f}function g(i){var f=i.length,r=[1732584193,-271733879,-1732584194,271733878],t,n,e,a,c,p;for(t=64;t<=f;t+=64)y(r,b(i.substring(t-64,t)));i=i.substring(t-64),n=i.length,e=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0];for(t=0;t<n;t+=1)e[t>>2]|=i.charCodeAt(t)<<(t%4<<3);if(e[t>>2]|=128<<(t%4<<3),t>55){y(r,e);for(t=0;t<16;t+=1)e[t]=0}return a=f*8,a=a.toString(16).match(/(.*?)(.{0,8})$/),c=parseInt(a[2],16),p=parseInt(a[1],16)||0,e[14]=c,e[15]=p,y(r,e),r}function T(i){var f=i.length,r=[1732584193,-271733879,-1732584194,271733878],t,n,e,a,c,p;for(t=64;t<=f;t+=64)y(r,l(i.subarray(t-64,t)));i=t-64<f?i.subarray(t-64):new Uint8Array(0),n=i.length,e=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0];for(t=0;t<n;t+=1)e[t>>2]|=i[t]<<(t%4<<3);if(e[t>>2]|=128<<(t%4<<3),t>55){y(r,e);for(t=0;t<16;t+=1)e[t]=0}return a=f*8,a=a.toString(16).match(/(.*?)(.{0,8})$/),c=parseInt(a[2],16),p=parseInt(a[1],16)||0,e[14]=c,e[15]=p,y(r,e),r}function L(i){var f=\"\",r;for(r=0;r<4;r+=1)f+=s[i>>r*8+4&15]+s[i>>r*8&15];return f}function d(i){var f;for(f=0;f<i.length;f+=1)i[f]=L(i[f]);return i.join(\"\")}if(d(g(\"hello\"))!==\"5d41402abc4b2a76b9719d911017c592\")u=function(i,f){var r=(i&65535)+(f&65535),t=(i>>16)+(f>>16)+(r>>16);return t<<16|r&65535};if(typeof ArrayBuffer<\"u\"&&!ArrayBuffer.prototype.slice)(function(){function i(f,r){if(f=f|0||0,f<0)return Math.max(f+r,0);return Math.min(f,r)}ArrayBuffer.prototype.slice=function(f,r){var t=this.byteLength,n=i(f,t),e=t,a,c,p,B;if(r!==o)e=i(r,t);if(n>e)return new ArrayBuffer(0);return a=e-n,c=new ArrayBuffer(a),p=new Uint8Array(c),B=new Uint8Array(this,n,a),p.set(B),c}})();function m(i){if(/[\\u0080-\\uFFFF]/.test(i))i=unescape(encodeURIComponent(i));return i}function M(i,f){var r=i.length,t=new ArrayBuffer(r),n=new Uint8Array(t),e;for(e=0;e<r;e+=1)n[e]=i.charCodeAt(e);return f?n:t}function x(i){return String.fromCharCode.apply(null,new Uint8Array(i))}function j(i,f,r){var t=new Uint8Array(i.byteLength+f.byteLength);return t.set(new Uint8Array(i)),t.set(new Uint8Array(f),i.byteLength),r?t:t.buffer}function A(i){var f=[],r=i.length,t;for(t=0;t<r-1;t+=2)f.push(parseInt(i.substr(t,2),16));return String.fromCharCode.apply(String,f)}function h(){this.reset()}return h.prototype.append=function(i){return this.appendBinary(m(i)),this},h.prototype.appendBinary=function(i){this._buff+=i,this._length+=i.length;var f=this._buff.length,r;for(r=64;r<=f;r+=64)y(this._hash,b(this._buff.substring(r-64,r)));return this._buff=this._buff.substring(r-64),this},h.prototype.end=function(i){var f=this._buff,r=f.length,t,n=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],e;for(t=0;t<r;t+=1)n[t>>2]|=f.charCodeAt(t)<<(t%4<<3);if(this._finish(n,r),e=d(this._hash),i)e=A(e);return this.reset(),e},h.prototype.reset=function(){return this._buff=\"\",this._length=0,this._hash=[1732584193,-271733879,-1732584194,271733878],this},h.prototype.getState=function(){return{buff:this._buff,length:this._length,hash:this._hash.slice()}},h.prototype.setState=function(i){return this._buff=i.buff,this._length=i.length,this._hash=i.hash,this},h.prototype.destroy=function(){delete this._hash,delete this._buff,delete this._length},h.prototype._finish=function(i,f){var r=f,t,n,e;if(i[r>>2]|=128<<(r%4<<3),r>55){y(this._hash,i);for(r=0;r<16;r+=1)i[r]=0}t=this._length*8,t=t.toString(16).match(/(.*?)(.{0,8})$/),n=parseInt(t[2],16),e=parseInt(t[1],16)||0,i[14]=n,i[15]=e,y(this._hash,i)},h.hash=function(i,f){return h.hashBinary(m(i),f)},h.hashBinary=function(i,f){var r=g(i),t=d(r);return f?A(t):t},h.ArrayBuffer=function(){this.reset()},h.ArrayBuffer.prototype.append=function(i){var f=j(this._buff.buffer,i,!0),r=f.length,t;this._length+=i.byteLength;for(t=64;t<=r;t+=64)y(this._hash,l(f.subarray(t-64,t)));return this._buff=t-64<r?new Uint8Array(f.buffer.slice(t-64)):new Uint8Array(0),this},h.ArrayBuffer.prototype.end=function(i){var f=this._buff,r=f.length,t=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],n,e;for(n=0;n<r;n+=1)t[n>>2]|=f[n]<<(n%4<<3);if(this._finish(t,r),e=d(this._hash),i)e=A(e);return this.reset(),e},h.ArrayBuffer.prototype.reset=function(){return this._buff=new Uint8Array(0),this._length=0,this._hash=[1732584193,-271733879,-1732584194,271733878],this},h.ArrayBuffer.prototype.getState=function(){var i=h.prototype.getState.call(this);return i.buff=x(i.buff),i},h.ArrayBuffer.prototype.setState=function(i){return i.buff=M(i.buff,!0),h.prototype.setState.call(this,i)},h.ArrayBuffer.prototype.destroy=h.prototype.destroy,h.ArrayBuffer.prototype._finish=h.prototype._finish,h.ArrayBuffer.hash=function(i,f){var r=T(new Uint8Array(i)),t=d(r);return f?A(t):t},h})});var I=R(S(),1);function*C(o,u){for(let s=0;s<o.length;s+=u)yield o.slice(s,s+u)}var q=8192;self.onmessage=({data:o})=>{if(o.event===\"md5\"){let u=new I.default.ArrayBuffer;for(let s of C(o.data,q))u.append(s.buffer);postMessage({event:\"md5-result\",data:u.end()})}};})();\n";