@secrecy/lib 1.86.3 → 1.86.4-fix-md5.1

package/dist/lib/client/SecrecyCloudClient.js

@@ -702,8 +702,10 @@ export class SecrecyCloudClient {
         const src = key
             ? await decrypt(key, encryptedContent, progressDecrypt, signal)
             : encryptedContent;
-        const md5Content = await md5(src);
-        if (md5Content !== dataContent.md5) {
+        // Encrypted data is authenticated by the stream: only public data has an md5.
+        if (!key &&
+            dataContent.md5 !== null &&
+            (await md5(src)) !== dataContent.md5) {
             throw new Error(`Content does not match`);
         }
         const decompressed = decompress(src);

package/dist/lib/client/data-link.js

@@ -1,14 +1,13 @@
 import z from 'zod';
 import { buildBytesFromDataLink } from '../crypto/domain';
 import { sodium } from '../sodium';
-import { derivePassword } from '../crypto/helpers';
-import { decryptSecretBox } from '../crypto';
+import { decryptKeyWithPassword } from '../crypto/helpers';
 import { decrypt } from '../worker/sodium';
-import { md5 } from '../worker/md5';
 import { decompress } from '../minify';
 const downloadDataLinkS3Schema = z.object({
     name: z.string(),
-    md5: z.string(),
+    // Only for unencrypted and legacy encrypted data.
+    md5: z.string().nullable(),
     md5Encrypted: z.string().nullable(),
     size: z.coerce.bigint().gte(0n),
     parts: z.array(z.object({ order: z.number(), md5: z.string(), contentUrl: z.string() })),
@@ -17,7 +16,8 @@ const downloadDataLinkS3Schema = z.object({
 });
 const downloadDataLinkLiteSchema = z.object({
     name: z.string(),
-    md5: z.string(),
+    // Only for unencrypted and legacy encrypted data.
+    md5: z.string().nullable(),
     md5Encrypted: z.string().nullable(),
     size: z.coerce.bigint().gte(0n),
     bytes: z.string(),
@@ -69,14 +69,8 @@ export async function downloadDataFromLink(opts) {
         throw new Error('Unable to read encrypted data without password!');
     }
     try {
-        const salt = sodium.crypto_generichash(sodium.crypto_pwhash_SALTBYTES, opts.crypto.password + dataLink.md5);
-        const derivedPassword = derivePassword(opts.crypto.password, salt);
-        const decryptedSharingDataKey = decryptSecretBox(sodium.from_hex(opts.crypto.key), derivedPassword);
+        const decryptedSharingDataKey = decryptKeyWithPassword(sodium.from_hex(opts.crypto.key), opts.crypto.password);
         const decryptedBytes = await decrypt(decryptedSharingDataKey, bytes, opts.decryptProgress, opts.signal);
-        const md5Content = await md5(decryptedBytes);
-        if (md5Content !== dataLink.md5) {
-            throw new Error(`Content does not match`);
-        }
         return decompress(decryptedBytes);
     }
     catch (err) {

package/dist/lib/client/helpers.js

@@ -3,25 +3,16 @@ import { popup } from '../utils/popup-tools.js';
 import { secrecyUserApp } from './types/index.js';
 import { getStorage } from './storage.js';
 import { setup } from '../sodium.js';
-export function assertBrowser(fn) {
-    if (typeof window === 'undefined') {
-        const err = {
-            name: 'ClientError',
-            code: 'SERVER_ENVIRONMENT',
-            message: `${fn}() can only run in a browser. On Next.js, call it from a "use client" component, or via dynamic(..., { ssr: false }).`,
-        };
-        throw err;
-    }
-}
 export function parseInfos() {
-    assertBrowser('parseInfos');
     if (window.location.hash === '') {
         return null;
     }
-    const hash = window.location.hash.slice(1);
+    const hash = window.location.hash.substr(1);
     try {
         const res = JSON.parse(atob(hash));
-        history.replaceState(null, '', window.location.pathname + window.location.search);
+        // Replace (not push) the entry: the fragment holds the private keys and
+        // must not stay in the browser history.
+        window.history.replaceState(window.history.state, '', window.location.pathname + window.location.search);
         const data = secrecyUserApp.safeParse(res);
         return data.success ? data.data : null;
     }
@@ -30,7 +21,6 @@ export function parseInfos() {
     }
 }
 export function getSecrecyClient(opts = {}) {
-    assertBrowser('getSecrecyClient');
     const storage = getStorage(opts.session);
     const infos = parseInfos();
     if (infos !== null) {
@@ -62,7 +52,6 @@ export function getSecrecyClient(opts = {}) {
     return null;
 }
 export async function login({ appId, context, path, redirect, scopes, backPath, session, secrecyUrls, forceLogin, }) {
-    assertBrowser('login');
     return await new Promise(async (resolve, reject) => {
         const appUrl = window.location.origin;
         const client = getSecrecyClient({ session, secrecyUrls });
@@ -150,7 +139,6 @@ export async function login({ appId, context, path, redirect, scopes, backPath,
  * juggle the sync/async mismatch between them.
  */
 export async function initSecrecy(opts) {
-    assertBrowser('initSecrecy');
     await setup();
     const existing = getSecrecyClient({
         session: opts.session,

package/dist/lib/client/upload.js

@@ -8,8 +8,8 @@ import { chunks, enumerate } from '../utils/array.js';
 import { getTrpcGuestClient, } from '../client.js';
 import axios from 'axios';
 import { encryptDataAndKey } from '../crypto/domain.js';
-import { derivePassword, generatePassword } from '../crypto/helpers.js';
-import { decryptCryptoBox, encryptSecretBox } from '../crypto/index.js';
+import { encryptKeyWithPassword, generatePassword } from '../crypto/helpers.js';
+import { decryptCryptoBox } from '../crypto/index.js';
 export async function uploadData({ storageType, data, password, forcePassword = false, encrypted = true, encryptProgress, uploadProgress, signal, meta, currentIdentity, keyPairs, apiClient, }) {
     if (!encrypted && (password || forcePassword)) {
         throw new Error('Cannot share unencrypted data with a password!');
@@ -40,7 +40,10 @@ export async function uploadData({ storageType, data, password, forcePassword =
         throw new Error('Cold storage is only for logged users!');
     }
     const compressed = encrypted ? compress(dataBuffer) : dataBuffer;
-    let { encryptedData, encryptedDataKey, dataKey, md5Data, md5Encrypted } = encrypted
+    // Only unencrypted (public) data sends the md5 of its content, computed in
+    // the requests below: for encrypted data it would let the server
+    // fingerprint the plaintext.
+    let { encryptedData, encryptedDataKey, dataKey, md5Encrypted } = encrypted
         ? await encryptDataAndKey({
             data: compressed,
             progress: encryptProgress,
@@ -52,7 +55,6 @@ export async function uploadData({ storageType, data, password, forcePassword =
             encryptedData: compressed,
             encryptedDataKey: null,
             dataKey: null,
-            md5Data: await md5(compressed),
             md5Encrypted: null,
         };
     await uploadProgress?.({
@@ -63,8 +65,6 @@ export async function uploadData({ storageType, data, password, forcePassword =
     const createSharing = ({ data, }) => {
         if (dataKey && (password || forcePassword)) {
             password ??= generatePassword();
-            const salt = sodium.crypto_generichash(sodium.crypto_pwhash_SALTBYTES, password + md5Data);
-            const derivedPassword = derivePassword(password, salt);
             let key;
             if (data.type === 'guest' ||
                 (data.type === 'authed' &&
@@ -88,7 +88,7 @@ export async function uploadData({ storageType, data, password, forcePassword =
             // NOTE: Process to create a sharing for a auth client (todo: endpoint)
             return {
                 password,
-                encryptedDataKey: sodium.to_hex(encryptSecretBox(key, derivedPassword)),
+                encryptedDataKey: sodium.to_hex(encryptKeyWithPassword(key, password)),
             };
         }
         return null;
@@ -102,14 +102,13 @@ export async function uploadData({ storageType, data, password, forcePassword =
                 size: BigInt(dataBuffer.byteLength),
                 key: encryptedDataKey ? sodium.to_hex(encryptedDataKey) : undefined,
                 md5Encrypted,
-                md5: md5Data,
                 fromIdentityPubKey: currentIdentity?.identityPubKey,
                 ...filetype,
             }
             : {
                 type: 'unencrypted',
                 content: Buffer.from(encryptedData),
-                md5: md5Data,
+                md5: await md5(compressed),
                 size: BigInt(dataBuffer.byteLength),
                 fromIdentityPubKey: currentIdentity?.identityPubKey,
                 ...filetype,
@@ -124,7 +123,7 @@ export async function uploadData({ storageType, data, password, forcePassword =
         const localData = {
             id: uploadData.id,
             storageType: 'lite',
-            md5: uploadDataArgs.md5,
+            md5: uploadDataArgs.type === 'unencrypted' ? uploadDataArgs.md5 : null,
             size: uploadDataArgs.size,
             sizeEncrypted: uploadDataArgs.type === 'encrypted'
                 ? uploadDataArgs.sizeEncrypted
@@ -146,13 +145,12 @@ export async function uploadData({ storageType, data, password, forcePassword =
                 size: BigInt(dataBuffer.byteLength),
                 key: encryptedDataKey ? sodium.to_hex(encryptedDataKey) : undefined,
                 md5Encrypted,
-                md5: md5Data,
                 fromIdentityPubKey: currentIdentity?.identityPubKey,
                 ...filetype,
             }
             : {
                 type: 'unencrypted',
-                md5: md5Data,
+                md5: await md5(compressed),
                 size: BigInt(dataBuffer.byteLength),
                 fromIdentityPubKey: currentIdentity?.identityPubKey,
                 ...filetype,
@@ -173,7 +171,7 @@ export async function uploadData({ storageType, data, password, forcePassword =
             const localData = {
                 id: uploadData.id,
                 storageType: storageType,
-                md5: uploadDataArgs.md5,
+                md5: uploadDataArgs.type === 'unencrypted' ? uploadDataArgs.md5 : null,
                 size: uploadDataArgs.size,
                 sizeEncrypted: uploadDataArgs.type === 'encrypted'
                     ? uploadDataArgs.sizeEncrypted
@@ -257,7 +255,7 @@ export async function uploadData({ storageType, data, password, forcePassword =
         const localData = {
             id: uploadData.id,
             storageType: storageType,
-            md5: uploadDataArgs.md5,
+            md5: uploadDataArgs.type === 'unencrypted' ? uploadDataArgs.md5 : null,
             size: uploadDataArgs.size,
             sizeEncrypted: uploadDataArgs.type === 'encrypted'
                 ? uploadDataArgs.sizeEncrypted

package/dist/lib/crypto/data.js

@@ -1,6 +1,5 @@
 import { setup, sodium } from '../sodium.js';
 import SparkMD5 from 'spark-md5';
-import { chunks } from '../utils/array.js';
 function assert(c, message) {
     if (!c) {
         throw new Error(message);
@@ -9,7 +8,19 @@ function assert(c, message) {
 export function secretStreamKeygen() {
     return sodium.crypto_secretstream_xchacha20poly1305_keygen();
 }
+function assertKey(key) {
+    assert(key.byteLength === sodium.crypto_secretstream_xchacha20poly1305_KEYBYTES, `key must be KEYBYTES (${sodium.crypto_secretstream_xchacha20poly1305_KEYBYTES}) long`);
+}
+// The wrappers return the secretstream state as a raw address in the wasm
+// heap and never release it: wipe it (it holds the stream key) and free it.
+function wipeState(state) {
+    const lib = sodium.libsodium;
+    const size = lib._crypto_secretstream_xchacha20poly1305_statebytes();
+    lib.HEAPU8.fill(0, state, state + size);
+    lib._free(state);
+}
 function encrypt(key) {
+    assertKey(key);
     let destroyed = false;
     const { state, header } = sodium.crypto_secretstream_xchacha20poly1305_init_push(key);
     const encrypt = (tag, plaintext) => {
@@ -19,6 +30,7 @@ function encrypt(key) {
     function destroy() {
         assert(!destroyed, 'state already destroyed');
         destroyed = true;
+        wipeState(state);
     }
     return {
         encrypt,
@@ -27,18 +39,19 @@ function encrypt(key) {
     };
 }
 function decrypt(header, key) {
-    assert(header.byteLength >=
-        sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES, `header must be at least HEADERBYTES (${sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES}) long`);
-    assert(key.byteLength >= sodium.crypto_secretstream_xchacha20poly1305_KEYBYTES, `key must be at least KEYBYTES (${sodium.crypto_secretstream_xchacha20poly1305_KEYBYTES}) long`);
+    assert(header.byteLength ===
+        sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES, `header must be HEADERBYTES (${sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES}) long`);
+    assertKey(key);
     let destroyed = false;
     const state = sodium.crypto_secretstream_xchacha20poly1305_init_pull(header, key);
     const decrypt = (ciphertext) => {
         assert(!destroyed, 'state already destroyed');
-        return sodium.crypto_secretstream_xchacha20poly1305_pull(state, ciphertext);
+        return sodium.crypto_secretstream_xchacha20poly1305_pull(state, ciphertext, null);
     };
     function destroy() {
         assert(!destroyed, 'state already destroyed');
         destroyed = true;
+        wipeState(state);
     }
     return {
         decrypt,
@@ -46,104 +59,146 @@ function decrypt(header, key) {
     };
 }
 export const CHUNK_SIZE = 8192;
+/**
+ * Encrypt `data` as a secretstream: the header followed by one authenticated
+ * chunk per CHUNK_SIZE bytes of plaintext. The last chunk (an empty one for
+ * empty data) is always tagged `TAG_FINAL` so that truncation is detected.
+ */
 export async function encryptSecretStream(key, data, progress, signal) {
     await setup();
     const { encrypt: crypt, destroy, header } = encrypt(key);
-    const encryptedChunk = CHUNK_SIZE + sodium.crypto_secretstream_xchacha20poly1305_ABYTES;
-    const max = Math.ceil(data.byteLength / CHUNK_SIZE) * encryptedChunk + header.byteLength;
-    void progress?.({
-        percent: 0,
-        total: max,
-        current: 0,
-    });
-    const final = new Uint8Array(max);
-    const sparkEncrypted = new SparkMD5.ArrayBuffer();
-    const spark = new SparkMD5.ArrayBuffer();
-    final.set(header);
-    sparkEncrypted.append(header.buffer);
-    let total = header.byteLength;
-    void progress?.({
-        percent: total / max,
-        total: max,
-        current: total,
-    });
-    let lastPercent = total / max;
-    for (const chunk of chunks(data, CHUNK_SIZE)) {
-        if (signal?.aborted === true) {
-            throw new Error(`Encrypt aborted`);
-        }
-        spark.append(chunk.buffer);
-        const tag = chunk.length < CHUNK_SIZE
-            ? sodium.crypto_secretstream_xchacha20poly1305_TAG_FINAL
-            : sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE;
-        const encrypted = crypt(tag, chunk);
-        sparkEncrypted.append(encrypted.buffer);
-        final.set(encrypted, total);
-        total += encrypted.byteLength;
-        const percent = total / max;
-        if (percent > lastPercent + 0.01) {
-            void progress?.({
-                percent,
-                total: max,
-                current: total,
-            });
-            lastPercent = percent;
+    try {
+        const chunkCount = Math.max(1, Math.ceil(data.byteLength / CHUNK_SIZE));
+        const max = header.byteLength +
+            data.byteLength +
+            chunkCount * sodium.crypto_secretstream_xchacha20poly1305_ABYTES;
+        void progress?.({
+            percent: 0,
+            total: max,
+            current: 0,
+        });
+        const final = new Uint8Array(max);
+        const sparkEncrypted = new SparkMD5.ArrayBuffer();
+        final.set(header);
+        sparkEncrypted.append(header.buffer);
+        let total = header.byteLength;
+        void progress?.({
+            percent: total / max,
+            total: max,
+            current: total,
+        });
+        let lastPercent = total / max;
+        for (let i = 0; i < chunkCount; i++) {
+            if (signal?.aborted === true) {
+                throw new Error(`Encrypt aborted`);
+            }
+            const chunk = data.subarray(i * CHUNK_SIZE, (i + 1) * CHUNK_SIZE);
+            const tag = i === chunkCount - 1
+                ? sodium.crypto_secretstream_xchacha20poly1305_TAG_FINAL
+                : sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE;
+            const encrypted = crypt(tag, chunk);
+            sparkEncrypted.append(encrypted.buffer);
+            final.set(encrypted, total);
+            total += encrypted.byteLength;
+            const percent = total / max;
+            if (percent > lastPercent + 0.01) {
+                void progress?.({
+                    percent,
+                    total: max,
+                    current: total,
+                });
+                lastPercent = percent;
+            }
         }
+        void progress?.({
+            percent: 1,
+            total,
+            current: total,
+        });
+        return {
+            data: final,
+            md5Encrypted: sparkEncrypted.end(),
+        };
+    }
+    finally {
+        destroy();
     }
-    destroy();
-    void progress?.({
-        percent: 1,
-        total,
-        current: total,
-    });
-    return {
-        data: final.slice(0, total),
-        md5Encrypted: sparkEncrypted.end(),
-        md5: spark.end(),
-    };
 }
+/**
+ * Decrypt a secretstream produced by `encryptSecretStream`. Throws if any
+ * chunk fails authentication, if data follows the `TAG_FINAL` chunk, or if the
+ * stream ends without it (truncation).
+ */
 export async function decryptSecretStream(key, data, progress, signal) {
     await setup();
-    const header = data.slice(0, sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES);
-    data = data.slice(sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES);
-    const { decrypt: decryptFn, destroy } = decrypt(header, key);
+    const headerBytes = sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES;
     const chunkSize = CHUNK_SIZE + sodium.crypto_secretstream_xchacha20poly1305_ABYTES;
-    const max = Math.ceil(data.byteLength / chunkSize) * CHUNK_SIZE;
-    void progress?.({
-        percent: 0,
-        total: max,
-        current: 0,
-    });
-    const final = new Uint8Array(max);
-    let total = 0;
-    let lastPercent = total / max;
-    for (const chunk of chunks(data, chunkSize)) {
-        if (signal?.aborted === true) {
-            throw new Error(`Decrypt aborted`);
-        }
-        const messageTag = decryptFn(chunk);
-        if (typeof messageTag === 'boolean') {
-            throw new Error('Unable to decrypt the data!');
+    // A valid stream always holds at least one (possibly empty) chunk.
+    if (data.byteLength <
+        headerBytes + sodium.crypto_secretstream_xchacha20poly1305_ABYTES) {
+        throw new Error('Unable to decrypt the data: the data is too short!');
+    }
+    const header = data.slice(0, headerBytes);
+    const body = data.subarray(headerBytes);
+    const chunkCount = Math.ceil(body.byteLength / chunkSize);
+    const max = body.byteLength -
+        chunkCount * sodium.crypto_secretstream_xchacha20poly1305_ABYTES;
+    const { decrypt: decryptFn, destroy } = decrypt(header, key);
+    try {
+        void progress?.({
+            percent: 0,
+            total: max,
+            current: 0,
+        });
+        const final = new Uint8Array(max);
+        let total = 0;
+        let finalTagSeen = false;
+        let lastPercent = total / max;
+        for (let i = 0; i < chunkCount; i++) {
+            if (signal?.aborted === true) {
+                throw new Error(`Decrypt aborted`);
+            }
+            const chunk = body.subarray(i * chunkSize, (i + 1) * chunkSize);
+            if (finalTagSeen) {
+                throw new Error('Unable to decrypt the data: unexpected data after the final chunk!');
+            }
+            const messageTag = decryptFn(chunk);
+            if (typeof messageTag === 'boolean') {
+                throw new Error('Unable to decrypt the data!');
+            }
+            if (messageTag.tag ===
+                sodium.crypto_secretstream_xchacha20poly1305_TAG_FINAL) {
+                finalTagSeen = true;
+            }
+            else if (messageTag.tag !==
+                sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE) {
+                throw new Error('Unable to decrypt the data: unexpected chunk tag!');
+            }
+            final.set(messageTag.message, total);
+            total += messageTag.message.byteLength;
+            const percent = total / max;
+            if (percent > lastPercent + 0.01) {
+                void progress?.({
+                    percent,
+                    total: max,
+                    current: total,
+                });
+                lastPercent = percent;
+            }
         }
-        final.set(messageTag.message, total);
-        total += messageTag.message.byteLength;
-        const percent = total / max;
-        if (percent > lastPercent + 0.01) {
-            void progress?.({
-                percent,
-                total: max,
-                current: total,
-            });
-            lastPercent = percent;
+        if (!finalTagSeen) {
+            throw new Error('Unable to decrypt the data: the data is truncated!');
         }
+        void progress?.({
+            percent: 1,
+            total,
+            current: total,
+        });
+        return final;
+    }
+    finally {
+        destroy();
     }
-    destroy();
-    void progress?.({
-        percent: 1,
-        total,
-        current: total,
-    });
-    return final.slice(0, total);
 }
 // async function mainSecretStream(random: Uint8Array): Promise<vo id> {
 //   const key = secretstreamKeygen();

package/dist/lib/crypto/domain.js

@@ -11,12 +11,11 @@ import { concatenate } from '../utils/array.js';
  */
 export async function encryptDataAndKey({ data, currentIdentity, keyPairs, progress, signal, }) {
     const dataKey = secretStreamKeygen();
-    const { data: encryptedData, md5: md5Data, md5Encrypted, } = await encrypt(dataKey, data, progress, signal);
+    const { data: encryptedData, md5Encrypted } = await encrypt(dataKey, data, progress, signal);
     if (!currentIdentity || !keyPairs) {
         return {
             encryptedData,
             dataKey,
-            md5Data,
             md5Encrypted,
         };
     }
@@ -29,7 +28,6 @@ export async function encryptDataAndKey({ data, currentIdentity, keyPairs, progr
         encryptedDataKey: encDataKey,
         encryptedData,
         dataKey,
-        md5Data,
         md5Encrypted,
     };
 }

package/dist/lib/crypto/helpers.js

@@ -1,5 +1,6 @@
-import { encryptCryptoBox } from '.';
+import { decryptSecretBox, encryptCryptoBox, encryptSecretBox } from '.';
 import { sodium } from '../sodium';
+import { concatenate } from '../utils/array.js';
 import { encryptSecretStream, secretStreamKeygen } from './data';
 export function generatePassword() {
     return sodium.randombytes_buf(16, 'hex');
@@ -7,6 +8,27 @@ export function generatePassword() {
 export function derivePassword(password, salt) {
     return sodium.crypto_pwhash(sodium.crypto_secretbox_KEYBYTES, password, salt, sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE, sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE, sodium.crypto_pwhash_ALG_ARGON2ID13, 'hex');
 }
+const PASSWORD_KEY_VERSION = 1;
+/**
+ * Wrap a data key under a password, with a random salt:
+ * `version (1 byte) || salt || nonce || secretbox(key)`.
+ */
+export function encryptKeyWithPassword(key, password) {
+    const salt = sodium.randombytes_buf(sodium.crypto_pwhash_SALTBYTES);
+    return concatenate(new Uint8Array([PASSWORD_KEY_VERSION]), salt, encryptSecretBox(key, derivePassword(password, salt)));
+}
+/** Unwrap a data key produced by `encryptKeyWithPassword`. */
+export function decryptKeyWithPassword(wrapped, password) {
+    const boxBytes = sodium.crypto_secretbox_NONCEBYTES +
+        sodium.crypto_secretbox_MACBYTES +
+        sodium.crypto_secretstream_xchacha20poly1305_KEYBYTES;
+    if (wrapped.byteLength === 1 + sodium.crypto_pwhash_SALTBYTES + boxBytes &&
+        wrapped[0] === PASSWORD_KEY_VERSION) {
+        const salt = wrapped.slice(1, 1 + sodium.crypto_pwhash_SALTBYTES);
+        return decryptSecretBox(wrapped.slice(1 + sodium.crypto_pwhash_SALTBYTES), derivePassword(password, salt));
+    }
+    throw new Error('Unsupported password protected key format');
+}
 export async function encryptName(name, nameKey) {
     const { data } = await encryptSecretStream(sodium.from_hex(nameKey), sodium.from_string(name));
     return sodium.to_hex(data);

package/dist/lib/crypto/index.js

@@ -1,12 +1,5 @@
 import { concatenate } from '../utils/array.js';
 import { sodium } from '../sodium.js';
-function dataTooShortError() {
-    return {
-        name: 'ClientError',
-        code: 'DATA_TOO_SHORT',
-        message: 'Encrypted payload is shorter than nonce + MAC',
-    };
-}
 export function encryptCryptoBox(data, publicKeyBob, privateKeyAlice) {
     const nonce = sodium.randombytes_buf(sodium.crypto_box_NONCEBYTES);
     const crypt = sodium.crypto_box_easy(data, nonce, sodium.from_hex(publicKeyBob), sodium.from_hex(privateKeyAlice));
@@ -17,7 +10,7 @@ export function generateCryptoBoxKeyPair() {
 }
 export function decryptCryptoBox(data, publicKeyAlice, privateKeyBob) {
     if (data.length < sodium.crypto_box_NONCEBYTES + sodium.crypto_box_MACBYTES) {
-        throw dataTooShortError();
+        throw new Error('data too short');
     }
     const nonce = data.slice(0, sodium.crypto_box_NONCEBYTES);
     const cipher = data.slice(sodium.crypto_box_NONCEBYTES);
@@ -34,7 +27,7 @@ export function encryptSecretBox(data, key) {
 export function decryptSecretBox(data, key) {
     if (data.length <
         sodium.crypto_secretbox_NONCEBYTES + sodium.crypto_secretbox_MACBYTES) {
-        throw dataTooShortError();
+        throw new Error('data too short');
     }
     const nonce = data.slice(0, sodium.crypto_secretbox_NONCEBYTES);
     const cipher = data.slice(sodium.crypto_secretbox_NONCEBYTES);

package/dist/lib/utils/popup-tools.js

@@ -98,26 +98,30 @@ function popupExecute(execute, url, name, options, callback) {
             //
         };
     const optionsString = optionsToString(popupOptions);
-    const win = execute(url, popupName, optionsString);
+    // Only the page we opened may answer: the popup name is predictable, so
+    // without these checks any window could inject a response (e.g. an
+    // attacker's session and keys on login).
     const expectedOrigin = new URL(url, window.location.href).origin;
+    const win = execute(url, popupName, optionsString);
     let isMessageSent = false;
     let interval;
     function popupCallbackOnce(err, data) {
         if (!isMessageSent) {
             isMessageSent = true;
+            window.removeEventListener('message', onMessage);
+            clearInterval(interval);
             popupCallback(err, data);
         }
     }
     function onMessage(message) {
-        if (message === undefined || message.origin !== expectedOrigin) {
-            console.error('Invalid message origin', message?.origin, expectedOrigin);
+        if (win === null ||
+            message.source !== win ||
+            message.origin !== expectedOrigin) {
             return;
         }
         const data = message.data;
-        if (data !== undefined && data.id === popupName) {
+        if (data !== undefined && data !== null && data.id === popupName) {
             popupCallbackOnce(undefined, data.data);
-            window.removeEventListener('message', onMessage);
-            clearInterval(interval);
         }
     }
     window.addEventListener('message', onMessage, false);
@@ -181,8 +185,14 @@ export function popupWithPost(url, postData, name, options, callback) {
 }
 /**
  * Return html that when executed, will trigger the popup to callback with a response
+ *
+ * @param  {Object}
+ * @param  {String} targetOrigin origin of the opener allowed to receive `data`
+ * @return {String}
  */
 export function popupResponse(id, data, targetOrigin) {
-    const jsonData = JSON.stringify({ id, data });
-    return `<script>window.opener.postMessage(${jsonData}, ${JSON.stringify(targetOrigin)});setTimeout(function() { window.close(); }, 50);</script>`;
+    // Escape "<" so the payload cannot close the script tag.
+    const jsonData = JSON.stringify({ id, data }).replaceAll('<', '\\u003c');
+    const origin = JSON.stringify(targetOrigin).replaceAll('<', '\\u003c');
+    return `<script>window.opener.postMessage(${jsonData}, ${origin});setTimeout(function() { window.close(); }, 50);</script>`;
 }

package/dist/lib/versioning.js

@@ -1 +1 @@
-export const SECRECY_LIB_VERSION = '1.86.3';
+export const SECRECY_LIB_VERSION = '0.0.0-development';