passbolt-browser-extension 3.0.6 → 4.6.2

package/src/all/background_page/service/secret/pownedService.js

@@ -0,0 +1,63 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.9.0
+ */
+
+import ExternalServiceUnavailableError from "../../error/externalServiceUnavailableError";
+import ExternalServiceError from '../../error/externalServiceError';
+import jsSHA from "jssha";
+
+class PownedPasswordService {
+  /**
+   * Check if password is present inside a dictionnary.
+   * @param {string} password The password to check.
+   * @returns {boolean}
+   * @throw {Error} If the setup url cannot be parsed.
+   * @throw {Error} If the domain is not valid.
+   */
+  static async checkIfPasswordIsPowned(password) {
+    const prefixLength = 5;
+    const apiUrl = 'https://api.pwnedpasswords.com/range/';
+    if (typeof password !== 'string') {
+      const err = new Error('Input password must be a string.');
+      return Promise.reject(err);
+    }
+
+    const shaObj = new jsSHA('SHA-1', 'TEXT');
+    shaObj.update(password);
+    const hashedPassword = shaObj.getHash('HEX');
+    const hashedPasswordPrefix = hashedPassword.substr(0, prefixLength);
+    const hashedPasswordSuffix = hashedPassword.substr(prefixLength);
+    const url = apiUrl + hashedPasswordPrefix;
+
+    let response;
+    try {
+      response = await fetch(url);
+    } catch (e) {
+      throw new ExternalServiceUnavailableError("pwnedpasswords API service is not available");
+    }
+
+    if (response.status !== 200) {
+      throw new ExternalServiceError(`Failed to request pwnedpasswords API: ${response.status}`);
+    }
+    const data = await response.text();
+
+    return data
+      .split('\n')
+      .map(line => line.split(':'))
+      .filter(filtered => filtered[0].toLowerCase() === hashedPasswordSuffix)
+      .map(mapped => Number(mapped[1]))
+      .shift() || 0;
+  }
+}
+
+export default PownedPasswordService;

package/src/all/background_page/service/secret/pownedService.test.js

@@ -0,0 +1,77 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2022 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         3.9.0
+ */
+
+import PownedPasswordService from "./pownedService";
+import ExternalServiceUnavailableError from '../../error/externalServiceUnavailableError';
+import ExternalServiceError from '../../error/externalServiceError';
+
+describe('PownedPasswordService', () => {
+  describe('checkIfPasswordIsPowned', () => {
+    it('should return a rejected promise if the input password is not a string', async() => {
+      expect.assertions(1);
+      try {
+        await PownedPasswordService.checkIfPasswordIsPowned(123);
+      } catch (error) {
+        expect(error.message).toEqual('Input password must be a string.');
+      }
+    });
+
+    it('should return a rejected promise if the pwnedpasswords API is unavailable', async() => {
+      expect.assertions(1);
+      try {
+        // Mock the fetch function to throw an error
+        jest.spyOn(global, 'fetch').mockImplementation(() => {
+          throw new Error();
+        });
+        await PownedPasswordService.checkIfPasswordIsPowned('password');
+      } catch (error) {
+        expect(error).toBeInstanceOf(ExternalServiceUnavailableError);
+      }
+    });
+
+    it('should return a rejected promise if the pwnedpasswords API returns a non-200 status code', async() => {
+      expect.assertions(1);
+      // Mock the fetch function to return a response with a non-200 status code
+      jest.spyOn(global, 'fetch').mockImplementation(() => ({
+        status: 500,
+        text: () => Promise.resolve('')
+      }));
+      try {
+        await PownedPasswordService.checkIfPasswordIsPowned('password');
+      } catch (error) {
+        expect(error).toBeInstanceOf(ExternalServiceError);
+      }
+    });
+
+    it('should return the number of times the password has been pwned if it is present in the pwnedpasswords API', async() => {
+      // Mock the fetch function to return a response with a 200 status code and a pwned password
+      jest.spyOn(global, 'fetch').mockImplementation(() => ({
+        status: 200,
+        text: () => Promise.resolve('suffix:count')
+      }));
+      const count = await PownedPasswordService.checkIfPasswordIsPowned('password');
+      expect(count).toEqual(count);
+    });
+
+    it('should return 0 if the password is not present in the pwnedpasswords API', async() => {
+      // Mock the fetch function to return a response with a 200 status code and no pwned password
+      jest.spyOn(global, 'fetch').mockImplementation(() => ({
+        status: 200,
+        text: () => Promise.resolve('')
+      }));
+      const count = await PownedPasswordService.checkIfPasswordIsPowned('password');
+      expect(count).toEqual(0);
+    });
+  });
+});

package/src/all/background_page/service/sessionStorage/userMeSessionStorageService.js

@@ -0,0 +1,94 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         4.1.0
+ */
+
+import UserEntity from "../../model/entity/user/userEntity";
+
+const USER_ME_STORAGE_KEY_PREFIX = "user-me";
+
+/**
+ * A cache service used to store the result of the requests made on the users me entry point.
+ */
+class UserMeSessionStorageService {
+  /**
+   * Get the storage key.
+   * @param {AbstractAccountEntity} account The account to get the key for.
+   * @returns {string}
+   * @throws {Error} If it cannot retrieve account id.
+   */
+  static getStorageKey(account) {
+    if (!account.id) {
+      throw new Error('Cannot retrieve account id, necessary to get a users me storage key.');
+    }
+    return `${USER_ME_STORAGE_KEY_PREFIX}-${account.id}`;
+  }
+
+  /**
+   * Get a user me cached data for a given account.
+   * @param {AbstractAccountEntity} account The account to get the cached data for.
+   * @returns {Promise<UserEntity|null>} Return the user me cached entity or null if the cache was not initialized.
+   * Note that in case the cache would be invalid, it would return null as well.
+   * @throws {Error} If it cannot get the storage key.
+   */
+  static async get(account) {
+    const storageKey = this.getStorageKey(account);
+    let storageData;
+
+    try {
+      storageData = await browser.storage.session.get(storageKey);
+    } catch (error) {
+      throw new Error('Unable to access the user me session storage', {cause: error});
+    }
+
+    const userMeDto = storageData?.[storageKey];
+
+    if (userMeDto) {
+      try {
+        return new UserEntity(userMeDto);
+      } catch (error) {
+        console.debug('Unable to instantiate the user entity based on the cached user dto.', error);
+      }
+    }
+
+    return null;
+  }
+
+  /**
+   * Cache a user me data for a given account.
+   * @param {AbstractAccountEntity} account The account to get the cached data for.
+   * @param {UserEntity} user The user me to cache
+   * @returns {Promise<void>}
+   */
+  static async set(account, user) {
+    const storageKey = this.getStorageKey(account);
+
+    await navigator.locks.request(storageKey, async() => {
+      await browser.storage.session.set({[storageKey]: user.toDto(UserEntity.ALL_CONTAIN_OPTIONS)});
+    });
+  }
+
+  /**
+   * Remove the cached data for a given account.
+   * @param {AbstractAccountEntity} account The account to get the cached data for.
+   * @returns {Promise<void>}
+   */
+  static async remove(account) {
+    const storageKey = this.getStorageKey(account);
+
+    await navigator.locks.request(storageKey, async() => {
+      await browser.storage.session.remove(storageKey);
+    });
+  }
+}
+
+export default UserMeSessionStorageService;

package/src/all/background_page/service/sessionStorage/userMeSessionStorageService.test.js

@@ -0,0 +1,146 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         4.1.0
+ */
+
+import UserMeSessionStorageService from "./userMeSessionStorageService";
+import AccountEntity from "../../model/entity/account/accountEntity";
+import {defaultAccountDto} from "../../model/entity/account/accountEntity.test.data";
+import {defaultUserDto} from "passbolt-styleguide/src/shared/models/entity/user/userEntity.test.data";
+import UserEntity from "../../model/entity/user/userEntity";
+import ProfileEntity from "../../model/entity/profile/profileEntity";
+
+describe("UserMeSessionStorageService", () => {
+  beforeEach(async() => {
+    await browser.storage.session.clear();
+  });
+
+  describe("UserMeSessionStorageService::get", () => {
+    it('should return null if there is no data in the storage', async() => {
+      expect.assertions(1);
+      const account = new AccountEntity(defaultAccountDto());
+      const cachedUser = await UserMeSessionStorageService.get(account);
+      expect(cachedUser).toBeNull();
+    });
+
+    it('should return the user in cache associated to the passed account if one in cache', async() => {
+      expect.assertions(4);
+      const account = new AccountEntity(defaultAccountDto());
+      const user = new UserEntity(defaultUserDto());
+      await UserMeSessionStorageService.set(account, user);
+
+      const cachedUser = await UserMeSessionStorageService.get(account);
+      expect(cachedUser).not.toBeNull();
+      expect(cachedUser).toBeInstanceOf(UserEntity);
+      expect(cachedUser.id).toEqual(user.id);
+      expect(cachedUser.profile).toBeInstanceOf(ProfileEntity);
+    });
+
+    it('should return null if trying to access the cache of another account', async() => {
+      expect.assertions(1);
+      const otherAccount = new AccountEntity(defaultAccountDto());
+
+      const account = new AccountEntity(defaultAccountDto());
+      const user = new UserEntity(defaultUserDto());
+      await UserMeSessionStorageService.set(account, user);
+
+      const cachedUserOtherAccount = await UserMeSessionStorageService.get(otherAccount);
+      expect(cachedUserOtherAccount).toBeNull();
+    });
+
+    it('should return the cached user for the given account even if there are other cached users for other accounts', async() => {
+      expect.assertions(2);
+      const otherAccount = new AccountEntity(defaultAccountDto());
+      const userOtherAccount = new UserEntity(defaultUserDto());
+      await UserMeSessionStorageService.set(otherAccount, userOtherAccount);
+
+      const account = new AccountEntity(defaultAccountDto());
+      const user = new UserEntity(defaultUserDto());
+      await UserMeSessionStorageService.set(account, user);
+
+      const cachedUser = await UserMeSessionStorageService.get(account);
+      expect(cachedUser).not.toBeNull();
+      expect(cachedUser.id).toEqual(user.id);
+    });
+  });
+
+  describe("UserMeSessionStorageService::set", () => {
+    it('should override an existing cached user if one already present', async() => {
+      expect.assertions(3);
+
+      const account = new AccountEntity(defaultAccountDto());
+      const user = new UserEntity(defaultUserDto());
+      await UserMeSessionStorageService.set(account, user);
+      await UserMeSessionStorageService.set(account, user);
+
+      expect(Object.keys(await browser.storage.session.get()).length).toEqual(1);
+      const cachedUser = await UserMeSessionStorageService.get(account);
+      expect(cachedUser).not.toBeNull();
+      expect(cachedUser.id).toEqual(user.id);
+    });
+  });
+
+  describe("UserMeSessionStorageService::remove", () => {
+    it('should not crash if nothing to remove', async() => {
+      expect.assertions(1);
+
+      const account = new AccountEntity(defaultAccountDto());
+      await UserMeSessionStorageService.remove(account);
+      expect(true).toBeTruthy();
+    });
+
+    it('should remove a cached user', async() => {
+      expect.assertions(1);
+
+      const account = new AccountEntity(defaultAccountDto());
+      const user = new UserEntity(defaultUserDto());
+      await UserMeSessionStorageService.set(account, user);
+
+      await UserMeSessionStorageService.remove(account);
+
+      expect(Object.keys(await browser.storage.session.get()).length).toEqual(0);
+    });
+
+    it('should not remove another cached user if there is none for the given account', async() => {
+      expect.assertions(1);
+
+      const otherAccount = new AccountEntity(defaultAccountDto());
+      const userOtherAccount = new UserEntity(defaultUserDto());
+      await UserMeSessionStorageService.set(otherAccount, userOtherAccount);
+
+      const account = new AccountEntity(defaultAccountDto());
+
+      await UserMeSessionStorageService.remove(account);
+
+      expect(Object.keys(await browser.storage.session.get()).length).toEqual(1);
+    });
+
+    it('should not remove another cached user if there is a cached user for the given account', async() => {
+      expect.assertions(3);
+
+      const otherAccount = new AccountEntity(defaultAccountDto());
+      const userOtherAccount = new UserEntity(defaultUserDto());
+      await UserMeSessionStorageService.set(otherAccount, userOtherAccount);
+
+      const account = new AccountEntity(defaultAccountDto());
+      const user = new UserEntity(defaultUserDto());
+      await UserMeSessionStorageService.set(account, user);
+
+      await UserMeSessionStorageService.remove(account);
+
+      expect(Object.keys(await browser.storage.session.get()).length).toEqual(1);
+      const cachedUserOtherAccount = await UserMeSessionStorageService.get(otherAccount);
+      expect(cachedUserOtherAccount).not.toBeNull();
+      expect(cachedUserOtherAccount.id).toEqual(userOtherAccount.id);
+    });
+  });
+});

package/src/all/background_page/service/sessionStorage/workersSessionStorage.js

@@ -0,0 +1,205 @@
+/**
+ * Passbolt ~ Open source password manager for teams
+ * Copyright (c) 2023 Passbolt SA (https://www.passbolt.com)
+ *
+ * Licensed under GNU Affero General Public License version 3 of the or any later version.
+ * For full copyright and license information, please see the LICENSE.txt
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) 2023 Passbolt SA (https://www.passbolt.com)
+ * @license       https://opensource.org/licenses/AGPL-3.0 AGPL License
+ * @link          https://www.passbolt.com Passbolt(tm)
+ * @since         4.0.0
+ */
+import Lock from "../../utils/lock";
+import WorkerEntity from "../../model/entity/worker/workerEntity";
+import Validator from "validator";
+const lock = new Lock();
+
+const WORKERS_STORAGE_KEY = 'workers';
+const LIMIT_WORKERS_BY_TAB = 100;
+
+class WorkersSessionStorage {
+  /**
+   * Set the workers session storage.
+   *
+   * @throws {Error} if operation failed
+   * @return {Promise<array>} results object, containing every object in keys that was found in the storage area.
+   * If storage is not set, undefined will be returned.
+   */
+  async getWorkers() {
+    const {workers} = await browser.storage.session.get(WORKERS_STORAGE_KEY);
+    return workers || [];
+  }
+
+  /**
+   * Get a worker from the session storage by id
+   *
+   * @param {string} id The worker id
+   * @return {Promise<object>} worker dto object
+   */
+  getWorkerById(id) {
+    if (!Validator.isUUID(id)) {
+      throw new TypeError("The worker id should be a valid uuid.");
+    }
+    const findById = workers => workers.find(worker => worker.id === id);
+    return this.getWorkers().then(findById);
+  }
+
+  /**
+   * Get workers from the session storage by tab id
+   *
+   * @param {number} tabId The tab id
+   * @return {Promise<object>} worker dto object
+   */
+  getWorkersByTabId(tabId) {
+    const filterByTabId = workers => workers.filter(worker => worker.tabId === tabId);
+    return this.getWorkers().then(filterByTabId);
+  }
+
+  /**
+   * Get workers from the session storage by name and tab id
+   *
+   * @param {string} name The name
+   * @param {number} tabId The tab id
+   * @return {object} worker dto object
+   */
+  getWorkersByNameAndTabId(name, tabId) {
+    const filterByNameAndTabId = workers => workers.filter(worker => worker.name === name && worker.tabId === tabId);
+    return this.getWorkers().then(filterByNameAndTabId);
+  }
+
+  /**
+   * Get worker from the main frame
+   * @param tabId
+   * @return {Promise<object>}
+   */
+  async getWorkerOnMainFrame(tabId) {
+    const workers = await this.getWorkersByTabId(tabId);
+    return workers.find(worker => worker.frameId === 0);
+  }
+
+
+  /**
+   * Add a worker in the session storage
+   * @param {WorkerEntity} workerEntity
+   * @return {Promise<void>}
+   */
+  async addWorker(workerEntity) {
+    await lock.acquire();
+    try {
+      this.assertEntityBeforeSave(workerEntity);
+      const workers = await this.getWorkers();
+      if (!this.IsExceedNumberWorkersByTabId(workers, workerEntity.tabId)) {
+        workers.push(workerEntity.toDto());
+        await browser.storage.session.set({workers});
+      } else {
+        throw new Error(`The extension port limit is exceeded on tab ${workerEntity.tabId}`);
+      }
+    } finally {
+      lock.release();
+    }
+  }
+
+  /**
+   *
+   * @param {Object<array>} workers The workers
+   * @param {number} tabId The tab id
+   * @param {number} limit The limit
+   * @constructor
+   */
+  IsExceedNumberWorkersByTabId(workers, tabId, limit = LIMIT_WORKERS_BY_TAB) {
+    return workers.filter(worker => worker.tabId === tabId).length >= limit;
+  }
+
+  /**
+   * Update a worker in the session storage.
+   * @param {WorkerEntity} workerEntity The worker to update
+   * @throws {Error} if the worker does not exist in the local storage
+   * @return {Promise<void>}
+   */
+  async updateWorker(workerEntity) {
+    await lock.acquire();
+    try {
+      this.assertEntityBeforeSave(workerEntity);
+      const workers = await this.getWorkers();
+      const workerIndex = workers.findIndex(item => item.id === workerEntity.id);
+      if (workerIndex === -1) {
+        throw new Error('The worker could not be found in the session storage');
+      }
+      workers[workerIndex] = workerEntity.toDto();
+      await browser.storage.session.set({workers});
+    } finally {
+      lock.release();
+    }
+  }
+
+  /**
+   * Delete workers in the session storage by tab id.
+   * @param {number} tabId The tab id
+   * @return {Promise<void>}
+   */
+  async deleteByTabId(tabId) {
+    await lock.acquire();
+    try {
+      const workers = await this.getWorkers();
+      const keepWorkerNotInTabId = worker => worker.tabId !== tabId;
+      const workersToKeep = workers.filter(keepWorkerNotInTabId);
+      await browser.storage.session.set({workers: workersToKeep});
+    } finally {
+      lock.release();
+    }
+  }
+
+  /**
+   * Delete workers in the session storage by port id.
+   * @param {string} id The worker id
+   * @return {Promise<void>}
+   */
+  async deleteById(id) {
+    if (!Validator.isUUID(id)) {
+      throw new TypeError("The worker id should be a valid uuid.");
+    }
+    await lock.acquire();
+    try {
+      const workers = await this.getWorkers();
+      const keepWorkerNotInTabId = worker => worker.id !== id;
+      const workersToKeep = workers.filter(keepWorkerNotInTabId);
+      await browser.storage.session.set({workers: workersToKeep});
+    } finally {
+      lock.release();
+    }
+  }
+
+  /**
+   * Flush the session storage.
+   * @return {Promise<void>}
+   */
+  async flush() {
+    const workers = [];
+    await lock.acquire();
+    try {
+      await browser.storage.session.set({workers});
+    } finally {
+      lock.release();
+    }
+  }
+
+  /**
+   * Make sure the entity meet some minimal requirements before being stored
+   *
+   * @param {WorkerEntity} workerEntity
+   * @throw {TypeError} if requirements are not met
+   * @private
+   */
+  assertEntityBeforeSave(workerEntity) {
+    if (!workerEntity) {
+      throw new TypeError('WorkerSessionStorage expects a WorkerEntity to be set');
+    }
+    if (!(workerEntity instanceof WorkerEntity)) {
+      throw new TypeError('WorkerSessionStorage expects an object of type WorkerEntity');
+    }
+  }
+}
+
+export default new WorkersSessionStorage();