passbolt-browser-extension 3.0.6 → 4.6.2

package/src/all/background_page/sdk/scriptExecution.js

@@ -5,120 +5,151 @@
  * @copyright (c) 2017 Passbolt SARL
  * @licence GNU Affero General Public License http://www.gnu.org/licenses/agpl-3.0.en.html
  */
+
 /**
- * ScriptExecution Constructor
- *
- * @param tabId int
- * @constructor
+ * Used to set the portname.
+ * This function is used as a replacement for the imported JS code string.
+ * With MV3 API, it's not possible anymore, we need an existing function to import.
+ * @param {string} portname
  */
-function ScriptExecution(tabId) {
-  this.tabId = tabId;
+function globalSetPortname(portname) {
+  window.portname = portname;
 }
 
 /**
- * Create a callback to injects JavaScript code into a page.
- * ref. https://developer.chrome.com/extensions/tabs#method-executeScript
- *
- * @param tabId
- * @param details
- * @param callback
- * @returns {Function}
+ * Used to create an object url.
+ * With MV3 API, it's not possible anymore to use the function createObjectURL.
+ * @param {string} dataUrl base64 url (Blob is not serializable a base64 url is needed)
+ * @return {string}
  */
-ScriptExecution.prototype.createScriptCallback = function(tabId, details, callback) {
-  return function () {
-      chrome.tabs.executeScript(tabId, details, callback);
-  };
-};
+function createObjectURL(dataUrl) {
+  const contentType = dataUrl.split(',')[0].split(':')[1].split(';')[0];
+  const b64Data = dataUrl.split(',')[1];
+  const sliceSize = 512;
+  // Base64 to BLOB (For security issue, avoid using fetch)
+  const byteCharacters = atob(b64Data);
+  const byteArrays = [];
 
-/**
- * Create a callback to injects CSS into a page
- * ref. https://developer.chrome.com/extensions/tabs#method-insertCSS
- *
- * @param tabId
- * @param details
- * @param callback
- * @returns {Function}
- */
-ScriptExecution.prototype.createCssCallback = function(tabId, details, callback) {
-  return function () {
-    chrome.tabs.insertCSS(tabId, details, callback);
-  };
-};
+  for (let offset = 0; offset < byteCharacters.length; offset += sliceSize) {
+    const slice = byteCharacters.slice(offset, offset + sliceSize);
+    const byteNumbers = new Array(slice.length);
 
-/**
- * Insert sequentially javascript code in the page
- *
- * @param fileArray array
- * @returns ScriptExecution object
- */
-ScriptExecution.prototype.injectScripts = function (fileArray) {
-  var callback = null;
-  var info = null;
+    for (let i = 0; i < slice.length; i++) {
+      byteNumbers[i] = slice.charCodeAt(i);
+    }
 
-  for (var i = fileArray.length - 1; i >= 0; --i) {
-    info = { file: fileArray[i], runAt: 'document_end' };
-    callback = this.createScriptCallback(this.tabId, info, callback);
+    const byteArray = new Uint8Array(byteNumbers);
+    byteArrays.push(byteArray);
   }
-  if (callback !== null) {
-    callback();
-  }
-};
+  const blob = new Blob(byteArrays, {type: contentType});
+  return self.URL.createObjectURL(blob);
+}
 
 /**
- * Insert javascript code in the page
- *
- * @param codeArray array
- * @returns ScriptExecution object
+ * Used to revoke an object url.
+ * With MV3 API, it's not possible anymore to use the function revokeObjectURL.
+ * @param {string} url The url to revoke
  */
-ScriptExecution.prototype.executeScript = function (codeArray) {
-  var callback = null;
-  var info = null;
+function revokeObjectURL(url) {
+  self.URL.revokeObjectURL(url);
+}
 
-  for (var i = codeArray.length - 1; i >= 0; --i) {
-    info = { code: codeArray[i], runAt: 'document_end' };
-    callback = this.createScriptCallback(this.tabId, info, callback);
+/**
+ * Utility class to insert JS, CSS into a tab.
+ */
+class ScriptExecution {
+  constructor(tabId, frameId = 0) {
+    this.tabId = tabId;
+    this.frameId = frameId;
   }
-  if (callback !== null) {
-    callback();
+
+  /**
+   * Insert javascript files in the page
+   * @param {Array<string>} fileArray
+   */
+  injectJs(fileArray) {
+    if (fileArray.length === 0) {
+      return;
+    }
+
+    browser.scripting.executeScript({
+      files: fileArray,
+      target: {
+        tabId: this.tabId,
+        frameIds: [this.frameId]
+      },
+      // Very important to isolated script and avoiding to share global variable between scripts
+      world: "ISOLATED"
+    });
   }
-};
 
-/**
- * Inject sequentially an array of css file in a page
- *
- * @param fileArray array
- * @returns ScriptExecution object
- */
-ScriptExecution.prototype.injectCss = function (fileArray) {
-  var callback = null;
-  var info = null;
+  /**
+   * Inject an array of css files in a page
+   * @param {Array<string>} fileArray
+   */
+  injectCss(fileArray) {
+    if (fileArray.length === 0) {
+      return;
+    }
 
-  for (var i = fileArray.length - 1; i >= 0; --i) {
-    info = { file: fileArray[i], runAt: 'document_end' };
-    callback = this.createCssCallback(this.tabId, info, callback);
+    browser.scripting.insertCSS({
+      files: fileArray,
+      target: {
+        tabId: this.tabId,
+        frameIds: [this.frameId]
+      }
+    });
   }
-  if (callback !== null) {
-    callback();
+
+  /**
+   * Injects the portname as a global variable.
+   * @param {string} portName
+   */
+  injectPortname(portName) {
+    browser.scripting.executeScript({
+      func: globalSetPortname,
+      args: [portName],
+      target: {
+        tabId: this.tabId,
+        frameIds: [this.frameId]
+      },
+      world: "ISOLATED"
+    });
   }
-};
 
-/**
- * Set a global variables in the content code environment
- * @param options as key value
- */
-ScriptExecution.prototype.setGlobals = function (options) {
-  var value, code;
-  for (var key in options) {
-    value = options[key];
-    code = 'var ' + key + '="';
-    if (typeof value === 'string') {
-      code += options[key];
-    } else {
-      throw Error('ScriptExecution.setGlobal unsupported type');
-    }
-    code += '";';
+  /**
+   * Injects the base64 object url and create object url with a Blob.
+   * @param {string} dataUrl The base64 url
+   * @returns {Promise<*>}
+   */
+  async injectBase64UrlToCreateObjectURL(dataUrl) {
+    const response = await browser.scripting.executeScript({
+      func: createObjectURL,
+      args: [dataUrl],
+      target: {
+        tabId: this.tabId,
+        frameIds: [this.frameId]
+      },
+      world: "ISOLATED"
+    });
+    return response[0]?.result;
   }
-  this.executeScript([code]);
-};
 
-exports.ScriptExecution = ScriptExecution;
+  /**
+   * Injects the url to revoke.
+   * @param {string} url The url to revoke
+   */
+  injectURLToRevoke(url) {
+    browser.scripting.executeScript({
+      func: revokeObjectURL,
+      args: [url],
+      target: {
+        tabId: this.tabId,
+        frameIds: [this.frameId]
+      },
+      world: "ISOLATED"
+    });
+  }
+}
+
+export default ScriptExecution;

package/src/all/background_page/sdk/scriptExecution.test.js

@@ -0,0 +1,143 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.9.0
+ */
+import ScriptExecution from "./scriptExecution";
+
+describe("ScriptExecution", () => {
+  describe("ScriptExecution::injectPortname", () => {
+    it("Should insert JS func", async() => {
+      expect.assertions(1);
+      const mockedScriptingJS = jest.spyOn(browser.scripting, "executeScript");
+      const scriptExecution = new ScriptExecution(1);
+      const portname = "portname";
+
+      const option = {
+        func: expect.anything(),
+        args: [portname],
+        target: {
+          tabId: 1,
+          frameIds: [0]
+        },
+        world: "ISOLATED"
+      };
+
+      scriptExecution.injectPortname(portname);
+
+      expect(mockedScriptingJS).toHaveBeenCalledWith(option);
+    });
+  });
+
+  describe("ScriptExecution::injectJs", () => {
+    it("Should insert JS files", async() => {
+      expect.assertions(1);
+      const mockedScriptingJS = jest.spyOn(browser.scripting, "executeScript");
+      const scriptExecution = new ScriptExecution(2);
+      const files = ["filename.js", "filename2.js"];
+
+      const option = {
+        files: files,
+        target: {
+          tabId: 2,
+          frameIds: [0]
+        },
+        world: "ISOLATED"
+      };
+
+      scriptExecution.injectJs(files);
+
+      expect(mockedScriptingJS).toHaveBeenCalledWith(option);
+    });
+  });
+
+  describe("ScriptExecution::injectCSS", () => {
+    it("Should insert CSS file", async() => {
+      expect.assertions(1);
+      const mockedScriptingCSS = jest.spyOn(browser.scripting, "insertCSS");
+      const scriptExecution = new ScriptExecution(3);
+      const files = ["filename.css", "filename2.css"];
+
+      const option = {
+        files: files,
+        target: {
+          tabId: 3,
+          frameIds: [0]
+        }
+      };
+
+      scriptExecution.injectCss(files);
+
+      expect(mockedScriptingCSS).toHaveBeenCalledWith(option);
+    });
+  });
+
+  describe("ScriptExecution::injectBase64UrlToCreateObjectURL", () => {
+    it("Should insert JS func", async() => {
+      expect.assertions(2);
+      const mockedScriptingJS = jest.spyOn(browser.scripting, "executeScript");
+      // data mocked
+      const dataUrl = "data:text/plain;base64,VGV4dA==";
+      self.URL.createObjectURL = jest.fn();
+      const option = {
+        func: expect.anything(),
+        args: [dataUrl],
+        target: {
+          tabId: 1,
+          frameIds: [0]
+        },
+        world: "ISOLATED"
+      };
+      const resultUrl = "blob:https://passbolt.dev/8a3e66b9-4646-4077-815a-5978936aa6d6";
+      // mock function
+      mockedScriptingJS.mockImplementationOnce(script => {
+        const url = script.func.apply(null, script.args);
+        return [{result: url}];
+      });
+      jest.spyOn(self.URL, "createObjectURL").mockImplementationOnce(() => resultUrl);
+      // process
+      const scriptExecution = new ScriptExecution(1);
+      const url = await scriptExecution.injectBase64UrlToCreateObjectURL(dataUrl);
+      // expectation
+      expect(mockedScriptingJS).toHaveBeenCalledWith(option);
+      expect(url).toStrictEqual(resultUrl);
+    });
+  });
+
+  describe("ScriptExecution::injectURLToRevoke", () => {
+    it("Should insert JS func", async() => {
+      expect.assertions(2);
+      const mockedScriptingJS = jest.spyOn(browser.scripting, "executeScript");
+      // data mocked
+      const url = "blob:https://passbolt.dev/8a3e66b9-4646-4077-815a-5978936aa6d6";
+      self.URL.revokeObjectURL = jest.fn();
+      const option = {
+        func: expect.anything(),
+        args: [url],
+        target: {
+          tabId: 1,
+          frameIds: [0]
+        },
+        world: "ISOLATED"
+      };
+      // mock function
+      mockedScriptingJS.mockImplementationOnce(async script => {
+        script.func.apply(null, script.args);
+      });
+      // process
+      const scriptExecution = new ScriptExecution(1);
+      scriptExecution.injectURLToRevoke(url);
+      // expectation
+      expect(mockedScriptingJS).toHaveBeenCalledWith(option);
+      expect(self.URL.revokeObjectURL).toHaveBeenCalledWith(url);
+    });
+  });
+});

package/src/all/background_page/sdk/storage.js

@@ -11,12 +11,14 @@ function LocalStorage() {
 }
 
 LocalStorage.prototype.init = function() {
-  var _this = this;
-  // Load the passbolt local storage.
-  // Data are serialized in the local storage.
-  return new Promise (function(resolve, reject) {
-    _this._storage.get('_passbolt_data', function(items) {
-      if( typeof chrome.runtime.lastError !== 'undefined' && chrome.runtime.lastError !== null) {
+  const _this = this;
+  /*
+   * Load the passbolt local storage.
+   * Data are serialized in the local storage.
+   */
+  return new Promise((resolve, reject) => {
+    _this._storage.get('_passbolt_data', items => {
+      if (typeof chrome.runtime.lastError !== 'undefined' && chrome.runtime.lastError !== null) {
         reject(chrome.runtime.lastError);
       } else {
         if (typeof items._passbolt_data !== 'undefined') {
@@ -32,9 +34,9 @@ LocalStorage.prototype.init = function() {
  * Save cached _data into chrome.storage
  * @private
  */
-LocalStorage.prototype._store = function () {
-  this._storage.set({'_passbolt_data': this._data}, function() {
-    if( typeof chrome.runtime.lastError !== 'undefined' && chrome.runtime.lastError !== null) {
+LocalStorage.prototype._store = function() {
+  this._storage.set({'_passbolt_data': this._data}, () => {
+    if (typeof chrome.runtime.lastError !== 'undefined' && chrome.runtime.lastError !== null) {
       console.error(chrome.runtime.lastError.message);
     }
   });
@@ -47,8 +49,8 @@ LocalStorage.prototype._store = function () {
  * @param key string
  * @returns {*} or null
  */
-LocalStorage.prototype.getItem = function (key) {
-  var item = this._data[key];
+LocalStorage.prototype.getItem = function(key) {
+  const item = this._data[key];
   if (typeof item === 'undefined') {
     return null;
   }
@@ -60,7 +62,7 @@ LocalStorage.prototype.getItem = function (key) {
  * @param key
  * @param value
  */
-LocalStorage.prototype.setItem = function (key, value) {
+LocalStorage.prototype.setItem = function(key, value) {
   this._data[key] = value;
   this._store();
 };
@@ -69,7 +71,7 @@ LocalStorage.prototype.setItem = function (key, value) {
  * Remove an item
  * @param keyStr
  */
-LocalStorage.prototype.removeItem = function (key, subkey) {
+LocalStorage.prototype.removeItem = function(key, subkey) {
   if (typeof subkey === 'undefined') {
     delete this._data[key];
   } else {
@@ -78,6 +80,4 @@ LocalStorage.prototype.removeItem = function (key, subkey) {
   this._store();
 };
 
-exports.LocalStorage = LocalStorage;
-var storage = new LocalStorage();
-exports.storage = storage;
+export default new LocalStorage();

package/src/all/background_page/service/account/buildApiClientOptionsService.js

@@ -0,0 +1,37 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+import {ApiClientOptions} from "passbolt-styleguide/src/shared/lib/apiClient/apiClientOptions";
+
+class BuildApiClientOptionsService {
+  /**
+   * Build Api client options based on an account.
+   * @param {AbstractAccountEntity} account The account to build the api client options based on
+   * @returns {Promise<ApiClientOptions>}
+   */
+  static async buildFromAccount(account) {
+    return this.buildFromDomain(account.domain);
+  }
+
+  /**
+   * Build Api client options based on a domain.
+   * @param {string} domain The domain to build the api client options based on.
+   * @returns {Promise<ApiClientOptions>}
+   */
+  static async buildFromDomain(domain) {
+    return new ApiClientOptions()
+      .setBaseUrl(domain);
+  }
+}
+
+export default BuildApiClientOptionsService;

package/src/all/background_page/service/account/buildApiClientOptionsService.test.js

@@ -0,0 +1,83 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+
+import AccountEntity from "../../model/entity/account/accountEntity";
+import {adminAccountDto} from "../../model/entity/account/accountEntity.test.data";
+import BuildApiClientOptionsService from "./buildApiClientOptionsService";
+
+describe("BuildAccountApiClientOptionsService", () => {
+  it("BuildAccountApiClientOptionsService:buildFromAccount", async() => {
+    expect.assertions(3);
+    // data
+    const csrfToken = "csrf-token";
+    const account = new AccountEntity(adminAccountDto());
+    // mocked function
+    jest.spyOn(browser.cookies, "get").mockImplementationOnce(() => ({value: csrfToken}));
+    // execution
+    const apiClientOptions = await BuildApiClientOptionsService.buildFromAccount(account);
+    const headers = await apiClientOptions.getHeaders();
+    // expectations
+    expect(apiClientOptions.baseUrl).toStrictEqual(new URL(account.domain));
+    expect(headers).toStrictEqual({"X-CSRF-Token": csrfToken});
+    expect(browser.cookies.get).toHaveBeenCalledWith({name: "csrfToken", url: `${account.domain}/`});
+  });
+
+  it("BuildAccountApiClientOptionsService:buildFromDomain with no subdomain", async() => {
+    expect.assertions(3);
+    // data
+    const csrfToken = "csrf-token";
+    const domain = "https://passbolt.local";
+    // mocked function
+    jest.spyOn(browser.cookies, "get").mockImplementationOnce(() => ({value: csrfToken}));
+    // execution
+    const apiClientOptions = await BuildApiClientOptionsService.buildFromDomain(domain);
+    const headers = await apiClientOptions.getHeaders();
+    // expectations
+    expect(apiClientOptions.baseUrl).toStrictEqual(new URL(domain));
+    expect(headers).toStrictEqual({"X-CSRF-Token": csrfToken});
+    expect(browser.cookies.get).toHaveBeenCalledWith({name: "csrfToken", url: `${domain}/`});
+  });
+
+  it("BuildAccountApiClientOptionsService:buildFromDomain with slash at the end of a trusted domain", async() => {
+    expect.assertions(3);
+    // data
+    const csrfToken = "csrf-token";
+    const domain = "https://passbolt.local/";
+    // mocked function
+    jest.spyOn(browser.cookies, "get").mockImplementationOnce(() => ({value: csrfToken}));
+    // execution
+    const apiClientOptions = await BuildApiClientOptionsService.buildFromDomain(domain);
+    const headers = await apiClientOptions.getHeaders();
+    // expectations
+    expect(apiClientOptions.baseUrl).toStrictEqual(new URL(domain));
+    expect(headers).toStrictEqual({"X-CSRF-Token": csrfToken});
+    expect(browser.cookies.get).toHaveBeenCalledWith({name: "csrfToken", url: domain});
+  });
+
+  it("BuildAccountApiClientOptionsService:buildFromDomain with subdomain", async() => {
+    expect.assertions(3);
+    // data
+    const csrfToken = "csrf-token";
+    const domain = "https://passbolt.local/test";
+    // mocked function
+    jest.spyOn(browser.cookies, "get").mockImplementationOnce(() => ({value: csrfToken}));
+    // execution
+    const apiClientOptions = await BuildApiClientOptionsService.buildFromDomain(domain);
+    const headers = await apiClientOptions.getHeaders();
+    // expectations
+    expect(apiClientOptions.baseUrl).toStrictEqual(new URL(domain));
+    expect(headers).toStrictEqual({"X-CSRF-Token": csrfToken});
+    expect(browser.cookies.get).toHaveBeenCalledWith({name: "csrfToken", url: `${domain}/`});
+  });
+});

package/src/all/background_page/service/account/getDecryptedUserPrivateKeyService.js

@@ -0,0 +1,38 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+
+import {OpenpgpAssertion} from "../../utils/openpgp/openpgpAssertions";
+import Keyring from "../../model/keyring";
+import DecryptPrivateKeyService from "../crypto/decryptPrivateKeyService";
+
+
+class GetDecryptedUserPrivateKeyService {
+  /**
+   * Get current user's private key and decrypts it.
+   *
+   * @param {string} passphrase The user's private key passphrase to decrypt to key.
+   * @returns {Promise<openpgp.PrivateKey>}
+   */
+  static async getKey(passphrase) {
+    const keyring = new Keyring();
+    const userPrivateArmoredKey = keyring.findPrivate()?.armoredKey;
+    if (!userPrivateArmoredKey) {
+      throw new Error("Can't find current user's private key.");
+    }
+    const key = await OpenpgpAssertion.readKeyOrFail(userPrivateArmoredKey);
+    return DecryptPrivateKeyService.decrypt(key, passphrase);
+  }
+}
+
+export default GetDecryptedUserPrivateKeyService;

package/src/all/background_page/service/account/getDecryptedUserPrivateKeyService.test.js

@@ -0,0 +1,44 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.6.0
+ */
+import GetDecryptedUserPrivateKeyService from "./getDecryptedUserPrivateKeyService";
+import ExternalGpgKeyEntity from "../../model/entity/gpgkey/external/externalGpgKeyEntity";
+import {pgpKeys} from "../../../../../test/fixtures/pgpKeys/keys";
+import Keyring from "../../model/keyring";
+
+const mockedFindPrivate = jest.spyOn(Keyring.prototype, "findPrivate");
+
+describe("GetDecryptedUserPrivateKey service", () => {
+  const key = pgpKeys.ada;
+
+  it("should return the current users' private key decrypted", async() => {
+    expect.assertions(3);
+    mockedFindPrivate.mockImplementation(() => new ExternalGpgKeyEntity({armored_key: key.private}));
+
+    const decryptedKey = await GetDecryptedUserPrivateKeyService.getKey(key.passphrase);
+    expect(decryptedKey.isPrivate()).toBe(true);
+    expect(decryptedKey.isDecrypted()).toBe(true);
+    expect(decryptedKey.getFingerprint().toUpperCase()).toBe(key.fingerprint);
+  }, 10 * 1000);
+
+  it("should throw an Error if the private key can't be find", async() => {
+    expect.assertions(1);
+    mockedFindPrivate.mockImplementation(() => null);
+
+    try {
+      await GetDecryptedUserPrivateKeyService.getKey(key.passphrase);
+    } catch (e) {
+      expect(e).toStrictEqual(new Error("Can't find current user's private key."));
+    }
+  });
+});