keybase-proofs 2.3.33 → 2.3.34

package/src/schema3.iced

@@ -1,8 +1,16 @@
 
 parse = require './parse3'
+{has_own,get_own} = require './util'
 
 mkerr = (path, err) -> new Error "At #{path.toString()}: #{err}"
 
+# __proto__ is not a data key. `{ __proto__: x }` and `obj["__proto__"] = x`
+# set [[Prototype]] instead of an own property. JSON.parse may store it as an
+# own key; msgpack unpack may throw. Ban it as a schema and payload key.
+# constructor, toString, hasOwnProperty, etc. are allowed; has_own treats them
+# as own keys.
+is_reserved_key_name = (k) -> k is '__proto__'
+
 class Path
   constructor : (v) ->
     @_v = v or []
@@ -33,11 +41,13 @@ class Node
 
   _check_value : ({checker, path, obj}) ->
     if not obj? and checker.is_optional() then return null
-    if not obj? then mkerr path, "value cannot be null"
+    if not obj? then return mkerr path, "value cannot be null"
     return checker._check { path, obj  }
 
 class Dict extends Node
   constructor : ({keys}) ->
+    for k of keys
+      if is_reserved_key_name k then throw new Error "schema key name is not allowed: #{k}"
     @_keys = keys
     # do not fail if there are extra keys unknown to schema
     @_allow_extra_keys = false
@@ -48,22 +58,24 @@ class Dict extends Node
       return mkerr path, "need a dictionary"
     for k,v of obj
       new_path = path.extend(k)
-      if not (checker = @_keys[k])?
+      if is_reserved_key_name k then return mkerr new_path, "key name is not allowed"
+      if not (checker = get_own(@_keys, k))?
         if @_allow_extra_keys then continue
         return mkerr new_path, "key is not supported"
       if (err = @_check_value { checker, path : new_path, obj : v }) then return err
     for k,v of @_keys
       new_path = path.extend(k)
-      if not obj[k]? and not v.is_optional() then return mkerr new_path, "key is missing but is mandatory"
+      if not has_own(obj, k) and not v.is_optional() then return mkerr new_path, "key is missing but is mandatory"
     return null
 
   debug_localize : (obj) ->
     ret = {}
-    for k,v of @_keys when obj[k]?
+    for k,v of @_keys when has_own obj, k
       ret[v._name or k] = v.debug_localize obj[k]
     ret
 
   set_key : (k,v) ->
+    if is_reserved_key_name k then throw new Error "schema key name is not allowed: #{k}"
     @_keys[k] = v
 
   allow_extra_keys : () ->
@@ -125,7 +137,7 @@ class Binary extends Node
 
   _convert_and_check : ({path, obj}) ->
     if @_convert and typeof(obj) is 'string'
-      obj = Buffer.from(obj, 'hex')
+      obj = parse.decode_hex(obj)
     unless Buffer.isBuffer(obj) and obj.length is @_len
       return [ (mkerr path, "value needs to be buffer of length #{@_len}"), null ]
     if @_bottom_bytes?
@@ -186,10 +198,11 @@ class StringEnum extends Node
   constructor : ({values}) ->
     @_values = {}
     for v in values
+      if is_reserved_key_name v then throw new Error "enum value is not allowed: #{v}"
       @_values[v] = true
   _check : ({path, obj}) ->
     if typeof(obj) isnt 'string' then return mkerr path, "value must be a string"
-    if not @_values[obj] then return mkerr path, "unknown enum value (#{obj})"
+    if not has_own(@_values, obj) then return mkerr path, "unknown enum value (#{obj})"
     return null
 
 class Value extends Node
@@ -218,7 +231,7 @@ class Or extends Node
     @_terms = terms
   _check : ({path, obj}) ->
     ok = false
-    for t in @_terms when t.check(obj)
+    for t in @_terms when not t.check(obj)
       ok = true
       break
     if not ok then return mkerr path, "no structure worked"

package/src/scrapers/twitter.iced

@@ -148,12 +148,12 @@ exports.TwitterScraper = class TwitterScraper extends BaseScraper
 
     # twitter may not obey our matching request order
     if responses?.length
-      dict = {}
+      map = new Map
       key  = if ids? then "id_str" else "screen_name"
-      dict[r[key]] = r for r in responses
+      map.set String(r[key]), r for r in responses
       res = []
       for identifier, i in input_list
-        res[i] = dict[identifier] or null
+        res[i] = map.get(String(identifier)) or null
 
     cb err, res
 

package/src/util.iced

@@ -5,6 +5,17 @@ crypto = require 'crypto'
 
 #----------
 
+# Native hasOwnProperty, captured so schema/input keys named
+# "hasOwnProperty" cannot shadow the method. Use instead of obj[k] or
+# obj.hasOwnProperty(k) — those see Object.prototype (constructor, toString, …).
+_has_own = {}.constructor.prototype.hasOwnProperty
+exports.has_own = has_own = (o, k) -> _has_own.call o, k
+exports.get_own = get_own = (o, k) ->
+  if _has_own.call(o, k) then o[k]
+  else undefined
+
+#----------
+
 exports.json_secure_compare = json_secure_compare = (a,b) ->
   [o1,o2] = (json_stringify_sorted(x) for x in [a,b])
   err = if bufeq_secure((Buffer.from o1, 'utf8'), (Buffer.from o2, 'utf8')) then null

package/test/files/alloc.iced

@@ -0,0 +1,40 @@
+{alloc,get_klass} = require '../../'
+
+exports.test_unknown_type = (T,cb) ->
+  for type in ["", "not_a_real_type", "toString", "constructor", "__proto__"]
+    [err, klass] = get_klass type
+    T.assert err?, "error"
+    T.equal err.message, "Unknown proof class: #{type}", "right message"
+    T.assert not klass?, "no klass"
+    T.assert not(alloc type, {}), "alloc returns null"
+
+  cb null
+
+exports.test_extra_lookup_tab = (T,cb) ->
+  class Dummy
+    constructor : (args) -> @args = args
+
+  # only used in keybase-proofs-test
+  extra_lookup_tab = {
+    "test.web_service_binding.rooter" : Dummy
+  }
+
+  [err, klass] = get_klass "test.web_service_binding.rooter", extra_lookup_tab
+  T.assert not err?, "no error for extra type"
+  T.equal klass, Dummy, "extra type klass"
+  obj = alloc "test.web_service_binding.rooter", {foo : 1}, extra_lookup_tab
+  T.assert obj?, "alloc extra type"
+  T.equal obj.args.foo, 1, "args passed through"
+
+  [err, klass] = get_klass "track", extra_lookup_tab
+  T.assert not err?, "builtin still found"
+  T.assert klass?, "builtin klass"
+
+  for type in ["", "not_a_real_type", "toString", "constructor", "__proto__"]
+    [err, klass] = get_klass type, extra_lookup_tab
+    T.assert err?, "error"
+    T.equal err.message, "Unknown proof class: #{type}", "right message"
+    T.assert not klass?, "no klass"
+    T.assert not(alloc type, {}, extra_lookup_tab), "alloc returns null"
+
+  cb null

package/test/files/parse3.iced

@@ -0,0 +1,61 @@
+parse3 = require '../../lib/parse3'
+schema = require '../../lib/schema3'
+
+exports.hex_rejects_trailing_junk = (T, cb) ->
+  uid = "00".repeat(15) + "19"
+  hash = "00".repeat(32)
+
+  uid_upper = "AA".repeat(15) + "19"
+
+  T.assert parse3.is_hex(uid, 16), "valid uid hex is accepted"
+  T.assert parse3.is_hex(uid_upper, 16), "uppercase uid hex is accepted"
+  T.assert not parse3.is_hex(uid + "zz", 16), "uid hex plus junk is rejected"
+  T.assert not parse3.is_hex(uid + "a", 16), "odd-length uid hex is rejected"
+  T.assert not parse3.is_hex(hash + "nothex", 32), "hash hex plus junk is rejected"
+
+  T.assert not parse3.is_uid(hash), "length has to match"
+
+  err = schema.uid().convert().check uid
+  T.assert not err?, "valid uid converts"
+
+  err = schema.uid().convert().check uid_upper
+  T.assert not err?, "uppercase uid converts"
+
+  err = schema.uid().convert().check hash
+  T.assert err?, "length has to match"
+
+  err = schema.uid().convert().check uid + "zz"
+  T.assert err?, "uid with trailing junk is rejected"
+
+  err = schema.uid().convert().check uid + "a"
+  T.assert err?, "odd-length uid is rejected"
+
+  err = schema.hash().convert().check hash + "zz"
+  T.assert err?, "hash with trailing junk is rejected"
+
+  out = parse3.unhex uid
+  T.assert Buffer.isBuffer(out) and out.length is 16, "unhex accepts valid uid"
+
+  out = parse3.unhex uid_upper
+  T.assert Buffer.isBuffer(out) and out.length is 16, "unhex accepts uppercase uid"
+
+  for bad in [uid + "zz", uid + "a"]
+    err = null
+    try
+      parse3.unhex bad
+    catch e
+      err = e
+    T.assert err?, "unhex rejects #{bad}"
+    T.assert err.toString().indexOf("bad binary or hex string") >= 0, "unhex error message"
+
+  cb null
+
+exports.hex_rejects_length_like_objects = (T, cb) ->
+  uid_buf = Buffer.alloc 16
+  T.assert parse3.is_hex(uid_buf, 16), "buffer of the right length is accepted"
+  T.assert not parse3.is_hex(Buffer.alloc(15), 16), "buffer of the wrong length is rejected"
+  T.assert not parse3.is_hex({length : 16}, 16), "plain object with length is rejected"
+  T.assert not parse3.is_hex((0 for i in [0...16]), 16), "array of the right length is rejected"
+  T.assert not parse3.is_uid({length : 16}), "is_uid rejects a length-like object"
+
+  cb null

package/test/files/schema3.iced

@@ -0,0 +1,258 @@
+schema = require '../../lib/schema3'
+{pack,unpack} = require 'purepack'
+
+# These collide with Object.prototype and with lookups like obj[k] /
+# obj.hasOwnProperty(k).
+_object_proto_names = [
+  "__proto__"
+  "constructor"
+  "hasOwnProperty"
+  "isPrototypeOf"
+  "propertyIsEnumerable"
+  "toLocaleString"
+  "toString"
+  "valueOf"
+]
+# "Weird key names" - Object prototype keys but handled by schema3 library.
+# With the exception of __proto__ - this one is banned because it requires
+# extra care to get right and has more footguns. See src/schema3.iced
+# is_reserved_key_name
+_weird_key_names = (n for n in _object_proto_names when n isnt "__proto__")
+
+exports.prototype_pollution_json = (T, cb) ->
+  # parsing "__proto__" property should not change resulting object's
+  # prototype.
+  obj = JSON.parse('{"__proto__":1}')
+  T.assert Object.getPrototypeOf(obj) is Object.prototype, "is Object.prototype"
+  T.assert Object::hasOwnProperty.call(obj, '__proto__'), "hasOwnProperty __proto__"
+
+  cb null
+
+exports.prototype_pollution_purepack = (T, cb) ->
+  # purepack does not allow __proto__ keys, although accidentially.
+
+  # Create a purepack with aaaaaaaaa property
+  aaa = Buffer.from (pack { aaaaaaaaa : 1 })
+
+  # Sanity check, 'aaaaaaaaa' is just a normal key in an unpacked object.
+  obj = unpack aaa
+  T.assert Object.getPrototypeOf(obj) is Object.prototype, "is Object.prototype"
+  T.assert Object::hasOwnProperty.call(obj, 'aaaaaaaaa'), "hasOwnProperty aaaaaaaaa"
+
+  # Str-replace aaaaaaaaa into __proto__
+  bin = Buffer.from(aaa.toString('binary').replace('aaaaaaaaa', '__proto__'), 'binary')
+  err = null
+  try
+    unpack(bin)
+  catch e
+    err = e
+  T.assert err?
+  T.equal err?.message, "duplicate key '__proto__'"
+
+  cb null
+
+exports.or_combinator = (T, cb) ->
+  schm = schema.or([
+    schema.dict({
+      name : schema.string()
+      username : schema.string()
+    })
+    schema.dict({
+      protocol : schema.string()
+      hostname : schema.string()
+    })
+  ])
+
+  err = schm.check { name : "reddit", username : "alice" }
+  T.assert not err?, "object matching first term is accepted"
+
+  err = schm.check { protocol : "https:", hostname : "example.com" }
+  T.assert not err?, "object matching second term is accepted"
+
+  err = schm.check { invalid : 1, obj : 2 }
+  T.assert err?, "object matching no term is rejected"
+  T.equal err?.message, "At <top>: no structure worked"
+
+  cb null
+
+exports.required_null_rejected = (T, cb) ->
+  for val in [null, undefined]
+    err = schema.array(schema.obj()).check [val]
+    T.assert err?, "array of obj() rejects null"
+    T.equal err?.message, "At <top>.0: value cannot be null"
+
+    err = schema.array(schema.string()).check [val]
+    T.assert err?, "array of obj() rejects null"
+    T.equal err?.message, "At <top>.0: value cannot be null"
+
+    err = schema.struct([schema.obj()]).check [val]
+    T.assert err?, "struct of obj() rejects null"
+    T.equal err?.message, "At <top>.0: value cannot be null"
+
+    err = schema.struct([schema.string()]).check [val]
+    T.assert err?, "struct of obj() rejects null"
+    T.equal err?.message, "At <top>.0: value cannot be null"
+
+    err = schema.dict({ x : schema.obj() }).check { x : val }
+    T.assert err?, "dict required obj() null is rejected"
+    T.equal err?.message, "At <top>.x: value cannot be null"
+
+    err = schema.dict({ x : schema.string() }).check { x : val }
+    T.assert err?, "dict required string null is rejected"
+    T.equal err?.message, "At <top>.x: value cannot be null"
+
+    err = schema.dict({ x : schema.string().optional() }).check { x : val }
+    T.assert not err?, "dict optional string null is accepted"
+
+  cb null
+
+exports.dict_missing_mandatory_key = (T, cb) ->
+  schm = schema.dict({
+    n : schema.string().name("name")
+    nick : schema.string().optional()
+  })
+
+  err = schm.check { n : "alice" }
+  T.assert not err?, "optional key may be omitted"
+
+  err = schm.check { nick : "a" }
+  T.assert err?, "missing mandatory key is rejected"
+  T.equal err?.message, "At <top>.n: key is missing but is mandatory"
+
+  err = schm.check {}
+  T.assert err?, "empty dict missing mandatory key is rejected"
+  T.equal err?.message, "At <top>.n: key is missing but is mandatory"
+
+  localized = schm.debug_localize { n : "alice" }
+  T.equal localized.name, "alice", "debug_localize uses schema names"
+  T.assert not localized.n?, "short key is replaced"
+
+  cb null
+
+exports.string_enum_rejects_unknown_weird_names = (T, cb) ->
+  schm = schema.string_enum ["in_person", "proofs", "video"]
+  err = schm.check "video"
+  T.assert not err?, "listed enum value is accepted"
+
+  err = schm.check "nope"
+  T.assert err?, "unknown enum value is rejected"
+
+  # Make sure that Object prototype names are not bugging out with string enum check.
+  for name in _object_proto_names
+    err = schm.check name
+    T.assert err?, "#{name} is not an enum value just because it is a prototype name"
+    T.assert (err?.message.indexOf("unknown enum value") >= 0), "#{name} error message"
+
+  cb null
+
+exports.string_enum_allows_weird_names = (T, cb) ->
+  for name in _weird_key_names
+    # Allow a string enum with weird name.
+    schm = schema.string_enum [name]
+    # And it can also be checked properly
+    err = schm.check name
+    T.assert not err?, "#{name} can be an enum value"
+    err = schm.check "nope"
+    T.assert err?, "other values still rejected next to #{name}"
+
+  # Do not allow banned __proto__ name.
+  threw = null
+  try
+    schema.string_enum ["__proto__"]
+  catch e
+    threw = e
+  T.assert threw?, "__proto__ is not a valid enum value"
+  T.equal threw?.message, "enum value is not allowed: __proto__"
+
+  cb null
+
+exports.dict_rejects_unknown_weird_keys = (T, cb) ->
+  schm = schema.dict { name : schema.string() }
+  err = schm.check { name : "ok" }
+  T.assert not err?, "valid dict is accepted"
+
+  err = schm.check { name : "ok", extra : 1 }
+  T.assert err?, "unknown key is rejected"
+  T.equal err?.message, "At <top>.extra: key is not supported"
+
+  # Allow weird key names to be checked against the schema, they are just not
+  # defined as dict fields and payloads with these fields are correctly
+  # rejected. They are not rejected / banned, and are treated as any other name
+  # (also see next test).
+  for name in _weird_key_names
+    obj = JSON.parse "{\"name\":\"ok\",\"#{name}\":1}"
+    err = null
+    threw = null
+    try
+      err = schm.check obj
+    catch e
+      threw = e
+    T.assert not threw?, "#{name} should not throw"
+    T.assert err?, "#{name} extra key is not a schema field"
+    T.equal err?.message, "At <top>.#{name}: key is not supported"
+
+  obj = JSON.parse '{"name":"ok","__proto__":1}'
+  err = schm.check obj
+  T.assert err?, "__proto__ extra key is rejected"
+  T.equal err?.message, "At <top>.__proto__: key name is not allowed"
+
+  schm = schema.dict({ name : schema.string() }).allow_extra_keys()
+  obj = JSON.parse '{"name":"ok","constructor":1}'
+  err = schm.check obj
+  T.assert not err?, "constructor extra key is allowed when extra keys are allowed"
+
+  obj = JSON.parse '{"name":"ok","__proto__":1}'
+  err = schm.check obj
+  T.assert err?, "__proto__ is rejected even with allow_extra_keys"
+  T.equal err?.message, "At <top>.__proto__: key name is not allowed"
+
+  cb null
+
+exports.dict_weird_schema_keys = (T, cb) ->
+  # Weird keys can be used in the schema as well, and objects with these
+  # keys can be checked against the schemas.
+  for name in _weird_key_names
+    keys = {}
+    keys[name] = schema.string()
+    schm = schema.dict keys
+
+    own = JSON.parse "{\"#{name}\":\"ok\"}"
+    err = schm.check own
+    T.assert not err?, "own #{name} key is accepted"
+
+    err = schm.check {}
+    T.assert err?, "inherited #{name} does not satisfy a required schema key"
+    T.equal err?.message, "At <top>.#{name}: key is missing but is mandatory"
+
+    localized = schm.debug_localize {}
+    T.assert not Object::hasOwnProperty.call(localized, name), "debug_localize ignores inherited #{name}"
+    localized = schm.debug_localize own
+    T.equal localized[name], "ok", "own #{name} key is localized"
+
+    schm = schema.dict { name : schema.string() }
+    schm.set_key name, schema.string()
+    obj = JSON.parse "{\"name\":\"ok\",\"#{name}\":\"ok\"}"
+    err = schm.check obj
+    T.assert not err?, "set_key can install #{name}"
+
+  # With the exception of __proto__ which is rejected in the schema construction stage.
+  keys = {}
+  Object.defineProperty keys, "__proto__", { value : schema.string(), enumerable : true }
+  threw = null
+  try
+    schema.dict keys
+  catch e
+    threw = e
+  T.assert threw?, "__proto__ is not a valid schema key"
+  T.equal threw?.message, "schema key name is not allowed: __proto__"
+
+  schm = schema.dict { name : schema.string() }
+  threw = null
+  try
+    schm.set_key "__proto__", schema.string()
+  catch e
+    threw = e
+  T.assert threw?, "set_key rejects __proto__"
+  T.equal threw?.message, "schema key name is not allowed: __proto__"
+
+  cb null

package/.travis.yml

@@ -1,10 +0,0 @@
-language: node_js
-node_js:
-  - "node"
-notifications:
-  slack:
-    rooms:
-      secure: W5hUm0MPWJ3v2VGRAq9fxgroVvqFOkwnbrxllEX3Zadf3e909fwQzm7KEUvSEd9fhsKrdBxPrphCZd1UCq5cXjCkfokKFojnbgnYPKZYgL4M7GWqiURCfIUY7r0gQCDnFzIIANacIbhT8089IkQva8QWCdfX4zVycTKOvMC0msE=
-branches:
-  only:
-    - master

package/lib/wot.js

@@ -1,147 +0,0 @@
-// Generated by IcedCoffeeScript 108.0.11
-(function() {
-  var Base, React, Vouch, constants, json_stringify_sorted, make_esc, pgp_utils, schema, streq_secure, unix_time, _ref,
-    __hasProp = {}.hasOwnProperty,
-    __extends = function(child, parent) { for (var key in parent) { if (__hasProp.call(parent, key)) child[key] = parent[key]; } function ctor() { this.constructor = child; } ctor.prototype = parent.prototype; child.prototype = new ctor(); child.__super__ = parent.prototype; return child; };
-
-  Base = require('./base').Base;
-
-  constants = require('./constants').constants;
-
-  make_esc = require('iced-error').make_esc;
-
-  pgp_utils = require('pgp-utils');
-
-  _ref = pgp_utils.util, json_stringify_sorted = _ref.json_stringify_sorted, unix_time = _ref.unix_time, streq_secure = _ref.streq_secure;
-
-  schema = require('./schema3');
-
-  exports.Vouch = Vouch = (function(_super) {
-    __extends(Vouch, _super);
-
-    function Vouch(obj) {
-      this.wot = obj.wot;
-      Vouch.__super__.constructor.call(this, obj);
-    }
-
-    Vouch.prototype._v_stub_paths = function() {
-      return ["body.wot_vouch"];
-    };
-
-    Vouch.prototype._type = function() {
-      return constants.sig_types.wot.vouch;
-    };
-
-    Vouch.prototype._type_v2 = function(revoke_flag) {
-      if ((this.revoke != null) || revoke_flag) {
-        return constants.sig_types_v2.wot.vouch_with_revoke;
-      } else {
-        return constants.sig_types_v2.wot.vouch;
-      }
-    };
-
-    Vouch.prototype._v_check = function(_arg, cb) {
-      var err, json, obj, proof_schema, schm;
-      json = _arg.json;
-      obj = json.body.wot_vouch;
-      if (obj == null) {
-        return cb(null);
-      }
-      proof_schema = schema.or([
-        schema.dict({
-          proof_type: schema.int(),
-          name: schema.string(),
-          username: schema.string()
-        }), schema.dict({
-          proof_type: schema.int(),
-          protocol: schema.string(),
-          hostname: schema.string()
-        }), schema.dict({
-          proof_type: schema.int(),
-          protocol: schema.string(),
-          domain: schema.string()
-        })
-      ]);
-      schm = schema.dict({
-        user: schema.dict({
-          username: schema.string(),
-          uid: schema.uid().convert(),
-          eldest: schema.dict({
-            seqno: schema.int(),
-            kid: schema.kid().convert()
-          }),
-          seq_tail: schema.dict({
-            seqno: schema.int(),
-            sig_id: schema.sig_id().convert(),
-            payload_hash: schema.hash().convert()
-          })
-        }),
-        confidence: schema.dict({
-          username_verified_via: schema.string_enum(["in_person", "proofs", "video", "audio", "other_chat", "familiar", "other"]).optional(),
-          proofs: schema.array(proof_schema).optional(),
-          other: schema.string({
-            max_length: 90
-          }).optional()
-        }),
-        vouch_text: schema.string({
-          max_length: 700
-        })
-      });
-      err = schm.check(obj);
-      return cb(err);
-    };
-
-    Vouch.prototype._v_customize_json = function(ret) {
-      var t, _ref1;
-      if ((t = (_ref1 = this.wot) != null ? _ref1.vouch : void 0) != null) {
-        return ret.body.wot_vouch = t;
-      }
-    };
-
-    return Vouch;
-
-  })(Base);
-
-  exports.React = React = (function(_super) {
-    __extends(React, _super);
-
-    function React(obj) {
-      this.wot = obj.wot;
-      React.__super__.constructor.call(this, obj);
-    }
-
-    React.prototype._v_stub_paths = function() {
-      return ["body.wot_react"];
-    };
-
-    React.prototype._type = function() {
-      return constants.sig_types.wot.react;
-    };
-
-    React.prototype._type_v2 = function(revoke_flag) {
-      return constants.sig_types_v2.wot.react;
-    };
-
-    React.prototype._v_check = function(_arg, cb) {
-      var json, obj, schm;
-      json = _arg.json;
-      obj = json.body.wot_react;
-      schm = schema.dict({
-        sig_id: schema.sig_id().convert(),
-        reaction: schema.string_enum(["accept", "reject"])
-      });
-      return cb(schm.check(obj));
-    };
-
-    React.prototype._v_customize_json = function(ret) {
-      var t;
-      if ((t = this.wot.react) != null) {
-        return ret.body.wot_react = t;
-      }
-    };
-
-    return React;
-
-  })(Base);
-
-}).call(this);