passwd-sso-cli 0.4.67 → 0.4.68

package/dist/commands/export.js

@@ -10,12 +10,7 @@ import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import { writeSecretFile } from "../lib/secure-file.js";
 import * as output from "../lib/output.js";
 import { CLI_API_PATH } from "../lib/api-paths.js";
-function escapeCSV(value) {
-    if (value.includes(",") || value.includes('"') || value.includes("\n")) {
-        return `"${value.replace(/"/g, '""')}"`;
-    }
-    return value;
-}
+import { escapeCsvCompat } from "../lib/csv-escape.js";
 export async function exportCommand(options) {
     const key = getEncryptionKey();
     if (!key) {
@@ -81,9 +76,9 @@ export async function exportCommand(options) {
             csvRows.push(headers.map((h) => {
                 const val = entry[h];
                 if (h === "totp" && val && typeof val === "object") {
-                    return escapeCSV(val.secret ?? "");
+                    return escapeCsvCompat(val.secret ?? "");
                 }
-                return escapeCSV(String(val ?? ""));
+                return escapeCsvCompat(String(val ?? ""));
             }).join(","));
         }
         const csvOut = csvRows.join("\n");

package/dist/lib/crypto.d.ts

@@ -13,9 +13,9 @@ export declare function hexEncode(buf: ArrayBuffer | Uint8Array): string;
 export declare function hexDecode(hex: string): Uint8Array;
 export declare function deriveWrappingKey(passphrase: string, accountSalt: Uint8Array): Promise<CryptoKey>;
 export declare function deriveEncryptionKey(secretKey: Uint8Array): Promise<CryptoKey>;
-export declare function deriveAuthKey(secretKey: Uint8Array): Promise<CryptoKey>;
+export declare function deriveAuthKeyBytes(secretKey: Uint8Array): Promise<Uint8Array>;
 export declare function unwrapSecretKey(encrypted: EncryptedData, wrappingKey: CryptoKey): Promise<Uint8Array>;
-export declare function computeAuthHash(authKey: CryptoKey): Promise<string>;
+export declare function computeAuthHash(authKeyBytes: Uint8Array): Promise<string>;
 export declare function verifyKey(encryptionKey: CryptoKey, artifact: EncryptedData): Promise<boolean>;
 export declare function encryptData(plaintext: string, key: CryptoKey, aad?: Uint8Array): Promise<EncryptedData>;
 export declare function decryptData(encrypted: EncryptedData, key: CryptoKey, aad?: Uint8Array): Promise<string>;

package/dist/lib/crypto.js

@@ -65,15 +65,18 @@ export async function deriveEncryptionKey(secretKey) {
         info: textEncode(HKDF_ENC_INFO),
     }, hkdfKey, { name: "AES-GCM", length: AES_KEY_LENGTH }, false, ["encrypt", "decrypt"]);
 }
-export async function deriveAuthKey(secretKey) {
-    const hkdfKey = await crypto.subtle.importKey("raw", toArrayBuffer(secretKey), "HKDF", false, ["deriveKey"]);
-    return crypto.subtle.deriveKey({
+// Uses deriveBits (not deriveKey) so no extractable CryptoKey is ever created.
+// Output bytes are identical to the previous exportKey("raw", <HMAC key>) form.
+export async function deriveAuthKeyBytes(secretKey) {
+    const hkdfKey = await crypto.subtle.importKey("raw", toArrayBuffer(secretKey), "HKDF", false, ["deriveBits"]);
+    const bits = await crypto.subtle.deriveBits({
         name: "HKDF",
         hash: "SHA-256",
         // See deriveEncryptionKey for zero-salt risk acceptance rationale
         salt: new ArrayBuffer(32),
         info: textEncode(HKDF_AUTH_INFO),
-    }, hkdfKey, { name: "HMAC", hash: "SHA-256", length: AES_KEY_LENGTH }, true, ["sign"]);
+    }, hkdfKey, AES_KEY_LENGTH);
+    return new Uint8Array(bits);
 }
 // ─── Secret Key Management ─────────────────────────────────────
 export async function unwrapSecretKey(encrypted, wrappingKey) {
@@ -87,9 +90,8 @@ export async function unwrapSecretKey(encrypted, wrappingKey) {
     return new Uint8Array(decrypted);
 }
 // ─── Auth Hash ────────────────────────────────────────────────
-export async function computeAuthHash(authKey) {
-    const rawKey = await crypto.subtle.exportKey("raw", authKey);
-    const hash = await crypto.subtle.digest("SHA-256", rawKey);
+export async function computeAuthHash(authKeyBytes) {
+    const hash = await crypto.subtle.digest("SHA-256", toArrayBuffer(authKeyBytes));
     return hexEncode(hash);
 }
 // ─── Verification ──────────────────────────────────────────────

package/dist/lib/csv-escape.d.ts

@@ -0,0 +1,13 @@
+/** Characters that make a spreadsheet interpret a cell as a formula. */
+export declare const CSV_FORMULA_TRIGGER_RE: RegExp;
+/**
+ * Escapes a value for a compatibility CSV format that only quote-wraps cells
+ * containing a delimiter/quote/newline (Bitwarden-compatible layout), while
+ * still neutralizing formula-injection.
+ *
+ * RS6 ordering: the `"` → `""` doubling is applied before the formula-prefix
+ * decision, and the prefix is added inside the quotes — a formula-triggering
+ * cell is always quote-wrapped so the leading `'` cannot be stripped by a bare
+ * unquoted value.
+ */
+export declare function escapeCsvCompat(value: string): string;

package/dist/lib/csv-escape.js

@@ -0,0 +1,41 @@
+// Shared CSV formula-injection (CSV injection) neutralization for the CLI.
+//
+// Mirrors src/lib/format/csv-escape.ts byte-for-byte behavior. The CLI is a
+// separate ESM package and cannot import the app module, so the trigger set
+// and escape logic are duplicated here; the parity test in
+// cli/src/__tests__/unit/csv-escape.test.ts pins them to the same cases as the
+// app twin so the two implementations cannot drift silently.
+//
+// A cell whose value begins with one of `= + - @ \t \r` is interpreted as a
+// formula by Excel / Google Sheets / LibreOffice when the exported file is
+// opened, enabling data exfiltration (HYPERLINK / WEBSERVICE) or command
+// execution (DDE). Prefixing such a cell with a single quote makes the
+// spreadsheet treat it as literal text.
+//
+// Leading whitespace (spaces, tabs, newlines) before the trigger char is also
+// caught (`\s*` prefix) — spreadsheets still evaluate `  =1+1` as a formula,
+// so a value with leading whitespace and a trigger char needs the same guard.
+/** Characters that make a spreadsheet interpret a cell as a formula. */
+export const CSV_FORMULA_TRIGGER_RE = /^\s*[=+\-@\t\r]/;
+/**
+ * Escapes a value for a compatibility CSV format that only quote-wraps cells
+ * containing a delimiter/quote/newline (Bitwarden-compatible layout), while
+ * still neutralizing formula-injection.
+ *
+ * RS6 ordering: the `"` → `""` doubling is applied before the formula-prefix
+ * decision, and the prefix is added inside the quotes — a formula-triggering
+ * cell is always quote-wrapped so the leading `'` cannot be stripped by a bare
+ * unquoted value.
+ */
+export function escapeCsvCompat(value) {
+    const needsQuote = value.includes(",") ||
+        value.includes('"') ||
+        value.includes("\n") ||
+        CSV_FORMULA_TRIGGER_RE.test(value);
+    if (!needsQuote)
+        return value;
+    const escaped = value.replace(/"/g, '""');
+    const prefixed = CSV_FORMULA_TRIGGER_RE.test(escaped) ? `'${escaped}` : escaped;
+    return `"${prefixed}"`;
+}
+//# sourceMappingURL=csv-escape.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passwd-sso-cli",
-  "version": "0.4.67",
+  "version": "0.4.68",
   "description": "CLI for passwd-sso password manager",
   "type": "module",
   "license": "MIT",