secrez 2.1.9 → 2.1.11-beta.0

package/README.md

@@ -370,6 +370,16 @@ Secrez is not intended to compete with password managers, so do not expect it to
 
 ## History
 
+**2.1.11-beta.0**
+
+- fix warning "(node:70960) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities" caused by the Git checker
+
+**2.1.10**
+
+- add external git change detection to block operations when repository state changes outside of Secrez (e.g., `git pull` in another terminal)
+- fix critical cache bug in git conflict detection that prevented external changes from being detected within 30 seconds
+- improve git conflict detection tests with comprehensive coverage for both git and non-git repositories
+
 **2.1.9**
 
 - add `<` parameter to reuse the last used path in commands (e.g., `totp <` will use the last path from previous command)
@@ -876,6 +886,66 @@ Thank you for any contributions! 😉
 ## Test coverage
 
 ```
+  162 passing (1m)
+  1 pending
+
+--------------------|---------|----------|---------|---------|--------------------------------------
+File                | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s                    
+--------------------|---------|----------|---------|---------|--------------------------------------
+All files           |   80.07 |    67.69 |   80.91 |   79.96 |                                      
+ src                |   57.62 |    53.75 |      55 |   58.11 |                                      
+  Command.js        |   74.66 |    74.13 |   78.57 |   75.67 | ...5-62,73,80,93,127,164-172,179-182 
+  PreCommand.js     |    8.82 |        0 |       0 |    8.82 | 6-97                                 
+  cliConfig.js      |     100 |      100 |     100 |     100 |                                      
+ src/commands       |   83.06 |    69.43 |   90.82 |   82.94 |                                      
+  Alias.js          |    88.6 |    78.68 |     100 |   88.46 | 101,112,139,169,173,180,190,213-214  
+  Bash.js           |      75 |        0 |   66.66 |      75 | 18-19                                
+  Cat.js            |   98.91 |    88.88 |     100 |   98.91 | 152                                  
+  Cd.js             |   96.42 |    86.66 |     100 |   96.42 | 44                                   
+  Conf.js           |    8.64 |        0 |      20 |    8.64 | 98-509                               
+  Contacts.js       |   86.06 |     75.6 |     100 |   85.95 | ...5,165,172,184,237,250,260,268-269 
+  Copy.js           |    91.2 |    71.92 |     100 |   91.11 | 115,166,183,205-210,225-226,253      
+  Ds.js             |   90.27 |     82.6 |     100 |   90.14 | 99,108-113,125,147-148               
+  Edit.js           |   12.94 |        0 |      40 |   12.94 | 88-222                               
+  Export.js         |   90.17 |    76.92 |     100 |   90.17 | ...3-198,209,227-231,236,248,257,260 
+  Find.js           |   93.58 |    86.66 |     100 |   93.42 | 101,164,200-203,209                  
+  Git.js            |   96.15 |       75 |     100 |   96.15 | 61                                   
+  Help.js           |     100 |       80 |     100 |     100 | 29                                   
+  Import.js         |   92.41 |    85.38 |     100 |   92.34 | ...7,387,393,441,457-458,466-473,500 
+  Lcat.js           |     100 |    85.71 |     100 |     100 | 54                                   
+  Lcd.js            |   95.65 |    81.81 |     100 |   95.65 | 50                                   
+  Lls.js            |   95.45 |    72.72 |     100 |   95.45 | 97                                   
+  Lpwd.js           |    92.3 |      100 |     100 |    92.3 | 36                                   
+  Ls.js             |   91.54 |    76.31 |     100 |   91.04 | 103,114-116,130,185                  
+  Mkdir.js          |   92.59 |       60 |     100 |   92.59 | 56-57                                
+  Mv.js             |   86.59 |    71.66 |     100 |   86.31 | 93-99,133,155-156,165,175-182        
+  Paste.js          |   84.61 |    70.83 |     100 |   84.61 | 72,78,81,89,113,130-131,139          
+  Pwd.js            |    92.3 |      100 |     100 |    92.3 | 33                                   
+  Quit.js           |      90 |       50 |     100 |      90 | 27                                   
+  Rm.js             |    90.9 |       76 |     100 |   90.74 | 63,125-126,136,144                   
+  Shell.js          |   88.23 |       60 |     100 |   88.23 | 38,55                                
+  Show.js           |   72.54 |    45.45 |   57.14 |      74 | ...8,100,106-114,117,123-126,132,145 
+  Ssh.js            |      25 |        0 |      40 |      25 | 72-120                               
+  Tag.js            |   96.26 |    91.37 |     100 |   96.22 | 122,171,204-205                      
+  Totp.js           |   92.23 |       75 |     100 |   92.23 | 189-190,230,240,282-287,301-302      
+  Touch.js          |   96.36 |    80.64 |     100 |   96.29 | 164,240                              
+  Use.js            |   91.66 |    86.95 |     100 |   91.66 | 68,83-84                             
+  Ver.js            |      90 |    66.66 |     100 |      90 | 25                                   
+  Whoami.js         |   83.33 |       60 |      80 |   83.33 | 27,35,48                             
+  index.js          |    87.5 |       50 |     100 |   86.95 | 15,22,31                             
+ src/prompts        |      75 |    33.33 |      50 |      75 |                                      
+  MainPromptMock.js |      75 |    33.33 |      50 |      75 | 29-35,44                             
+ src/utils          |   67.61 |     62.5 |   54.16 |   67.21 |                                      
+  AliasManager.js   |     100 |    91.66 |     100 |     100 | 47                                   
+  ContactManager.js |   73.33 |       60 |   85.71 |   73.33 | 12,34-36                             
+  Fido2Client.js    |    9.61 |        0 |       0 |    9.61 | 8-108                                
+  HelpProto.js      |   89.07 |     82.6 |     100 |   88.88 | 49,135-137,153-154,171-176,195       
+  Logger.js         |   63.63 |    56.25 |   36.84 |   62.79 | ...25,37-49,57,65-69,74,84,88,93,105 
+--------------------|---------|----------|---------|---------|--------------------------------------
+
+> secrez@2.1.11-beta.0 posttest /Users/francescosullo/Projects/Secrez/secrez/packages/secrez
+> nyc check-coverage --statements 65 --branches 50 --functions 65 --lines 65
+
 
 ```
 

package/coverage.report

@@ -1,5 +1,5 @@
 
-> secrez@2.1.9 test /Users/francescosullo/Projects/Secrez/secrez/packages/secrez
+> secrez@2.1.11-beta.0 test /Users/francescosullo/Projects/Secrez/secrez/packages/secrez
 > cross-env NODE_ENV=test nyc --reporter=lcov --reporter=text mocha test/*.test.js test/**/*.test.js test/**/**/*.js --exit
 
 
@@ -15,24 +15,19 @@
     #validate
       ✓ should validate the options
 
-  #Fido2Client
-    #configuration
-      ✓ should verify that all the scripts exist
-
   #Alias
     ✓ should return the help
     ✓ create aliases and lists them
-    - should chain two commands
     ✓ rename and delete aliases
     ✓ should throw if there are errors
 
   #Cat
     ✓ should return the help
     ✓ should show the content of a file
-    ✓ should show either one or all the versions of a file (1019ms)
+    ✓ should show either one or all the versions of a file (1017ms)
     ✓ should throw if entry is not a file or file does not exist
     ✓ should throw if trying to cat a binary file
-    ✓ should show the content of a Yaml file (1028ms)
+    ✓ should show the content of a Yaml file (1026ms)
 
   #Cd
     ✓ should return the help
@@ -51,6 +46,257 @@
 
   #Copy
     ✓ should return the help
-    ✓ should copy a file to the clipboard (406ms)
-    ✓ should copy a string to the clipboard (261ms)
- ELIFECYCLE  Test failed. See above for more details.
+    ✓ should copy a file to the clipboard (385ms)
+    ✓ should copy a string to the clipboard (250ms)
+    ✓ should copy a card to the clipboard (909ms)
+    ✓ should return an error if the file does not exist or is a folder (39ms)
+    ✓ should throw if copying to clipboard a binary files
+
+  #Ds
+    ✓ should return the help
+    ✓ should list all datasets
+    ✓ should create a new dataset
+    ✓ should rename a dataset
+    ✓ should delete a dataset
+
+  #Export
+    ✓ should return the help
+    ✓ should export a file to the current local folder
+    ✓ should export a file encrypted only for the user itself
+    ✓ should export a binary file to the current local folder
+    ✓ should export an encrypted file to the current local folder
+    ✓ should export a file and delete it after 1 second (1204ms)
+    ✓ should return an error if the file does not exist or is a folder
+    ✓ should export a keystore json file if a private_key exists in the entry (645ms)
+    ✓ should export a cryptoenv file if a private_key exists in the entry
+    ✓ should export a cryptoenv file with entire content when no private_key fields exist and user confirms
+    ✓ should throw error when no private_key fields exist and user declines
+    ✓ should throw error when no private_key fields exist and keystore option is used
+    ✓ should display encrypted content in console when using crypto-env with no-export
+
+  #Find
+    ✓ should return the help
+    ✓ should show find a string in the tree (1020ms)
+    ✓ should find no result without parameters
+    ✓ should skip binary files from search
+
+  #Git
+    ✓ should return the help
+    ✓ should show git status when --status is used (3120ms)
+    ✓ should show git status by default (3325ms)
+    ✓ should handle conflict risk scenario (5067ms)
+    ✓ should handle non-git repository
+    ✓ should allow normal operations in non-git repository
+Bye bye :o)
+    ✓ should detect external git changes and block operations (14550ms)
+
+  #Help
+    ✓ should return the help
+    ✓ #execAsync and format
+    ✓ should throw if wrong command
+    ✓ -- to complete coverage
+
+  #Import
+    ✓ should return the help
+    ✓ should import a file in the current folder
+    ✓ should import an encrypted file
+    ✓ should import an encrypted file encrypted for myself
+    ✓ should import an encrypted binary file and export it again verifying it is fine
+    ✓ should import files recursively
+    ✓ should read a folder and import the only text file
+    ✓ should read a folder and import text and binary files
+    ✓ should simulate the import of two files
+    ✓ should move the imported file
+    ✓ should import a backup from another software spanning the data among folders and files
+    ✓ should import a backup from another software but saving the tags as tags
+    ✓ should import a backup from another software using tags to prefix the paths
+    ✓ should import using tags to prefix the paths, ignoring the tags
+    ✓ should import from a LastPass-like csv setting the path from "grouping" and "name"
+    ✓ should import from a json
+    ✓ should throw importing a malformed backup
+    ✓ should throw importing a CSV indicating wrong fields to generate the path
+
+  #Lcat
+    ✓ should return the help
+    ✓ cat a file
+    ✓ return en error if trying to cat a binary file
+
+  #Lcd
+    ✓ should return the help
+    ✓ change to a folder
+    ✓ return en error if changing to a file
+
+  #Lls
+    ✓ should return the help
+    ✓ should list a folder
+    ✓ return en error if lls-ing a not existing path
+    ✓ return a message if no files are found
+
+  #Lpwd
+    ✓ should return the help
+    ✓ change to a folder
+
+  #Ls
+    ✓ should return the help
+    ✓ should return all the datasets
+    ✓ should list folders and files
+    ✓ should list folders and files using wildcards
+
+  #Mkdir
+    ✓ should return the help
+    ✓ should create a folder
+    ✓ should create a nested folder
+    ✓ should throw if trying to create a child of a file
+    ✓ should throw if wrong parameters
+
+  #Mv
+    ✓ should return the help
+    ✓ should rename a file (1010ms)
+    ✓ should move a file to another folder
+    ✓ should move many files to another folder
+    ✓ should move a file to another subfolder
+    ✓ should move and rename file to another folder
+    ✓ should move file to another folder using wildcards
+    ✓ should move file to another dataset using wildcards
+    ✓ should move file managing duplicates
+    ✓ should throw if parameters are missed or wrong
+    ✓ should move files from and to other datasets (1029ms)
+    ✓ should move the results of a find
+
+  #Paste
+    ✓ should return the help
+    ✓ should paste the clipboard content to a new file (39ms)
+    ✓ should paste the clipboard content to an existent file (55ms)
+    ✓ should paste a single field to a yml card
+
+  #Pwd
+    ✓ should return the help
+    ✓ should show the working folder
+
+  #Quit
+    ✓ should show the content of an external file via bash
+
+  #Rm
+    ✓ should return the help
+    ✓ should delete a file with one version
+    ✓ should delete many files usign wildcards
+    ✓ should return errors if wrong parameters
+    ✓ should delete some versions of a file (1011ms)
+
+  #Shell
+    ✓ should return the help
+    ✓ should show the content of an external file via shell
+
+  #Show
+    ✓ should return the help
+    ✓ should show the field password of a card
+
+  #Tag
+    ✓ should return the help
+    ✓ should tag a file
+    ✓ should remove a tag
+    ✓ should list all the tags
+    ✓ should show the file tagged as
+    ✓ should show very long file tagged as
+
+  #Totp
+    ✓ should return the help
+    ✓ should totp a file to the clipboard (380ms)
+    ✓ should read a totp secret from an image and add the totp field to the card
+    ✓ should read a totp secret from an image and return the secret
+    ✓ should throw if bad image
+    ✓ should throw if missing parameters
+    ✓ should throw if the yaml is malformed
+    ✓ should read a totp secret from the clipboard (73ms)
+
+  #Touch
+    ✓ should return the help
+    ✓ should create a file
+    ✓ should create a file with content
+    ✓ should duplicate a file
+    ✓ should throw if trying to duplicate a non existing file
+    ✓ should throw if trying to duplicate a folder
+    ✓ should throw if trying to create a child of a file
+    ✓ should throw if wrong parameters
+    ✓ should create a file and generate a wallet
+New file "/folder2/file1" created.
+    ✓ should generate 5 prefixed wallet (56ms)
+New file "/folder2/file1" created.
+    ✓ should generate a wallet with mnemonic and 2 keys
+
+  #Use
+    ✓ should return the help
+    ✓ should use a new dataset, creating it if does not exist
+
+  #Ver
+    ✓ should show the current version
+
+  #Whoami
+    ✓ should return the help
+    ✓ should see who am I
+
+  #Fido2Client
+    #configuration
+      - should verify that all the scripts exist
+
+
+  162 passing (1m)
+  1 pending
+
+--------------------|---------|----------|---------|---------|--------------------------------------
+File                | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s                    
+--------------------|---------|----------|---------|---------|--------------------------------------
+All files           |   80.07 |    67.69 |   80.91 |   79.96 |                                      
+ src                |   57.62 |    53.75 |      55 |   58.11 |                                      
+  Command.js        |   74.66 |    74.13 |   78.57 |   75.67 | ...5-62,73,80,93,127,164-172,179-182 
+  PreCommand.js     |    8.82 |        0 |       0 |    8.82 | 6-97                                 
+  cliConfig.js      |     100 |      100 |     100 |     100 |                                      
+ src/commands       |   83.06 |    69.43 |   90.82 |   82.94 |                                      
+  Alias.js          |    88.6 |    78.68 |     100 |   88.46 | 101,112,139,169,173,180,190,213-214  
+  Bash.js           |      75 |        0 |   66.66 |      75 | 18-19                                
+  Cat.js            |   98.91 |    88.88 |     100 |   98.91 | 152                                  
+  Cd.js             |   96.42 |    86.66 |     100 |   96.42 | 44                                   
+  Conf.js           |    8.64 |        0 |      20 |    8.64 | 98-509                               
+  Contacts.js       |   86.06 |     75.6 |     100 |   85.95 | ...5,165,172,184,237,250,260,268-269 
+  Copy.js           |    91.2 |    71.92 |     100 |   91.11 | 115,166,183,205-210,225-226,253      
+  Ds.js             |   90.27 |     82.6 |     100 |   90.14 | 99,108-113,125,147-148               
+  Edit.js           |   12.94 |        0 |      40 |   12.94 | 88-222                               
+  Export.js         |   90.17 |    76.92 |     100 |   90.17 | ...3-198,209,227-231,236,248,257,260 
+  Find.js           |   93.58 |    86.66 |     100 |   93.42 | 101,164,200-203,209                  
+  Git.js            |   96.15 |       75 |     100 |   96.15 | 61                                   
+  Help.js           |     100 |       80 |     100 |     100 | 29                                   
+  Import.js         |   92.41 |    85.38 |     100 |   92.34 | ...7,387,393,441,457-458,466-473,500 
+  Lcat.js           |     100 |    85.71 |     100 |     100 | 54                                   
+  Lcd.js            |   95.65 |    81.81 |     100 |   95.65 | 50                                   
+  Lls.js            |   95.45 |    72.72 |     100 |   95.45 | 97                                   
+  Lpwd.js           |    92.3 |      100 |     100 |    92.3 | 36                                   
+  Ls.js             |   91.54 |    76.31 |     100 |   91.04 | 103,114-116,130,185                  
+  Mkdir.js          |   92.59 |       60 |     100 |   92.59 | 56-57                                
+  Mv.js             |   86.59 |    71.66 |     100 |   86.31 | 93-99,133,155-156,165,175-182        
+  Paste.js          |   84.61 |    70.83 |     100 |   84.61 | 72,78,81,89,113,130-131,139          
+  Pwd.js            |    92.3 |      100 |     100 |    92.3 | 33                                   
+  Quit.js           |      90 |       50 |     100 |      90 | 27                                   
+  Rm.js             |    90.9 |       76 |     100 |   90.74 | 63,125-126,136,144                   
+  Shell.js          |   88.23 |       60 |     100 |   88.23 | 38,55                                
+  Show.js           |   72.54 |    45.45 |   57.14 |      74 | ...8,100,106-114,117,123-126,132,145 
+  Ssh.js            |      25 |        0 |      40 |      25 | 72-120                               
+  Tag.js            |   96.26 |    91.37 |     100 |   96.22 | 122,171,204-205                      
+  Totp.js           |   92.23 |       75 |     100 |   92.23 | 189-190,230,240,282-287,301-302      
+  Touch.js          |   96.36 |    80.64 |     100 |   96.29 | 164,240                              
+  Use.js            |   91.66 |    86.95 |     100 |   91.66 | 68,83-84                             
+  Ver.js            |      90 |    66.66 |     100 |      90 | 25                                   
+  Whoami.js         |   83.33 |       60 |      80 |   83.33 | 27,35,48                             
+  index.js          |    87.5 |       50 |     100 |   86.95 | 15,22,31                             
+ src/prompts        |      75 |    33.33 |      50 |      75 |                                      
+  MainPromptMock.js |      75 |    33.33 |      50 |      75 | 29-35,44                             
+ src/utils          |   67.61 |     62.5 |   54.16 |   67.21 |                                      
+  AliasManager.js   |     100 |    91.66 |     100 |     100 | 47                                   
+  ContactManager.js |   73.33 |       60 |   85.71 |   73.33 | 12,34-36                             
+  Fido2Client.js    |    9.61 |        0 |       0 |    9.61 | 8-108                                
+  HelpProto.js      |   89.07 |     82.6 |     100 |   88.88 | 49,135-137,153-154,171-176,195       
+  Logger.js         |   63.63 |    56.25 |   36.84 |   62.79 | ...25,37-49,57,65-69,74,84,88,93,105 
+--------------------|---------|----------|---------|---------|--------------------------------------
+
+> secrez@2.1.11-beta.0 posttest /Users/francescosullo/Projects/Secrez/secrez/packages/secrez
+> nyc check-coverage --statements 65 --branches 50 --functions 65 --lines 65
+

package/package.json

@@ -1,17 +1,17 @@
 {
   "name": "secrez",
-  "version": "2.1.9",
+  "version": "2.1.11-beta.0",
   "license": "MIT",
   "nyc": {
     "include": "src",
     "exclude": []
   },
   "dependencies": {
-    "@secrez/core": "~1.0.5",
-    "@secrez/crypto": "~1.0.4",
-    "@secrez/eth": "~0.0.4",
-    "@secrez/fs": "~1.0.6",
-    "@secrez/utils": "~1.0.4",
+    "@secrez/core": "~1.0.6",
+    "@secrez/crypto": "~1.0.5",
+    "@secrez/eth": "~0.0.5",
+    "@secrez/fs": "~1.0.8",
+    "@secrez/utils": "~1.0.5",
     "case": "^1.6.3",
     "chalk": "^3.0.0",
     "clipboardy": "^2.3.0",

package/src/Command.js

@@ -152,7 +152,15 @@ class Command extends PreCommand {
         // Show the warning message
         this.Logger.yellow(conflictCheck.message);
 
-        // Ask user if they want to continue
+        // If bypass is not allowed (e.g., external changes detected), block the operation
+        if (!conflictCheck.allowBypass) {
+          this.Logger.grey(
+            "Operation blocked for data integrity. Please quit and re-enter Secrez."
+          );
+          return false;
+        }
+
+        // Otherwise, ask user if they want to continue
         const shouldContinue = await this.useInput({
           type: "confirm",
           message: "Do you want to continue anyway?",

package/src/Welcome.js

@@ -250,38 +250,46 @@ Thanks.`);
   }
 
   async handleDeprecatedFido2() {
-    Logger.yellow("FIDO2 second factor authentication is no longer supported in this version.");
+    Logger.yellow(
+      "FIDO2 second factor authentication is no longer supported in this version."
+    );
     Logger.grey("Removing deprecated FIDO2 configuration...");
-    
+
     try {
       const conf = await this.secrez.readConf();
       const data = conf.data;
-      
+
       if (data.keys) {
         // Remove all FIDO2 keys from the configuration
         delete data.keys;
-        
+
         // Save the cleaned configuration
         await this.secrez.saveConf(conf);
-        
+
         Logger.green("FIDO2 configuration has been removed successfully.");
         Logger.grey("You can now login with your master password only.");
-        
+
         // Try to login again with the cleaned configuration
         let errorCode = await this.login();
         if (errorCode === 1) {
-          Logger.red("Login still failed. Please check your password or create a new account.");
+          Logger.red(
+            "Login still failed. Please check your password or create a new account."
+          );
           // eslint-disable-next-line no-process-exit
           process.exit(1);
         }
       } else {
-        Logger.red("No FIDO2 keys found, but login still requires second factor. This may indicate a corrupted configuration.");
+        Logger.red(
+          "No FIDO2 keys found, but login still requires second factor. This may indicate a corrupted configuration."
+        );
         // eslint-disable-next-line no-process-exit
         process.exit(1);
       }
     } catch (e) {
       Logger.red(`Failed to clean FIDO2 configuration: ${e.message}`);
-      Logger.grey("You may need to manually remove the keys.json file and create a new account.");
+      Logger.grey(
+        "You may need to manually remove the keys.json file and create a new account."
+      );
       // eslint-disable-next-line no-process-exit
       process.exit(1);
     }