8 files changed, 170 insertions, 132 deletions
diff --git a/frontend/beta/js/Clipperz/Base.js b/frontend/beta/js/Clipperz/Base.js index cf40314..1c6faa1 100644 --- a/frontend/beta/js/Clipperz/Base.js +++ b/frontend/beta/js/Clipperz/Base.js @@ -233,32 +233,60 @@ MochiKit.Base.update(Clipperz.Base, { //------------------------------------------------------------------------- 'sanitizeString': function(aValue) { var result; if (Clipperz.Base.objectType(aValue) == 'string') { result = aValue; result = result.replace(/</img,"<"); result = result.replace(/>/img,">"); } else { result = aValue; } return result; }, + 'javascriptInjectionPattern': new RegExp("javascript:\/\/\"", "g"), + + 'sanitizeUrl': function(aValue) { + var result; + + if ((aValue != null) && this.javascriptInjectionPattern.test(aValue)) { + result = aValue.replace(this.javascriptInjectionPattern, ''); + console.log("sanitized url", aValue, result); + } else { + result = aValue; + } + + return result; + }, + + 'sanitizeFavicon': function(aValue) { + var result; + + if ((aValue != null) && this.javascriptInjectionPattern.test(aValue)) { + result = aValue.replace(this.javascriptInjectionPattern, ''); + console.log("sanitized favicon", aValue, result); + } else { + result = aValue; + } + + return result; + }, + //------------------------------------------------------------------------- 'exception': { 'AbstractMethod': new MochiKit.Base.NamedError("Clipperz.Base.exception.AbstractMethod"), 'UnknownType': new MochiKit.Base.NamedError("Clipperz.Base.exception.UnknownType"), 'VulnerabilityIssue': new MochiKit.Base.NamedError("Clipperz.Base.exception.VulnerabilityIssue") }, //------------------------------------------------------------------------- __syntaxFix__: "syntax fix" }); MochiKit.Base.registerComparator('Object dummy comparator', diff --git a/frontend/beta/js/Clipperz/Crypto/PRNG.js b/frontend/beta/js/Clipperz/Crypto/PRNG.js index b5c3f8a..6fdeca4 100644 --- a/frontend/beta/js/Clipperz/Crypto/PRNG.js +++ b/frontend/beta/js/Clipperz/Crypto/PRNG.js @@ -184,38 +184,32 @@ Clipperz.Crypto.PRNG.TimeRandomnessSource.prototype = MochiKit.Base.update(new C intervalTime = this.intervalTime(); if (this.boostMode() == true) { intervalTime = intervalTime / 9; } this.updateGeneratorWithValue(entropyByte); setTimeout(this.collectEntropy, intervalTime); }, //------------------------------------------------------------------------- 'numberOfRandomBits': function() { return 5; }, //------------------------------------------------------------------------- - - 'pollingFrequency': function() { - return 10; - }, - - //------------------------------------------------------------------------- __syntaxFix__: "syntax fix" }); //***************************************************************************** Clipperz.Crypto.PRNG.MouseRandomnessSource = function(args) { args = args || {}; Clipperz.Crypto.PRNG.RandomnessSource.call(this, args); this._numberOfBitsToCollectAtEachEvent = 4; this._randomBitsCollector = 0; this._numberOfRandomBitsCollected = 0; MochiKit.Signal.connect(document, 'onmousemove', this, 'collectEntropy'); @@ -232,38 +226,38 @@ Clipperz.Crypto.PRNG.MouseRandomnessSource.prototype = MochiKit.Base.update(new //------------------------------------------------------------------------- 'randomBitsCollector': function() { return this._randomBitsCollector; }, 'setRandomBitsCollector': function(aValue) { this._randomBitsCollector = aValue; }, 'appendRandomBitsToRandomBitsCollector': function(aValue) { var collectedBits; var numberOfRandomBitsCollected; numberOfRandomBitsCollected = this.numberOfRandomBitsCollected(); - collectetBits = this.randomBitsCollector() | (aValue << numberOfRandomBitsCollected); - this.setRandomBitsCollector(collectetBits); + collectedBits = this.randomBitsCollector() | (aValue << numberOfRandomBitsCollected); + this.setRandomBitsCollector(collectedBits); numberOfRandomBitsCollected += this.numberOfBitsToCollectAtEachEvent(); if (numberOfRandomBitsCollected == 8) { - this.updateGeneratorWithValue(collectetBits); + this.updateGeneratorWithValue(collectedBits); numberOfRandomBitsCollected = 0; this.setRandomBitsCollector(0); } this.setNumberOfRandomBitsCollected(numberOfRandomBitsCollected) }, //------------------------------------------------------------------------- 'numberOfRandomBitsCollected': function() { return this._numberOfRandomBitsCollected; }, 'setNumberOfRandomBitsCollected': function(aValue) { this._numberOfRandomBitsCollected = aValue; }, @@ -276,122 +270,80 @@ Clipperz.Crypto.PRNG.MouseRandomnessSource.prototype = MochiKit.Base.update(new var mask; mask = 0xffffffff >>> (32 - this.numberOfBitsToCollectAtEachEvent()); mouseLocation = anEvent.mouse().client; randomBit = ((mouseLocation.x ^ mouseLocation.y) & mask); this.appendRandomBitsToRandomBitsCollector(randomBit) }, //------------------------------------------------------------------------- 'numberOfRandomBits': function() { return 1; }, //------------------------------------------------------------------------- - - 'pollingFrequency': function() { - return 10; - }, - - //------------------------------------------------------------------------- __syntaxFix__: "syntax fix" }); //***************************************************************************** -Clipperz.Crypto.PRNG.KeyboardRandomnessSource = function(args) { +Clipperz.Crypto.PRNG.CryptoRandomRandomnessSource = function(args) { args = args || {}; - Clipperz.Crypto.PRNG.RandomnessSource.call(this, args); - this._randomBitsCollector = 0; - this._numberOfRandomBitsCollected = 0; + this._intervalTime = args.intervalTime || 1000; + this._browserCrypto = args.browserCrypto; - MochiKit.Signal.connect(document, 'onkeypress', this, 'collectEntropy'); + Clipperz.Crypto.PRNG.RandomnessSource.call(this, args); + this.collectEntropy(); return this; } -Clipperz.Crypto.PRNG.KeyboardRandomnessSource.prototype = MochiKit.Base.update(new Clipperz.Crypto.PRNG.RandomnessSource, { - - //------------------------------------------------------------------------- - - 'randomBitsCollector': function() { - return this._randomBitsCollector; - }, +Clipperz.Crypto.PRNG.CryptoRandomRandomnessSource.prototype = MochiKit.Base.update(new Clipperz.Crypto.PRNG.RandomnessSource, { - 'setRandomBitsCollector': function(aValue) { - this._randomBitsCollector = aValue; + 'intervalTime': function() { + return this._intervalTime; }, - - 'appendRandomBitToRandomBitsCollector': function(aValue) { - var collectedBits; - var numberOfRandomBitsCollected; - - numberOfRandomBitsCollected = this.numberOfRandomBitsCollected(); - collectetBits = this.randomBitsCollector() | (aValue << numberOfRandomBitsCollected); - this.setRandomBitsCollector(collectetBits); - numberOfRandomBitsCollected ++; - - if (numberOfRandomBitsCollected == 8) { - this.updateGeneratorWithValue(collectetBits); - numberOfRandomBitsCollected = 0; - this.setRandomBitsCollector(0); - } - - this.setNumberOfRandomBitsCollected(numberOfRandomBitsCollected) + + 'browserCrypto': function () { + return this._browserCrypto; }, //------------------------------------------------------------------------- - 'numberOfRandomBitsCollected': function() { - return this._numberOfRandomBitsCollected; - }, - - 'setNumberOfRandomBitsCollected': function(aValue) { - this._numberOfRandomBitsCollected = aValue; - }, + 'collectEntropy': function() { + var bytesToCollect; - //------------------------------------------------------------------------- + if (this.boostMode() == true) { + bytesToCollect = 64; + } else { + bytesToCollect = 8; + } - 'collectEntropy': function(anEvent) { -/* - var mouseLocation; - var randomBit; - - mouseLocation = anEvent.mouse().client; - - randomBit = ((mouseLocation.x ^ mouseLocation.y) & 0x1); - this.appendRandomBitToRandomBitsCollector(randomBit); -*/ - }, - - //------------------------------------------------------------------------- + var randomValuesArray = new Uint8Array(bytesToCollect); + this.browserCrypto().getRandomValues(randomValuesArray); + for (var i = 0; i < randomValuesArray.length; i++) { + this.updateGeneratorWithValue(randomValuesArray[i]); + } - 'numberOfRandomBits': function() { - return 1; + setTimeout(this.collectEntropy, this.intervalTime()); }, //------------------------------------------------------------------------- - - 'pollingFrequency': function() { - return 10; - }, - - //------------------------------------------------------------------------- __syntaxFix__: "syntax fix" }); //############################################################################# Clipperz.Crypto.PRNG.Fortuna = function(args) { var i,c; args = args || {}; this._key = args.seed || null; if (this._key == null) { this._counter = 0; this._key = new Clipperz.ByteArray(); } else { this._counter = 1; @@ -594,69 +546,63 @@ MochiKit.Logging.logWarning("Fortuna generator has not enough entropy, yet!"); 'addRandomnessSource': function(aRandomnessSource) { aRandomnessSource.setGenerator(this); aRandomnessSource.setSourceId(this.randomnessSources().length); this.randomnessSources().push(aRandomnessSource); if (this.isReadyToGenerateRandomValues() == false) { aRandomnessSource.setBoostMode(true); } }, //------------------------------------------------------------------------- 'deferredEntropyCollection': function(aValue) { var result; -//MochiKit.Logging.logDebug(">>> PRNG.deferredEntropyCollection"); if (this.isReadyToGenerateRandomValues()) { -//MochiKit.Logging.logDebug("--- PRNG.deferredEntropyCollection - 1"); result = aValue; } else { -//MochiKit.Logging.logDebug("--- PRNG.deferredEntropyCollection - 2"); var deferredResult; Clipperz.NotificationCenter.notify(this, 'updatedProgressState', 'collectingEntropy', true); deferredResult = new MochiKit.Async.Deferred(); -// deferredResult.addBoth(function(res) {MochiKit.Logging.logDebug("1.2.1 - PRNG.deferredEntropyCollection - 1: " + res); return res;}); deferredResult.addCallback(MochiKit.Base.partial(MochiKit.Async.succeed, aValue)); -// deferredResult.addBoth(function(res) {MochiKit.Logging.logDebug("1.2.2 - PRNG.deferredEntropyCollection - 2: " + res); return res;}); MochiKit.Signal.connect(this, 'readyToGenerateRandomBytes', deferredResult, 'callback'); result = deferredResult; } -//MochiKit.Logging.logDebug("<<< PRNG.deferredEntropyCollection - result: " + result); return result; }, //------------------------------------------------------------------------- 'fastEntropyAccumulationForTestingPurpose': function() { while (! this.isReadyToGenerateRandomValues()) { this.addRandomByte(Math.floor(Math.random() * 32), Math.floor(Math.random() * 32), Math.floor(Math.random() * 256)); } }, //------------------------------------------------------------------------- - +/* 'dump': function(appendToDoc) { var tbl; var i,c; tbl = document.createElement("table"); tbl.border = 0; with (tbl.style) { border = "1px solid lightgrey"; fontFamily = 'Helvetica, Arial, sans-serif'; fontSize = '8pt'; //borderCollapse = "collapse"; } var hdr = tbl.createTHead(); var hdrtr = hdr.insertRow(0); // document.createElement("tr"); { @@ -736,33 +682,33 @@ MochiKit.Logging.logWarning("Fortuna generator has not enough entropy, yet!"); fontFamily = "Courier New, monospace"; fontSize = "12px"; lineHeight = "16px"; borderTop = "1px solid black"; padding = "10px"; } if (document.getElementById(ne.id)) { MochiKit.DOM.swapDOM(ne.id, ne); } else { document.body.appendChild(ne); } ne.appendChild(tbl); } return tbl; }, - +*/ //----------------------------------------------------------------------------- __syntaxFix__: "syntax fix" }); //############################################################################# Clipperz.Crypto.PRNG.Random = function(args) { args = args || {}; // MochiKit.Base.bindMethods(this); return this; } Clipperz.Crypto.PRNG.Random.prototype = MochiKit.Base.update(null, { 'toString': function() { @@ -811,39 +757,49 @@ Clipperz.Crypto.PRNG.defaultRandomGenerator = function() { } //............................................................. // // MouseRandomnessSource // //............................................................. { var newRandomnessSource; newRandomnessSource = new Clipperz.Crypto.PRNG.MouseRandomnessSource(); _clipperz_crypt_prng_defaultPRNG.addRandomnessSource(newRandomnessSource); } //............................................................. // - // KeyboardRandomnessSource + // CryptoRandomRandomnessSource // //............................................................. { var newRandomnessSource; + var browserCrypto; - newRandomnessSource = new Clipperz.Crypto.PRNG.KeyboardRandomnessSource(); - _clipperz_crypt_prng_defaultPRNG.addRandomnessSource(newRandomnessSource); + if (window.crypto && window.crypto.getRandomValues) { + browserCrypto = window.crypto; + } else if (window.msCrypto && window.msCrypto.getRandomValues) { + browserCrypto = window.msCrypto; + } else { + browserCrypto = null; + } + + if (browserCrypto != null) { + newRandomnessSource = new Clipperz.Crypto.PRNG.CryptoRandomRandomnessSource({'browserCrypto':browserCrypto}); + _clipperz_crypt_prng_defaultPRNG.addRandomnessSource(newRandomnessSource); + } } - } return _clipperz_crypt_prng_defaultPRNG; }; //############################################################################# Clipperz.Crypto.PRNG.exception = { NotEnoughEntropy: new MochiKit.Base.NamedError("Clipperz.Crypto.PRNG.exception.NotEnoughEntropy") }; MochiKit.DOM.addLoadEvent(Clipperz.Crypto.PRNG.defaultRandomGenerator); diff --git a/frontend/beta/js/Clipperz/Crypto/SRP.js b/frontend/beta/js/Clipperz/Crypto/SRP.js index 8cc80ba..8c522ad 100644 --- a/frontend/beta/js/Clipperz/Crypto/SRP.js +++ b/frontend/beta/js/Clipperz/Crypto/SRP.js @@ -31,52 +31,63 @@ try { if (typeof(Clipperz.Crypto.BigInt) == 'undefined') { throw ""; }} catch (e try { if (typeof(Clipperz.Crypto.PRNG) == 'undefined') { throw ""; }} catch (e) { throw "Clipperz.Crypto.SRP depends on Clipperz.Crypto.PRNG!"; } if (typeof(Clipperz.Crypto.SRP) == 'undefined') { Clipperz.Crypto.SRP = {}; } Clipperz.Crypto.SRP.VERSION = "0.1"; Clipperz.Crypto.SRP.NAME = "Clipperz.Crypto.SRP"; //############################################################################# MochiKit.Base.update(Clipperz.Crypto.SRP, { '_n': null, '_g': null, + '_k': null, + //------------------------------------------------------------------------- 'n': function() { if (Clipperz.Crypto.SRP._n == null) { Clipperz.Crypto.SRP._n = new Clipperz.Crypto.BigInt("115b8b692e0e045692cf280b436735c77a5a9e8a9e7ed56c965f87db5b2a2ece3", 16); } return Clipperz.Crypto.SRP._n; }, //------------------------------------------------------------------------- 'g': function() { if (Clipperz.Crypto.SRP._g == null) { Clipperz.Crypto.SRP._g = new Clipperz.Crypto.BigInt(2); // eventually 5 (as suggested on the Diffi-Helmann documentation) } return Clipperz.Crypto.SRP._g; }, + 'k': function() { + if (Clipperz.Crypto.SRP._k == null) { +// Clipperz.Crypto.SRP._k = new Clipperz.Crypto.BigInt(this.stringHash(this.n().asString() + this.g().asString()), 16); + Clipperz.Crypto.SRP._k = new Clipperz.Crypto.BigInt("64398bff522814e306a97cb9bfc4364b7eed16a8c17c5208a40a2bad2933c8e", 16); + } + + return Clipperz.Crypto.SRP._k; + }, + //----------------------------------------------------------------------------- 'exception': { 'InvalidValue': new MochiKit.Base.NamedError("Clipperz.Crypto.SRP.exception.InvalidValue") }, //------------------------------------------------------------------------- __syntaxFix__: "syntax fix" }); //############################################################################# // // S R P C o n n e c t i o n version 1.0 // //============================================================================= @@ -116,154 +127,162 @@ Clipperz.Crypto.SRP.Connection.prototype = MochiKit.Base.update(null, { 'C': function () { return this._C; }, //------------------------------------------------------------------------- 'P': function () { return this._P; }, //------------------------------------------------------------------------- 'a': function () { if (this._a == null) { this._a = new Clipperz.Crypto.BigInt(Clipperz.Crypto.PRNG.defaultRandomGenerator().getRandomBytes(32).toHexString().substring(2), 16); // this._a = new Clipperz.Crypto.BigInt("37532428169486597638072888476611365392249575518156687476805936694442691012367", 10); -//MochiKit.Logging.logDebug("SRP a: " + this._a); } return this._a; }, //------------------------------------------------------------------------- 'A': function () { if (this._A == null) { - // Warning: this value should be strictly greater than zero: how should we perform this check? + // Warning: this value should be strictly greater than zero this._A = Clipperz.Crypto.SRP.g().powerModule(this.a(), Clipperz.Crypto.SRP.n()); - - if (this._A.equals(0)) { -MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to 0."); + if (this._A.equals(0) || negative(this._A)) { + MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'A' to 0."); throw Clipperz.Crypto.SRP.exception.InvalidValue; } -//MochiKit.Logging.logDebug("SRP A: " + this._A); } return this._A; }, //------------------------------------------------------------------------- 's': function () { return this._s; -//MochiKit.Logging.logDebug("SRP s: " + this._S); }, 'set_s': function(aValue) { this._s = aValue; }, //------------------------------------------------------------------------- 'B': function () { return this._B; }, 'set_B': function(aValue) { - // Warning: this value should be strictly greater than zero: how should we perform this check? - if (! aValue.equals(0)) { - this._B = aValue; -//MochiKit.Logging.logDebug("SRP B: " + this._B); - } else { -MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to 0."); + // Warning: this value should be strictly greater than zero + this._B = aValue; + if (this._B.equals(0) || negative(this._B)) { + MochiKit.Logging.logError("Clipperz.Crypto.SRP.Connection: trying to set 'B' to 0."); throw Clipperz.Crypto.SRP.exception.InvalidValue; } }, //------------------------------------------------------------------------- 'x': function () { if (this._x == null) { this._x = new Clipperz.Crypto.BigInt(this.stringHash(this.s().asString(16, 64) + this.P()), 16); -//MochiKit.Logging.logDebug("SRP x: " + this._x); } return this._x; }, //------------------------------------------------------------------------- 'u': function () { if (this._u == null) { - this._u = new Clipperz.Crypto.BigInt(this.stringHash(this.B().asString()), 16); -//MochiKit.Logging.logDebug("SRP u: " + this._u); + this._u = new Clipperz.Crypto.BigInt(this.stringHash(this.A().asString() + this.B().asString()), 16); } return this._u; }, //------------------------------------------------------------------------- 'S': function () { if (this._S == null) { var bigint; var srp; bigint = Clipperz.Crypto.BigInt; srp = Clipperz.Crypto.SRP; this._S = bigint.powerModule( - bigint.subtract(this.B(), bigint.powerModule(srp.g(), this.x(), srp.n())), - bigint.add(this.a(), bigint.multiply(this.u(), this.x())), - srp.n() + bigint.subtract( + this.B(), + bigint.multiply( + Clipperz.Crypto.SRP.k(), + bigint.powerModule(srp.g(), this.x(), srp.n()) + ) + ), + bigint.add(this.a(), bigint.multiply(this.u(), this.x())), + srp.n() ) -//MochiKit.Logging.logDebug("SRP S: " + this._S); } return this._S; }, //------------------------------------------------------------------------- 'K': function () { if (this._K == null) { this._K = this.stringHash(this.S().asString()); -//MochiKit.Logging.logDebug("SRP K: " + this._K); } return this._K; }, //------------------------------------------------------------------------- 'M1': function () { if (this._M1 == null) { - this._M1 = this.stringHash(this.A().asString(10) + this.B().asString(10) + this.K()); -//MochiKit.Logging.logDebug("SRP M1: " + this._M1); +// this._M1 = this.stringHash(this.A().asString(10) + this.B().asString(10) + this.K()); + + // http://srp.stanford.edu/design.html + // User -> Host: M = H(H(N) xor H(g), H(I), s, A, B, K) + + this._M1 = this.stringHash( + "597626870978286801440197562148588907434001483655788865609375806439877501869636875571920406529" + + this.stringHash(this.C()) + + this.s().asString() + + this.A().asString() + + this.B().asString() + + this.K() + ); +//console.log("M1", this._M1); } return this._M1; }, //------------------------------------------------------------------------- 'M2': function () { if (this._M2 == null) { this._M2 = this.stringHash(this.A().asString(10) + this.M1() + this.K()); -//MochiKit.Logging.logDebug("SRP M2: " + this._M2); +//console.log("M2", this._M2); } return this._M2; }, //========================================================================= 'serverSideCredentialsWithSalt': function(aSalt) { var result; var s, x, v; s = aSalt; x = this.stringHash(s + this.P()); v = Clipperz.Crypto.SRP.g().powerModule(new Clipperz.Crypto.BigInt(x, 16), Clipperz.Crypto.SRP.n()); result = {}; diff --git a/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js b/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js index 2295d3f..369b9ce 100644 --- a/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js +++ b/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js @@ -125,33 +125,33 @@ Clipperz.PM.BookmarkletProcessor.prototype = MochiKit.Base.update(null, { type = aField['type'].toLowerCase(); result = ((type != 'hidden') && (type != 'submit') && (type != 'checkbox') && (type != 'radio') && (type != 'select')); return result; }, this.fields()) } return this._editableFields; }, //------------------------------------------------------------------------- 'hostname': function() { if (this._hostname == null) { var actionUrl; - actionUrl = this.configuration()['form']['attributes']['action']; + actionUrl = Clipperz.Base.sanitizeUrl(this.configuration()['form']['attributes']['action']); //MochiKit.Logging.logDebug("+++ actionUrl: " + actionUrl); this._hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1'); } return this._hostname; }, 'favicon': function() { if (this._favicon == null) { this._favicon = "http://" + this.hostname() + "/favicon.ico"; //MochiKit.Logging.logDebug("+++ favicon: " + this._favicon); } return this._favicon; }, diff --git a/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js b/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js index 0e4640e..a5a4697 100644 --- a/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js +++ b/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js @@ -87,33 +87,33 @@ YAHOO.extendX(Clipperz.PM.Components.RecordDetail.DirectLoginBindingComponent, C //------------------------------------------------------------------------- 'recordFieldOptions': function() { var result; var option; var recordFieldKey; var recordFields; //MochiKit.Logging.logDebug(">>> DirectLoginBindingComponent.recordFieldOptions"); recordFields = this.directLoginBinding().directLogin().record().currentVersion().fields(); result = []; option = {tag:'option', value:null, html:'---'}; result.push(option); for (recordFieldKey in recordFields) { // TODO: remove the value: field and replace it with element.dom.value = <some value> - option = {tag:'option', value:recordFieldKey, html:recordFields[recordFieldKey].label()} + option = {tag:'option', value:recordFieldKey, html:Clipperz.Base.sanitizeString(recordFields[recordFieldKey].label())} if (recordFieldKey == this.directLoginBinding().fieldKey()) { option['selected'] = true; } result.push(option); } //MochiKit.Logging.logDebug("<<< DirectLoginBindingComponent.recordFieldOptions"); return result; }, //------------------------------------------------------------------------- 'syncAndUpdateEditMode': function() { this.synchronizeComponentValues(); this.updateEditMode(); }, @@ -137,33 +137,33 @@ YAHOO.extendX(Clipperz.PM.Components.RecordDetail.DirectLoginBindingComponent, C Clipperz.YUI.DomHelper.append(selectElement.dom, anOption); }); */ this.getElement('editModeBox').show(); //MochiKit.Logging.logDebug("<<< DirectLoginBindingComponent.updateEditMode"); }, //------------------------------------------------------------------------- 'updateViewMode': function() { //MochiKit.Logging.logDebug(">>> DirectLoginBindingComponent.updateViewMode"); this.getElement('editModeBox').hide(); this.getElement('viewModeBox').show(); - this.getElement('viewValue').update(this.directLoginBinding().field().label()); + this.getElement('viewValue').update(Clipperz.Base.sanitizeString(this.directLoginBinding().field().label())); //MochiKit.Logging.logDebug("<<< DirectLoginBindingComponent.updateViewMode"); }, //------------------------------------------------------------------------- 'synchronizeComponentValues': function() { //MochiKit.Logging.logDebug(">>> DirectLoginBindingComponent.synchronizeComponentValues") //MochiKit.Logging.logDebug("--- DirectLoginBindingComponent.synchronizeComponentValues - 1 - " + this.getId('select')); this.directLoginBinding().setFieldKey(this.getDom('select').value); //MochiKit.Logging.logDebug("<<< DirectLoginBindingComponent.synchronizeComponentValues"); }, //------------------------------------------------------------------------- __syntaxFix__: "syntax fix" }); diff --git a/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js b/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js index c0cfa3c..56d9d59 100644 --- a/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js +++ b/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js @@ -25,33 +25,33 @@ if (typeof(Clipperz) == 'undefined') { Clipperz = {}; } if (typeof(Clipperz.PM) == 'undefined') { Clipperz.PM = {}; } if (typeof(Clipperz.PM.DataModel) == 'undefined') { Clipperz.PM.DataModel = {}; } //############################################################################# Clipperz.PM.DataModel.DirectLogin = function(args) { //MochiKit.Logging.logDebug(">>> new Clipperz.PM.DataModel.DirectLogin"); //console.log(">>> new Clipperz.PM.DataModel.DirectLogin - args: %o", args); //console.log("--- formData: %s", Clipperz.Base.serializeJSON(args.formData)); args = args || {}; //MochiKit.Logging.logDebug("--- new Clipperz.PM.DataModel.DirectLogin - args: " + Clipperz.Base.serializeJSON(MochiKit.Base.keys(args))); this._record = args.record || null; this._label = args.label || "unnamed record" this._reference = args.reference || Clipperz.PM.Crypto.randomKey(); - this._favicon = args.favicon || null; + this._favicon = Clipperz.Base.sanitizeFavicon(args.favicon) || null; this._bookmarkletVersion = args.bookmarkletVersion || "0.1"; this._directLoginInputs = null; this._formValues = args.formValues || {}; this.setFormData(args.formData || null); //console.log("=== formData: %o", this.formData()); if (args.legacyBindingData == null) { this.setBindingData(args.bindingData || null); } else { this.setLegacyBindingData(args.legacyBindingData); } this._fixedFavicon = null; @@ -89,67 +89,75 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, { 'label': function() { return this._label; }, 'setLabel': function(aValue) { this._label = aValue; }, //------------------------------------------------------------------------- 'favicon': function() { if (this._favicon == null) { var actionUrl; var hostname; - actionUrl = this.formData()['attributes']['action']; + actionUrl = this.action(); hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1'); - this._favicon = "http://" + hostname + "/favicon.ico"; + this._favicon = Clipperz.Base.sanitizeFavicon("http://" + hostname + "/favicon.ico"); } return this._favicon; }, //------------------------------------------------------------------------- 'fixedFavicon': function() { var result; if (this._fixedFavicon == null) { result = this.favicon(); if (Clipperz_IEisBroken) { if (this.user().preferences().disableUnsecureFaviconLoadingForIE()) { if (result.indexOf('https://') != 0) { result = Clipperz.PM.Strings['defaultFaviconUrl_IE']; this.setFixedFavicon(result); } } } } else { result = this._fixedFavicon; } return result; }, 'setFixedFavicon': function(aValue) { this._fixedFavicon = aValue; }, + 'action': function () { + var result; + + result = Clipperz.Base.sanitizeUrl(this.formData()['attributes']['action']); + + return result; + }, + //------------------------------------------------------------------------- 'bookmarkletVersion': function() { return this._bookmarkletVersion; }, 'setBookmarkletVersion': function(aValue) { this._bookmarkletVersion = aValue; }, //------------------------------------------------------------------------- 'formData': function() { return this._formData; }, @@ -429,33 +437,33 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, { //------------------------------------------------------------------------- 'runSubmitFormDirectLogin': function(aWindow) { MochiKit.DOM.withWindow(aWindow, MochiKit.Base.bind(function() { var formElement; var formSubmitFunction; var submitButtons; //MochiKit.Logging.logDebug("### runDirectLogin - 3"); // MochiKit.DOM.currentDocument().write('<html><head><title>' + this.label() + '</title><META http-equiv="Content-Type" content="text/html; charset=utf-8" /></head><body></body></html>') //MochiKit.Logging.logDebug("### runDirectLogin - 3.1"); MochiKit.DOM.appendChildNodes(MochiKit.DOM.currentDocument().body, MochiKit.DOM.H3(null, "Loading " + this.label() + " ...")); //MochiKit.Logging.logDebug("### runDirectLogin - 4"); //console.log(this.formData()['attributes']); formElement = MochiKit.DOM.FORM(MochiKit.Base.update({id:'directLoginForm'}, { 'method':this.formData()['attributes']['method'], - 'action':this.formData()['attributes']['action']})); + 'action': this.action()})); //MochiKit.Logging.logDebug("### runDirectLogin - 5"); formSubmitFunction = MochiKit.Base.method(formElement, 'submit'); //MochiKit.Logging.logDebug("### runDirectLogin - 6"); MochiKit.DOM.appendChildNodes(MochiKit.DOM.currentDocument().body, MochiKit.DOM.DIV({style:'display:none; visibility:hidden;'}, formElement) ); //MochiKit.Logging.logDebug("### runDirectLogin - 7"); MochiKit.DOM.appendChildNodes(formElement, MochiKit.Base.map( MochiKit.Base.methodcaller("formConfiguration"), this.directLoginInputs())); //MochiKit.Logging.logDebug("### runDirectLogin - 8"); submitButtons = MochiKit.Base.filter(function(anInputElement) { //MochiKit.Logging.logDebug("### runDirectLogin - 8.1 - " + anInputElement); //MochiKit.Logging.logDebug("### runDirectLogin - 8.2 - " + anInputElement.tagName); //MochiKit.Logging.logDebug("### runDirectLogin - 8.3 - " + anInputElement.getAttribute('type')); @@ -474,35 +482,35 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, { } } else { //MochiKit.Logging.logDebug("### NEW submit") submitButtons[0].click(); } }, this)); }, //------------------------------------------------------------------------- 'runDirectLogin': function(aNewWindow) { var newWindow; //console.log("formData.attributes", this.formData()['attributes']); // if (/^javascript/.test(this.formData()['attributes']['action'])) { - if ((/^(https?|webdav|ftp)\:/.test(this.formData()['attributes']['action']) == false) && - (this.formData()['attributes']['type'] != 'http_auth')) - { + if ((/^(https?|webdav|ftp)\:/.test(this.action()) == false) && + (this.formData()['attributes']['type'] != 'http_auth') + ) { var messageBoxConfiguration; if (typeof(aNewWindow) != 'undefined') { aNewWindow.close(); } messageBoxConfiguration = {}; messageBoxConfiguration.title = Clipperz.PM.Strings['VulnerabilityWarning_Panel_title']; messageBoxConfiguration.msg = Clipperz.PM.Strings['VulnerabilityWarning_Panel_message']; messageBoxConfiguration.animEl = YAHOO.ext.Element.get("mainDiv"); messageBoxConfiguration.progress = false; messageBoxConfiguration.closable = false; messageBoxConfiguration.buttons = {'cancel': Clipperz.PM.Strings['VulnerabilityWarning_Panel_buttonLabel']}; Clipperz.YUI.MessageBox.show(messageBoxConfiguration); diff --git a/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js b/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js index 236d7c9..ba302da 100644 --- a/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js +++ b/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js @@ -34,33 +34,33 @@ Clipperz.PM.DataModel.DirectLoginReference = function(args) { //MochiKit.Logging.logDebug(">>> new DirectLoginReference: " + Clipperz.Base.serializeJSON(MochiKit.Base.keys(args))); //MochiKit.Logging.logDebug(">>> new DirectLoginReference - record: " + args.record); this._user = args.user; if (args.directLogin != null) { this._reference = args.directLogin.reference(); this._recordReference = args.directLogin.record().reference(); this._label = args.directLogin.label(); this._favicon = args.directLogin.favicon() || null; this._directLogin = args.directLogin; this._record = args.directLogin.record(); } else { this._reference = args.reference; this._recordReference = args.record; this._label = args.label; - this._favicon = args.favicon || null; + this._favicon = Clipperz.Base.sanitizeFavicon(args.favicon) || null; this._directLogin = null; this._record = null; } this._fixedFavicon = null; return this; } Clipperz.PM.DataModel.DirectLoginReference.prototype = MochiKit.Base.update(null, { 'user': function() { return this._user; }, diff --git a/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js b/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js index 1a5caff..b0b9b63 100644 --- a/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js +++ b/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js @@ -24,32 +24,33 @@ refer to http://www.clipperz.com. try { if (typeof(Clipperz.PM.Proxy.Offline) == 'undefined') { throw ""; }} catch (e) { throw "Clipperz.PM.Proxy.Offline.DataStore depends on Clipperz.PM.Proxy.Offline!"; } //============================================================================= Clipperz.PM.Proxy.Offline.DataStore = function(args) { args = args || {}; this._data = args.data || (typeof(_clipperz_dump_data_) != 'undefined' ? _clipperz_dump_data_ : null); this._isReadOnly = (typeof(args.readOnly) == 'undefined' ? true : args.readOnly); this._shouldPayTolls = args.shouldPayTolls || false; this._tolls = {}; this._connections = {}; + this._C = null; this._b = null; this._B = null; this._A = null; this._userData = null; return this; } //Clipperz.Base.extend(Clipperz.PM.Proxy.Offline.DataStore, Object, { Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, { //------------------------------------------------------------------------- 'isReadOnly': function () { return this._isReadOnly; }, @@ -131,32 +132,42 @@ Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, { }, this)); } deferredResult.addCallback(MochiKit.Base.bind(function() { //console.log("this._data", resultData); this._data = resultData; }, this)); deferredResult.callback(); //Clipperz.log("<<< Proxy.Test.setupWithData"); return deferredResult; }, //========================================================================= + 'C': function() { + return this._C; + }, + + 'set_C': function(aValue) { + this._C = aValue; + }, + + //------------------------------------------------------------------------- + 'b': function() { return this._b; }, 'set_b': function(aValue) { this._b = aValue; }, //------------------------------------------------------------------------- 'B': function() { return this._B; }, 'set_B': function(aValue) { this._B = aValue; @@ -223,34 +234,34 @@ Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, { var tollParameters; tollParameters = someParameters['toll']; localToll = this.tolls()[tollParameters['targetValue']]; if (localToll != null) { if (! Clipperz.PM.Toll.validate(tollParameters['targetValue'], tollParameters['toll'], localToll['cost'])) { throw "Toll value too low."; }; } else { throw "Missing toll"; } } }, //========================================================================= - - 'processMessage': function(aFunctionName, someParameters) { + + 'processMessage': function (aFunctionName, someParameters) { var result; switch(aFunctionName) { case 'knock': result = this._knock(someParameters); break; case 'registration': this.checkToll(aFunctionName, someParameters); result = this._registration(someParameters.parameters); break; case 'handshake': this.checkToll(aFunctionName, someParameters); result = this._handshake(someParameters.parameters); break; case 'message': this.checkToll(aFunctionName, someParameters); @@ -290,95 +301,111 @@ Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, { this.data()['users'][someParameters['credentials']['C']] = { 's': someParameters['credentials']['s'], 'v': someParameters['credentials']['v'], 'version': someParameters['credentials']['version'], // 'lock': someParameters['user']['lock'], 'lock': Clipperz.Crypto.Base.generateRandomSeed(), // 'maxNumberOfRecords': '100', 'userDetails': someParameters['user']['header'], 'statistics': someParameters['user']['statistics'], 'userDetailsVersion': someParameters['user']['version'], 'records': {} } } else { throw "user already exists"; } } else { - throw Clipperz.PM.Proxy.Offline.DataStore.exception.ReadOnly; + throw Clipperz.PM.Proxy.Offline.DataStore.exception.ReadOnly; } result = { result: { 'lock': this.data()['users'][someParameters['credentials']['C']]['lock'], 'result': 'done' - }, + }, toll: this.getTollForRequestType('CONNECT') } return MochiKit.Async.succeed(result); }, //------------------------------------------------------------------------- '_handshake': function(someParameters) { var result; var nextTollRequestType; //Clipperz.log(">>> Proxy.Offline.DataStore._handshake"); result = {}; if (someParameters.message == "connect") { var userData; var randomBytes; var b, B, v; //console.log(">>> Proxy.Offline.DataStore._handshake.connect", someParameters); userData = this.data()['users'][someParameters.parameters.C]; if ((typeof(userData) != 'undefined') && (userData['version'] == someParameters.version)) { this.setUserData(userData); } else { this.setUserData(this.data()['users']['catchAllUser']); } randomBytes = Clipperz.Crypto.Base.generateRandomSeed(); + this.set_C(someParameters.parameters.C); this.set_b(new Clipperz.Crypto.BigInt(randomBytes, 16)); v = new Clipperz.Crypto.BigInt(this.userData()['v'], 16); - this.set_B(v.add(Clipperz.Crypto.SRP.g().powerModule(this.b(), Clipperz.Crypto.SRP.n()))); + this.set_B((Clipperz.Crypto.SRP.k().multiply(v)).add(Clipperz.Crypto.SRP.g().powerModule(this.b(), Clipperz.Crypto.SRP.n()))); this.set_A(someParameters.parameters.A); result['s'] = this.userData()['s']; result['B'] = this.B().asString(16); nextTollRequestType = 'CONNECT'; } else if (someParameters.message == "credentialCheck") { - var v, u, S, A, K, M1; + var v, u, s, S, A, K, M1; + var stringHash = function (aValue) { + return Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(aValue)).toHexString().substring(2); + }; //console.log(">>> Proxy.Offline.DataStore._handshake.credentialCheck", someParameters); v = new Clipperz.Crypto.BigInt(this.userData()['v'], 16); - u = new Clipperz.Crypto.BigInt(Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(this.B().asString(10))).toHexString(), 16); A = new Clipperz.Crypto.BigInt(this.A(), 16); + u = new Clipperz.Crypto.BigInt(Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(A.asString(10) + this.B().asString(10))).toHexString(), 16); + s = new Clipperz.Crypto.BigInt(this.userData()['s'], 16); S = (A.multiply(v.powerModule(u, Clipperz.Crypto.SRP.n()))).powerModule(this.b(), Clipperz.Crypto.SRP.n()); - K = Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(S.asString(10))).toHexString().slice(2); + K = stringHash(S.asString(10)); - M1 = Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(A.asString(10) + this.B().asString(10) + K)).toHexString().slice(2); + M1 = stringHash( + "597626870978286801440197562148588907434001483655788865609375806439877501869636875571920406529" + + stringHash(this.C()) + + s.asString(10) + + A.asString(10) + + this.B().asString(10) + + K + ); if (someParameters.parameters.M1 == M1) { var M2; - M2 = Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(A.asString(10) + someParameters.parameters.M1 + K)).toHexString().slice(2); + M2 = stringHash( + A.asString(10) + + someParameters.parameters.M1 + + K + ); result['M2'] = M2; } else { throw new Error("Client checksum verification failed! Expected <" + M1 + ">, received <" + someParameters.parameters.M1 + ">.", "Error"); } nextTollRequestType = 'MESSAGE'; } else if (someParameters.message == "oneTimePassword") { var otpData; //console.log("HANDSHAKE WITH OTP", someParameters.parameters.oneTimePasswordKey); //console.log("someParameters", someParameters); //console.log("data.OTP", Clipperz.Base.serializeJSON(this.data()['onetimePasswords'])); otpData = this.data()['onetimePasswords'][someParameters.parameters.oneTimePasswordKey]; try { if (typeof(otpData) != 'undefined') { |