keybase-proofs 2.3.33 → 2.3.35

package/src/schema3.iced

@@ -1,8 +1,16 @@
 
 parse = require './parse3'
+{has_own,get_own} = require './util'
 
 mkerr = (path, err) -> new Error "At #{path.toString()}: #{err}"
 
+# __proto__ is not a data key. `{ __proto__: x }` and `obj["__proto__"] = x`
+# set [[Prototype]] instead of an own property. JSON.parse may store it as an
+# own key; msgpack unpack may throw. Ban it as a schema and payload key.
+# constructor, toString, hasOwnProperty, etc. are allowed; has_own treats them
+# as own keys.
+is_reserved_key_name = (k) -> k is '__proto__'
+
 class Path
   constructor : (v) ->
     @_v = v or []
@@ -33,11 +41,13 @@ class Node
 
   _check_value : ({checker, path, obj}) ->
     if not obj? and checker.is_optional() then return null
-    if not obj? then mkerr path, "value cannot be null"
+    if not obj? then return mkerr path, "value cannot be null"
     return checker._check { path, obj  }
 
 class Dict extends Node
   constructor : ({keys}) ->
+    for k of keys
+      if is_reserved_key_name k then throw new Error "schema key name is not allowed: #{k}"
     @_keys = keys
     # do not fail if there are extra keys unknown to schema
     @_allow_extra_keys = false
@@ -48,22 +58,24 @@ class Dict extends Node
       return mkerr path, "need a dictionary"
     for k,v of obj
       new_path = path.extend(k)
-      if not (checker = @_keys[k])?
+      if is_reserved_key_name k then return mkerr new_path, "key name is not allowed"
+      if not (checker = get_own(@_keys, k))?
         if @_allow_extra_keys then continue
         return mkerr new_path, "key is not supported"
       if (err = @_check_value { checker, path : new_path, obj : v }) then return err
     for k,v of @_keys
       new_path = path.extend(k)
-      if not obj[k]? and not v.is_optional() then return mkerr new_path, "key is missing but is mandatory"
+      if not has_own(obj, k) and not v.is_optional() then return mkerr new_path, "key is missing but is mandatory"
     return null
 
   debug_localize : (obj) ->
     ret = {}
-    for k,v of @_keys when obj[k]?
+    for k,v of @_keys when has_own obj, k
       ret[v._name or k] = v.debug_localize obj[k]
     ret
 
   set_key : (k,v) ->
+    if is_reserved_key_name k then throw new Error "schema key name is not allowed: #{k}"
     @_keys[k] = v
 
   allow_extra_keys : () ->
@@ -125,7 +137,7 @@ class Binary extends Node
 
   _convert_and_check : ({path, obj}) ->
     if @_convert and typeof(obj) is 'string'
-      obj = Buffer.from(obj, 'hex')
+      obj = parse.decode_hex(obj)
     unless Buffer.isBuffer(obj) and obj.length is @_len
       return [ (mkerr path, "value needs to be buffer of length #{@_len}"), null ]
     if @_bottom_bytes?
@@ -186,10 +198,11 @@ class StringEnum extends Node
   constructor : ({values}) ->
     @_values = {}
     for v in values
+      if is_reserved_key_name v then throw new Error "enum value is not allowed: #{v}"
       @_values[v] = true
   _check : ({path, obj}) ->
     if typeof(obj) isnt 'string' then return mkerr path, "value must be a string"
-    if not @_values[obj] then return mkerr path, "unknown enum value (#{obj})"
+    if not has_own(@_values, obj) then return mkerr path, "unknown enum value (#{obj})"
     return null
 
 class Value extends Node
@@ -218,7 +231,7 @@ class Or extends Node
     @_terms = terms
   _check : ({path, obj}) ->
     ok = false
-    for t in @_terms when t.check(obj)
+    for t in @_terms when not t.check(obj)
       ok = true
       break
     if not ok then return mkerr path, "no structure worked"

package/src/scrapers/twitter.iced

@@ -148,12 +148,12 @@ exports.TwitterScraper = class TwitterScraper extends BaseScraper
 
     # twitter may not obey our matching request order
     if responses?.length
-      dict = {}
+      map = new Map
       key  = if ids? then "id_str" else "screen_name"
-      dict[r[key]] = r for r in responses
+      map.set String(r[key]), r for r in responses
       res = []
       for identifier, i in input_list
-        res[i] = dict[identifier] or null
+        res[i] = map.get(String(identifier)) or null
 
     cb err, res
 

package/src/subkey.iced

@@ -59,10 +59,10 @@ exports.SubkeyBase = class SubkeyBase extends Base
       err = new Error "Reverse sig json mismatch: #{a} != #{b}"
     return err
 
-  _v_check : ({json, assert_pgp_hash}, cb) ->
+  _v_check : ({json, assert_pgp_hash, pgp_max_length}, cb) ->
     esc = make_esc cb, "SubkeyBase::_v_check"
     await super { json }, esc defer()
-    await @reverse_sig_check { json, new_km: @get_new_km(), assert_pgp_hash }, esc defer()
+    await @reverse_sig_check { json, new_km: @get_new_km(), assert_pgp_hash, pgp_max_length }, esc defer()
     cb null
 
   _get_reverse_sig : (json) ->
@@ -73,7 +73,7 @@ exports.SubkeyBase = class SubkeyBase extends Base
     # body.sibkey.reverse_sig should be the only field different between the two
     outer.body[@get_key_field()].reverse_sig = null
 
-  reverse_sig_check : ({json, new_km, subkm, assert_pgp_hash}, cb) ->
+  reverse_sig_check : ({json, new_km, subkm, assert_pgp_hash, pgp_max_length}, cb) ->
 
     # For historical reasons, some people call 'new_km' 'subkm'
     new_km or= subkm
@@ -82,7 +82,9 @@ exports.SubkeyBase = class SubkeyBase extends Base
     err = null
     if (sig = @_get_reverse_sig(json))? and new_km?
       eng = new_km.make_sig_eng()
-      await eng.unbox sig, esc(defer(raw)), { assert_pgp_hash }
+      # pgp_max_length only applies to PGP messages since Keybase NaCl
+      # does not have a compression feature.
+      await eng.unbox sig, esc(defer(raw)), { assert_pgp_hash, pgp_max_length }
       await a_json_parse raw, esc defer payload
       rsk = new_km.get_ekid().toString('hex')
       if (err = @_match_json json, payload)? then # noop

package/src/util.iced

@@ -5,6 +5,17 @@ crypto = require 'crypto'
 
 #----------
 
+# Native hasOwnProperty, captured so schema/input keys named
+# "hasOwnProperty" cannot shadow the method. Use instead of obj[k] or
+# obj.hasOwnProperty(k) — those see Object.prototype (constructor, toString, …).
+_has_own = {}.constructor.prototype.hasOwnProperty
+exports.has_own = has_own = (o, k) -> _has_own.call o, k
+exports.get_own = get_own = (o, k) ->
+  if _has_own.call(o, k) then o[k]
+  else undefined
+
+#----------
+
 exports.json_secure_compare = json_secure_compare = (a,b) ->
   [o1,o2] = (json_stringify_sorted(x) for x in [a,b])
   err = if bufeq_secure((Buffer.from o1, 'utf8'), (Buffer.from o2, 'utf8')) then null

package/.travis.yml

@@ -1,10 +0,0 @@
-language: node_js
-node_js:
-  - "node"
-notifications:
-  slack:
-    rooms:
-      secure: W5hUm0MPWJ3v2VGRAq9fxgroVvqFOkwnbrxllEX3Zadf3e909fwQzm7KEUvSEd9fhsKrdBxPrphCZd1UCq5cXjCkfokKFojnbgnYPKZYgL4M7GWqiURCfIUY7r0gQCDnFzIIANacIbhT8089IkQva8QWCdfX4zVycTKOvMC0msE=
-branches:
-  only:
-    - master

package/CONTRIBUTORS.md

@@ -1,5 +0,0 @@
-
-## Contributors
-
- * Keybase employees
- * @mark-adams (bitbucket)

package/Makefile

@@ -1,70 +0,0 @@
-ICED=node_modules/.bin/iced
-BUILD_STAMP=build-stamp
-TEST_STAMP=test-stamp
-UGLIFYJS=node_modules/.bin/uglifyjs
-WD=`pwd`
-BROWSERIFY=node_modules/.bin/browserify
-
-default: build
-all: build
-
-lib/%.js: src/%.iced
-	$(ICED) -I browserify -c -o `dirname $@` $<
-
-$(BUILD_STAMP): \
-	lib/alloc.js \
-	lib/alloc3.js \
-	lib/announcement.js \
-	lib/auth.js \
-	lib/base.js \
-	lib/b64extract.js \
-	lib/constants.js \
-	lib/cryptocurrency.js \
-	lib/device.js \
-	lib/eldest.js \
-	lib/errors.js \
-	lib/expand.js \
-	lib/main.js \
-	lib/parse3.js \
-	lib/revoke.js \
-	lib/schema3.js \
-	lib/sibkey.js \
-	lib/sig3.js \
-	lib/subkey.js \
-	lib/per_user_key.js \
-	lib/pgp_update.js \
-	lib/scrapers/base.js \
-	lib/scrapers/coinbase.js \
-	lib/scrapers/dns.js \
-	lib/scrapers/facebook.js \
-	lib/scrapers/generic_web_site.js \
-	lib/scrapers/github.js \
-	lib/scrapers/hackernews.js \
-	lib/scrapers/reddit.js \
-	lib/scrapers/twitter.js \
-	lib/scrapers/generic_social.js \
-	lib/team.js \
-	lib/team_hidden.js \
-	lib/track.js \
-	lib/wallet.js \
-	lib/web_service.js \
-	lib/wot.js \
-	lib/update_passphrase_hash.js \
-	lib/update_settings.js \
-	lib/util.js
-	date > $@
-
-build: $(BUILD_STAMP)
-
-test-server: $(BUILD_STAMP)
-	$(ICED) test/run.iced
-
-test: test-server
-
-clean:
-	rm -rf lib/* lib/scrapers/* $(BUILD_STAMP) $(TEST_STAMP)
-
-setup:
-	npm install -d
-
-.PHONY: clean setup test  test-browser

package/lib/wot.js

@@ -1,147 +0,0 @@
-// Generated by IcedCoffeeScript 108.0.11
-(function() {
-  var Base, React, Vouch, constants, json_stringify_sorted, make_esc, pgp_utils, schema, streq_secure, unix_time, _ref,
-    __hasProp = {}.hasOwnProperty,
-    __extends = function(child, parent) { for (var key in parent) { if (__hasProp.call(parent, key)) child[key] = parent[key]; } function ctor() { this.constructor = child; } ctor.prototype = parent.prototype; child.prototype = new ctor(); child.__super__ = parent.prototype; return child; };
-
-  Base = require('./base').Base;
-
-  constants = require('./constants').constants;
-
-  make_esc = require('iced-error').make_esc;
-
-  pgp_utils = require('pgp-utils');
-
-  _ref = pgp_utils.util, json_stringify_sorted = _ref.json_stringify_sorted, unix_time = _ref.unix_time, streq_secure = _ref.streq_secure;
-
-  schema = require('./schema3');
-
-  exports.Vouch = Vouch = (function(_super) {
-    __extends(Vouch, _super);
-
-    function Vouch(obj) {
-      this.wot = obj.wot;
-      Vouch.__super__.constructor.call(this, obj);
-    }
-
-    Vouch.prototype._v_stub_paths = function() {
-      return ["body.wot_vouch"];
-    };
-
-    Vouch.prototype._type = function() {
-      return constants.sig_types.wot.vouch;
-    };
-
-    Vouch.prototype._type_v2 = function(revoke_flag) {
-      if ((this.revoke != null) || revoke_flag) {
-        return constants.sig_types_v2.wot.vouch_with_revoke;
-      } else {
-        return constants.sig_types_v2.wot.vouch;
-      }
-    };
-
-    Vouch.prototype._v_check = function(_arg, cb) {
-      var err, json, obj, proof_schema, schm;
-      json = _arg.json;
-      obj = json.body.wot_vouch;
-      if (obj == null) {
-        return cb(null);
-      }
-      proof_schema = schema.or([
-        schema.dict({
-          proof_type: schema.int(),
-          name: schema.string(),
-          username: schema.string()
-        }), schema.dict({
-          proof_type: schema.int(),
-          protocol: schema.string(),
-          hostname: schema.string()
-        }), schema.dict({
-          proof_type: schema.int(),
-          protocol: schema.string(),
-          domain: schema.string()
-        })
-      ]);
-      schm = schema.dict({
-        user: schema.dict({
-          username: schema.string(),
-          uid: schema.uid().convert(),
-          eldest: schema.dict({
-            seqno: schema.int(),
-            kid: schema.kid().convert()
-          }),
-          seq_tail: schema.dict({
-            seqno: schema.int(),
-            sig_id: schema.sig_id().convert(),
-            payload_hash: schema.hash().convert()
-          })
-        }),
-        confidence: schema.dict({
-          username_verified_via: schema.string_enum(["in_person", "proofs", "video", "audio", "other_chat", "familiar", "other"]).optional(),
-          proofs: schema.array(proof_schema).optional(),
-          other: schema.string({
-            max_length: 90
-          }).optional()
-        }),
-        vouch_text: schema.string({
-          max_length: 700
-        })
-      });
-      err = schm.check(obj);
-      return cb(err);
-    };
-
-    Vouch.prototype._v_customize_json = function(ret) {
-      var t, _ref1;
-      if ((t = (_ref1 = this.wot) != null ? _ref1.vouch : void 0) != null) {
-        return ret.body.wot_vouch = t;
-      }
-    };
-
-    return Vouch;
-
-  })(Base);
-
-  exports.React = React = (function(_super) {
-    __extends(React, _super);
-
-    function React(obj) {
-      this.wot = obj.wot;
-      React.__super__.constructor.call(this, obj);
-    }
-
-    React.prototype._v_stub_paths = function() {
-      return ["body.wot_react"];
-    };
-
-    React.prototype._type = function() {
-      return constants.sig_types.wot.react;
-    };
-
-    React.prototype._type_v2 = function(revoke_flag) {
-      return constants.sig_types_v2.wot.react;
-    };
-
-    React.prototype._v_check = function(_arg, cb) {
-      var json, obj, schm;
-      json = _arg.json;
-      obj = json.body.wot_react;
-      schm = schema.dict({
-        sig_id: schema.sig_id().convert(),
-        reaction: schema.string_enum(["accept", "reject"])
-      });
-      return cb(schm.check(obj));
-    };
-
-    React.prototype._v_customize_json = function(ret) {
-      var t;
-      if ((t = this.wot.react) != null) {
-        return ret.body.wot_react = t;
-      }
-    };
-
-    return React;
-
-  })(Base);
-
-}).call(this);

package/src/wot.iced

@@ -1,96 +0,0 @@
-{Base} = require './base'
-{constants} = require './constants'
-{make_esc} = require 'iced-error'
-pgp_utils = require('pgp-utils')
-{json_stringify_sorted,unix_time,streq_secure} = pgp_utils.util
-schema = require './schema3'
-
-#==========================================================================
-
-exports.Vouch = class Vouch extends Base
-
-  constructor : (obj) ->
-    @wot = obj.wot
-    super obj
-
-  _v_stub_paths : () -> [ "body.wot_vouch" ]
-  _type : () -> constants.sig_types.wot.vouch
-
-  _type_v2 : (revoke_flag) ->
-    if @revoke? or revoke_flag then constants.sig_types_v2.wot.vouch_with_revoke
-    else constants.sig_types_v2.wot.vouch
-
-  _v_check : ({json}, cb) ->
-    obj = json.body.wot_vouch
-    if not obj? then return cb null
-
-    proof_schema = schema.or([
-      schema.dict({
-        proof_type : schema.int(), # keybase1.ProofType
-        name : schema.string(),
-        username : schema.string()
-      }),
-      schema.dict({
-        proof_type : schema.int(),
-        protocol : schema.string(),
-        hostname : schema.string()
-      }),
-      schema.dict({
-        proof_type : schema.int(),
-        protocol : schema.string(),
-        domain : schema.string()
-      })
-    ])
-
-    schm = schema.dict({
-      user : schema.dict({
-        username : schema.string()
-        uid : schema.uid().convert()
-        eldest : schema.dict({
-          seqno : schema.int()
-          kid : schema.kid().convert()
-        })
-        seq_tail : schema.dict({
-         seqno : schema.int()
-         sig_id : schema.sig_id().convert()
-         payload_hash : schema.hash().convert()
-        })
-      })
-      confidence : schema.dict({
-        username_verified_via : schema.string_enum(["in_person", "proofs", "video", "audio", "other_chat", "familiar", "other"]).optional()
-        proofs: schema.array(proof_schema).optional()
-        other : schema.string({max_length: 90}).optional()
-      })
-      vouch_text : schema.string({max_length: 700})
-    })
-    err = schm.check(obj)
-    cb err
-
-   _v_customize_json : (ret) ->
-    ret.body.wot_vouch = t if (t = @wot?.vouch)?
-
-#==========================================================================
-
-exports.React = class React extends Base
-
-  constructor : (obj) ->
-    @wot = obj.wot
-    super obj
-
-  _v_stub_paths : () -> [ "body.wot_react" ]
-  _type : () -> constants.sig_types.wot.react
-
-  _type_v2 : (revoke_flag) -> constants.sig_types_v2.wot.react
-
-  _v_check : ({json}, cb) ->
-    obj = json.body.wot_react
-    schm = schema.dict({
-      sig_id : schema.sig_id().convert()
-      reaction : schema.string_enum(["accept", "reject"])
-    })
-    cb schm.check(obj)
-
-   _v_customize_json : (ret) ->
-    ret.body.wot_react = t if (t = @wot.react)?
-
-#==========================================================================