From 6fcd82fb85f277f9e974a62763024d7958ff218d Mon Sep 17 00:00:00 2001 From: El RIDO Date: Tue, 27 Aug 2019 07:38:27 +0200 Subject: [PATCH 01/24] making the feature detection more robust, let users with no WASM create uncompressed pastes, remove dead & duplicate code --- i18n/bg.json | 4 +- i18n/cs.json | 4 +- i18n/de.json | 4 +- i18n/es.json | 4 +- i18n/fr.json | 4 +- i18n/hu.json | 4 +- i18n/it.json | 4 +- i18n/nl.json | 4 +- i18n/no.json | 4 +- i18n/oc.json | 4 +- i18n/pl.json | 4 +- i18n/pt.json | 4 +- i18n/ru.json | 4 +- i18n/sl.json | 4 +- i18n/zh.json | 4 +- js/privatebin.js | 107 ++++++++++++++++++++++++------------------- js/test/CryptTool.js | 3 ++ tpl/bootstrap.php | 2 +- tpl/page.php | 2 +- 19 files changed, 110 insertions(+), 64 deletions(-) diff --git a/i18n/bg.json b/i18n/bg.json index c51ab0f4..07a929c1 100644 --- a/i18n/bg.json +++ b/i18n/bg.json @@ -161,5 +161,7 @@ "For more information see this FAQ entry.": "Вижте тази страница за повече информация.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Браузъра ви може да се нуждае от HTTPS връзка за да използва WebCrypto API. Пробвай да минеш на HTTPS." + "Браузъра ви може да се нуждае от HTTPS връзка за да използва WebCrypto API. Пробвай да минеш на HTTPS.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones." } diff --git a/i18n/cs.json b/i18n/cs.json index a36ef8ba..365d6110 100644 --- a/i18n/cs.json +++ b/i18n/cs.json @@ -161,5 +161,7 @@ "For more information see this FAQ entry.": "For more information see this FAQ entry.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS." + "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones." } diff --git a/i18n/de.json b/i18n/de.json index 3f99404f..a89f8208 100644 --- a/i18n/de.json +++ b/i18n/de.json @@ -161,5 +161,7 @@ "For more information see this FAQ entry.": "Besuche diesen FAQ Eintrag für weitere Informationen dazu.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Dein Browser benötigt möglicherweise eine HTTPS Verbindung um das WebCrypto API nutzen zu können. Versuche auf HTTPS zu wechseln." + "Dein Browser benötigt möglicherweise eine HTTPS Verbindung um das WebCrypto API nutzen zu können. Versuche auf HTTPS zu wechseln.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Dein Browser unterstützt WebAssembly nicht, welches für zlib Komprimierung benötigt wird. Du kannst unkomprimierte Dokumente erzeugen, aber keine komprimierten lesen." } diff --git a/i18n/es.json b/i18n/es.json index 6dd9e912..de6fa543 100644 --- a/i18n/es.json +++ b/i18n/es.json @@ -161,5 +161,7 @@ "For more information see this FAQ entry.": "For more information see this FAQ entry.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS." + "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones." } diff --git a/i18n/fr.json b/i18n/fr.json index fabb1d29..bebd1857 100644 --- a/i18n/fr.json +++ b/i18n/fr.json @@ -170,5 +170,7 @@ "For more information see this FAQ entry.": "Pour plus d'informations consultez cette rubrique de la FAQ.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Votre navigateur peut nécessiter une connexion HTTPS pour prendre en charge l’API WebCrypto. Essayez de passer en HTTPS." + "Votre navigateur peut nécessiter une connexion HTTPS pour prendre en charge l’API WebCrypto. Essayez de passer en HTTPS.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones." } diff --git a/i18n/hu.json b/i18n/hu.json index da2dd525..cf1fe02b 100644 --- a/i18n/hu.json +++ b/i18n/hu.json @@ -161,5 +161,7 @@ "For more information see this FAQ entry.": "For more information see this FAQ entry.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS." + "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones." } diff --git a/i18n/it.json b/i18n/it.json index 125812fa..22f6838a 100644 --- a/i18n/it.json +++ b/i18n/it.json @@ -161,5 +161,7 @@ "For more information see this FAQ entry.": "For more information see this FAQ entry.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS." + "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones." } diff --git a/i18n/nl.json b/i18n/nl.json index 4c93d784..00aea3b7 100644 --- a/i18n/nl.json +++ b/i18n/nl.json @@ -161,5 +161,7 @@ "For more information see this FAQ entry.": "For more information see this FAQ entry.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS." + "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones." } diff --git a/i18n/no.json b/i18n/no.json index 108ce8d3..9f9fa62e 100644 --- a/i18n/no.json +++ b/i18n/no.json @@ -161,5 +161,7 @@ "For more information see this FAQ entry.": "For more information see this FAQ entry.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS." + "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones." } diff --git a/i18n/oc.json b/i18n/oc.json index ec81c89b..6cd33cab 100644 --- a/i18n/oc.json +++ b/i18n/oc.json @@ -170,5 +170,7 @@ "For more information see this FAQ entry.": "Per mai d’informacions vejatz aqueste article de FAQ.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Se pòt que vòstre navigator faga besonh d’una connexion HTTPS per èsser compatible amb l’API WebCrypto. Ensajatz de passar al HTTPS." + "Se pòt que vòstre navigator faga besonh d’una connexion HTTPS per èsser compatible amb l’API WebCrypto. Ensajatz de passar al HTTPS.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones." } diff --git a/i18n/pl.json b/i18n/pl.json index f1ae43f0..3be5baa0 100644 --- a/i18n/pl.json +++ b/i18n/pl.json @@ -161,5 +161,7 @@ "For more information see this FAQ entry.": "For more information see this FAQ entry.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS." + "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones." } diff --git a/i18n/pt.json b/i18n/pt.json index f7b7e0bb..3ff603e0 100644 --- a/i18n/pt.json +++ b/i18n/pt.json @@ -161,5 +161,7 @@ "For more information see this FAQ entry.": "For more information see this FAQ entry.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS." + "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones." } diff --git a/i18n/ru.json b/i18n/ru.json index d25b3465..66d413c7 100644 --- a/i18n/ru.json +++ b/i18n/ru.json @@ -171,5 +171,7 @@ "For more information see this FAQ entry.": "Для продробностей прочтите информацию в FAQ.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Ваш браузер требует использования HTTPS подключения для поддержки WebCrypto API. Попробуйте переключиться на HTTPS." + "Ваш браузер требует использования HTTPS подключения для поддержки WebCrypto API. Попробуйте переключиться на HTTPS.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones." } diff --git a/i18n/sl.json b/i18n/sl.json index e88961d0..5e61d197 100644 --- a/i18n/sl.json +++ b/i18n/sl.json @@ -170,5 +170,7 @@ "For more information see this FAQ entry.": "For more information see this FAQ entry.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS." + "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones." } diff --git a/i18n/zh.json b/i18n/zh.json index 2e2c7de9..2577b55a 100644 --- a/i18n/zh.json +++ b/i18n/zh.json @@ -161,5 +161,7 @@ "For more information see this FAQ entry.": "For more information see this FAQ entry.", "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.": - "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS." + "Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.", + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.": + "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones." } diff --git a/js/privatebin.js b/js/privatebin.js index b141779b..c990c359 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -789,7 +789,8 @@ jQuery.PrivateBin = (function($, RawDeflate) { utf16To8(message) ); if (mode === 'zlib') { - return z.deflate(message).buffer; + let zlib = (await z); + return zlib.deflate(message).buffer; } return message; } @@ -809,7 +810,12 @@ jQuery.PrivateBin = (function($, RawDeflate) { { if (mode === 'zlib' || mode === 'none') { if (mode === 'zlib') { - data = z.inflate( + let zlib = (await z); + if (typeof zlib === 'undefined') { + Alert.showError('Your browser doesn\'t support WebAssembly, used for zlib compression. You can create uncompressed documents, but can\'t read compressed ones.') + return ''; + } + data = zlib.inflate( new Uint8Array(data) ).buffer; } @@ -883,7 +889,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { stringToArraybuffer( utf16To8(password) ) - ); + ).catch(Alert.showError); password = Array.prototype.map.call( new Uint8Array(passwordBuffer), x => ('00' + x.toString(16)).slice(-2) @@ -903,7 +909,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { {name: 'PBKDF2'}, // we use PBKDF2 for key derivation false, // the key may not be exported ['deriveKey'] // we may only use it for key derivation - ); + ).catch(Alert.showError); // derive a stronger key for use with AES return window.crypto.subtle.deriveKey( @@ -920,7 +926,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { }, false, // the key may not be exported ['encrypt', 'decrypt'] // we may only use it for en- and decryption - ); + ).catch(Alert.showError); } /** @@ -959,16 +965,21 @@ jQuery.PrivateBin = (function($, RawDeflate) { { // AES in Galois Counter Mode, keysize 256 bit, // authentication tag 128 bit, 10000 iterations in key derivation - const spec = [ - getRandomBytes(16), // initialization vector - getRandomBytes(8), // salt - 100000, // iterations - 256, // key size - 128, // tag size - 'aes', // algorithm - 'gcm', // algorithm mode - $('body').data('compression') || 'zlib' // compression - ], encodedSpec = []; + const compression = ( + typeof (await z) === 'undefined' ? + 'none' : // client lacks support for WASM + $('body').data('compression') || 'zlib' + ), + spec = [ + getRandomBytes(16), // initialization vector + getRandomBytes(8), // salt + 100000, // iterations + 256, // key size + 128, // tag size + 'aes', // algorithm + 'gcm', // algorithm mode + compression // compression + ], encodedSpec = []; for (let i = 0; i < spec.length; ++i) { encodedSpec[i] = i < 2 ? btoa(spec[i]) : spec[i]; } @@ -987,8 +998,8 @@ jQuery.PrivateBin = (function($, RawDeflate) { await window.crypto.subtle.encrypt( cryptoSettings(JSON.stringify(adata), spec), await deriveKey(key, password, spec), - await compress(message, spec[7]) - ) + await compress(message, compression) + ).catch(Alert.showError) ) ), adata @@ -1043,7 +1054,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { stringToArraybuffer( atob(cipherMessage) ) - ), + ).catch(Alert.showError), spec[7] ); } catch(err) { @@ -1194,7 +1205,6 @@ jQuery.PrivateBin = (function($, RawDeflate) { me.getPasteId = function() { const idRegEx = /^[a-z0-9]{16}$/; - const idRegExFind = /[a-z0-9]{16}/; // return cached value if (id !== null) { @@ -1573,6 +1583,22 @@ jQuery.PrivateBin = (function($, RawDeflate) { handleNotification(1, $statusMessage, message, icon); }; + /** + * display a warning message + * + * This automatically passes the text to I18n for translation. + * + * @name Alert.showWarning + * @function + * @param {string|array} message string, use an array for %s/%d options + * @param {string|null} icon optional, the icon to show, default: + * leave previous icon + */ + me.showWarning = function(message, icon) + { + handleNotification(2, $errorMessage, message, icon); + }; + /** * display an error message * @@ -1699,7 +1725,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { currentIcon = [ 'glyphicon-time', // loading icon 'glyphicon-info-sign', // status icon - '', // reserved for warning, not used yet + 'glyphicon-warning-sign', // warning icon 'glyphicon-alert' // error icon ]; }; @@ -1768,14 +1794,14 @@ jQuery.PrivateBin = (function($, RawDeflate) { return; } } - Alert.showError( - I18n._('Cannot parse response from URL shortener.') - ); + Alert.showError('Cannot parse response from URL shortener.'); } }) .fail(function(data, textStatus, errorThrown) { console.error(textStatus, errorThrown); - // we don't know why it failed, could be CORS of the external server not setup properly, in which case we follow old behavior to open it in new tab + // we don't know why it failed, could be CORS of the external + // server not setup properly, in which case we follow old + // behavior to open it in new tab window.open( `${$shortenButton.data('shortener')}${encodeURIComponent($pasteUrl.attr('href'))}`, '_blank', @@ -2731,9 +2757,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { // revert loading status… me.hideAttachment(); me.hideAttachmentPreview(); - Alert.showError( - I18n._('Your browser does not support uploading encrypted files. Please use a newer browser.') - ); + Alert.showWarning('Your browser does not support uploading encrypted files. Please use a newer browser.'); return; } @@ -4194,8 +4218,6 @@ jQuery.PrivateBin = (function($, RawDeflate) { const PasteEncrypter = (function () { const me = {}; - let requirementsChecked = false; - /** * called after successful paste upload * @@ -4428,16 +4450,13 @@ jQuery.PrivateBin = (function($, RawDeflate) { }); cipherMessage['attachment'] = await fileReading; } else { - Alert.showError( - I18n._('Cannot process attachment data.') - ); - throw new TypeError('Cannot process attachment data.'); + const error = 'Cannot process attachment data.'; + Alert.showError(error); + throw new TypeError(error); } } catch (error) { console.error(error); - Alert.showError( - I18n._('Cannot retrieve attachment.') - ); + Alert.showError('Cannot retrieve attachment.'); throw error; } } @@ -4528,8 +4547,6 @@ jQuery.PrivateBin = (function($, RawDeflate) { } } - let format = '', - text = ''; if (paste.v > 1) { // version 2 paste const pasteMessage = JSON.parse(pastePlain); @@ -4630,9 +4647,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { // log detailed error, but display generic translation console.error(message); - Alert.showError( - I18n._('Could not decrypt data. Did you enter a wrong password? Retry with the button at the top.') - ); + Alert.showError('Could not decrypt data. Did you enter a wrong password? Retry with the button at the top.'); // reset password, so it can be re-entered Prompt.reset(); @@ -4702,8 +4717,6 @@ jQuery.PrivateBin = (function($, RawDeflate) { * initial (security) check * * @name InitialCheck - * @param {object} window - * @param {object} document * @class */ const InitialCheck = (function () { @@ -4848,6 +4861,9 @@ jQuery.PrivateBin = (function($, RawDeflate) { $('#httpnotice').removeClass('hidden'); } + z = zlib.catch(function () { + Alert.showWarning('Your browser doesn\'t support WebAssembly, used for zlib compression. You can create uncompressed documents, but can\'t read compressed ones.'); + }); return true; } @@ -4926,9 +4942,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { // missing decryption key (or paste ID) in URL? if (window.location.hash.length === 0) { - Alert.showError( - I18n._('Cannot decrypt paste: Decryption key missing in URL (Did you use a redirector or an URL shortener which strips part of the URL?)') - ); + Alert.showError('Cannot decrypt paste: Decryption key missing in URL (Did you use a redirector or an URL shortener which strips part of the URL?)'); return; } } @@ -5054,7 +5068,6 @@ jQuery.PrivateBin = (function($, RawDeflate) { Prompt.init(); TopNav.init(); UiHelper.init(); - z = (await zlib); if (!InitialCheck.init()) { // something major is wrong, stop right away return; diff --git a/js/test/CryptTool.js b/js/test/CryptTool.js index 80ea5ecb..9589ef97 100644 --- a/js/test/CryptTool.js +++ b/js/test/CryptTool.js @@ -8,6 +8,9 @@ describe('CryptTool', function () { await new Promise(resolve => setTimeout(resolve, 1900)); }); + // ensure zlib is getting loaded + $.PrivateBin.InitialCheck.init(); + this.timeout(30000); it('can en- and decrypt any message', function () { jsc.assert(jsc.forall( diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index 2d07fe22..caf4bb5f 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -71,7 +71,7 @@ if ($MARKDOWN): endif; ?> - + diff --git a/tpl/page.php b/tpl/page.php index eec66ae7..9b33be46 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -49,7 +49,7 @@ if ($MARKDOWN): endif; ?> - + From a6aef109ccf90ef37249c5c121dfc3a8f0fa1210 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Tue, 27 Aug 2019 23:16:06 +0200 Subject: [PATCH 02/24] making feature detection work as intended in chrome --- js/privatebin.js | 18 ++++++++++++++---- js/test/Alert.js | 18 +++++++++--------- js/test/InitialCheck.js | 16 +++++----------- tpl/bootstrap.php | 2 +- tpl/page.php | 2 +- 5 files changed, 30 insertions(+), 26 deletions(-) diff --git a/js/privatebin.js b/js/privatebin.js index c990c359..6b16e7f8 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -566,10 +566,10 @@ jQuery.PrivateBin = (function($, RawDeflate) { // if $element is given, apply text to element if ($element !== null) { - // get last text node of element + // set the last text node of element let content = $element.contents(); if (content.length > 1) { - content[content.length - 1].nodeValue = ' ' + output; + $element.html(' ' + output).prepend(content[0]); } else { $element.text(output); } @@ -4803,11 +4803,21 @@ jQuery.PrivateBin = (function($, RawDeflate) { */ function isOldBrowser() { // webcrypto support - if (typeof window.crypto !== 'object') { + if (!( + 'crypto' in window && + 'getRandomValues' in window.crypto && + 'subtle' in window.crypto && + 'encrypt' in window.crypto.subtle && + 'decrypt' in window.crypto.subtle && + 'Uint32Array' in window + )) { return true; } - if (typeof WebAssembly !== 'object' && typeof WebAssembly.instantiate !== 'function') { + if (!( + 'WebAssembly' in window && + 'instantiate' in window.WebAssembly + )) { return true; } try { diff --git a/js/test/Alert.js b/js/test/Alert.js index dfaf3535..9d009556 100644 --- a/js/test/Alert.js +++ b/js/test/Alert.js @@ -10,7 +10,7 @@ describe('Alert', function () { function (icon, message) { icon = icon.join(''); message = message.join(''); - var expected = ''; @@ -21,7 +21,7 @@ describe('Alert', function () { ); $.PrivateBin.Alert.init(); $.PrivateBin.Alert.showStatus(message, icon); - var result = $('body').html(); + const result = $('body').html(); return expected === result; } ); @@ -39,7 +39,7 @@ describe('Alert', function () { function (icon, message) { icon = icon.join(''); message = message.join(''); - var expected = ''; @@ -50,7 +50,7 @@ describe('Alert', function () { ); $.PrivateBin.Alert.init(); $.PrivateBin.Alert.showError(message, icon); - var result = $('body').html(); + const result = $('body').html(); return expected === result; } ); @@ -69,7 +69,7 @@ describe('Alert', function () { function (message, string, number) { message = message.join(''); string = string.join(''); - var expected = ''; @@ -80,7 +80,7 @@ describe('Alert', function () { ); $.PrivateBin.Alert.init(); $.PrivateBin.Alert.showRemaining(['%s' + message + '%d', string, number]); - var result = $('body').html(); + const result = $('body').html(); return expected === result; } ); @@ -98,7 +98,7 @@ describe('Alert', function () { function (message, icon) { message = message.join(''); icon = icon.join(''); - var defaultMessage = 'Loading…'; + const defaultMessage = 'Loading…'; if (message.length === 0) { message = defaultMessage; } @@ -114,7 +114,7 @@ describe('Alert', function () { ); $.PrivateBin.Alert.init(); $.PrivateBin.Alert.showLoading(message, icon); - var result = $('body').html(); + const result = $('body').html(); return expected === result; } ); @@ -182,7 +182,7 @@ describe('Alert', function () { jsc.array(common.jscAlnumString()), function (trigger, message) { message = message.join(''); - var handlerCalled = false, + let handlerCalled = false, defaultMessage = 'Loading…', functions = [ $.PrivateBin.Alert.showStatus, diff --git a/js/test/InitialCheck.js b/js/test/InitialCheck.js index 5b0778cc..50c6dfb5 100644 --- a/js/test/InitialCheck.js +++ b/js/test/InitialCheck.js @@ -22,7 +22,6 @@ describe('InitialCheck', function () { '' ); $.PrivateBin.Alert.init(); - window.crypto = null; const result1 = !$.PrivateBin.InitialCheck.init(), result2 = !$('#errormessage').hasClass('hidden'); clean(); @@ -61,24 +60,19 @@ describe('InitialCheck', function () { jsc.property( 'shows error, if HTTP only site is detected', 'bool', - jsc.elements(['localhost', '127.0.0.1', '[::1]', '']), jsc.nearray(common.jscA2zString()), - jsc.elements(['.onion', '.i2p', '']), - function (secureProtocol, localhost, domain, tld) { - const isDomain = localhost === '', - isSecureContext = secureProtocol || !isDomain || tld.length > 0, - clean = jsdom('', { - 'url': (secureProtocol ? 'https' : 'http' ) + '://' + - (isDomain ? domain.join('') + tld : localhost) + '/' + function (secureProtocol, domain) { + const clean = jsdom('', { + 'url': (secureProtocol ? 'https' : 'http' ) + '://' + domain.join('') + '/' }); $('body').html( ''+ '' ); $.PrivateBin.Alert.init(); - window.crypto = null; + window.crypto = new WebCrypto(); const result1 = $.PrivateBin.InitialCheck.init(), - result2 = isSecureContext === $('#httpnotice').hasClass('hidden'); + result2 = secureProtocol === $('#httpnotice').hasClass('hidden'); clean(); return result1 && result2; } diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index caf4bb5f..07e86d96 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -71,7 +71,7 @@ if ($MARKDOWN): endif; ?> - + diff --git a/tpl/page.php b/tpl/page.php index 9b33be46..51f46612 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -49,7 +49,7 @@ if ($MARKDOWN): endif; ?> - + From ad570c391a506b460d5c441696ae04ba11721656 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Wed, 28 Aug 2019 19:23:58 +0200 Subject: [PATCH 03/24] extend Alert class unit testing --- js/test/Alert.js | 134 +++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 129 insertions(+), 5 deletions(-) diff --git a/js/test/Alert.js b/js/test/Alert.js index 9d009556..8e3787d3 100644 --- a/js/test/Alert.js +++ b/js/test/Alert.js @@ -4,7 +4,25 @@ var common = require('../common'); describe('Alert', function () { describe('showStatus', function () { jsc.property( - 'shows a status message', + 'shows a status message (basic)', + jsc.array(common.jscAlnumString()), + jsc.array(common.jscAlnumString()), + function (icon, message) { + icon = icon.join(''); + message = message.join(''); + const expected = '
' + message + '
'; + $('body').html( + '
' + ); + $.PrivateBin.Alert.init(); + $.PrivateBin.Alert.showStatus(message, icon); + const result = $('body').html(); + return expected === result; + } + ); + + jsc.property( + 'shows a status message (bootstrap)', jsc.array(common.jscAlnumString()), jsc.array(common.jscAlnumString()), function (icon, message) { @@ -33,7 +51,25 @@ describe('Alert', function () { }); jsc.property( - 'shows an error message', + 'shows an error message (basic)', + jsc.array(common.jscAlnumString()), + jsc.array(common.jscAlnumString()), + function (icon, message) { + icon = icon.join(''); + message = message.join(''); + const expected = '
' + message + '
'; + $('body').html( + '
' + ); + $.PrivateBin.Alert.init(); + $.PrivateBin.Alert.showError(message, icon); + const result = $('body').html(); + return expected === result; + } + ); + + jsc.property( + 'shows an error message (bootstrap)', jsc.array(common.jscAlnumString()), jsc.array(common.jscAlnumString()), function (icon, message) { @@ -56,13 +92,79 @@ describe('Alert', function () { ); }); + describe('showWarning', function () { + before(function () { + cleanup(); + }); + + jsc.property( + 'shows a warning message (basic)', + jsc.array(common.jscAlnumString()), + jsc.array(common.jscAlnumString()), + function (icon, message) { + icon = icon.join(''); + message = message.join(''); + const expected = '
' + message + '
'; + $('body').html( + '
' + ); + $.PrivateBin.Alert.init(); + $.PrivateBin.Alert.showWarning(message, icon); + const result = $('body').html(); + return expected === result; + } + ); + + jsc.property( + 'shows a warning message (bootstrap)', + jsc.array(common.jscAlnumString()), + jsc.array(common.jscAlnumString()), + function (icon, message) { + icon = icon.join(''); + message = message.join(''); + const expected = ''; + $('body').html( + '' + ); + $.PrivateBin.Alert.init(); + $.PrivateBin.Alert.showWarning(message, icon); + const result = $('body').html(); + return expected === result; + } + ); + }); + describe('showRemaining', function () { before(function () { cleanup(); }); jsc.property( - 'shows remaining time', + 'shows remaining time (basic)', + jsc.array(common.jscAlnumString()), + jsc.array(common.jscAlnumString()), + 'integer', + function (message, string, number) { + message = message.join(''); + string = string.join(''); + const expected = '
' + string + message + number + '
'; + $('body').html( + '' + ); + $.PrivateBin.Alert.init(); + $.PrivateBin.Alert.showRemaining(['%s' + message + '%d', string, number]); + const result = $('body').html(); + return expected === result; + } + ); + + jsc.property( + 'shows remaining time (bootstrap)', jsc.array(common.jscAlnumString()), jsc.array(common.jscAlnumString()), 'integer', @@ -92,7 +194,7 @@ describe('Alert', function () { }); jsc.property( - 'shows a loading message', + 'shows a loading message (basic)', jsc.array(common.jscAlnumString()), jsc.array(common.jscAlnumString()), function (message, icon) { @@ -102,7 +204,29 @@ describe('Alert', function () { if (message.length === 0) { message = defaultMessage; } - var expected = '
  • '; + $('body').html( + '' + ); + $.PrivateBin.Alert.init(); + $.PrivateBin.Alert.showLoading(message, icon); + const result = $('body').html(); + return expected === result; + } + ); + + jsc.property( + 'shows a loading message (bootstrap)', + jsc.array(common.jscAlnumString()), + jsc.array(common.jscAlnumString()), + function (message, icon) { + message = message.join(''); + icon = icon.join(''); + const defaultMessage = 'Loading…'; + if (message.length === 0) { + message = defaultMessage; + } + const expected = '
    • ' + message + '
    '; From 7f65fe92188ed03db9d4fe82f494a5cc4f4cc655 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Wed, 28 Aug 2019 19:25:11 +0200 Subject: [PATCH 04/24] fixing conflicting icons when using error message div for warnings in bootstrap template --- js/privatebin.js | 1 + tpl/bootstrap.php | 2 +- tpl/page.php | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/js/privatebin.js b/js/privatebin.js index 6b16e7f8..c7d638d9 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -1596,6 +1596,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { */ me.showWarning = function(message, icon) { + $errorMessage.find(':first').removeClass(currentIcon[3]); handleNotification(2, $errorMessage, message, icon); }; diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index 07e86d96..af9a3e29 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -71,7 +71,7 @@ if ($MARKDOWN): endif; ?> - + diff --git a/tpl/page.php b/tpl/page.php index 51f46612..afd58b30 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -49,7 +49,7 @@ if ($MARKDOWN): endif; ?> - + From c56d777c11efa70c6468092b6e6193fe037db8e9 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Wed, 28 Aug 2019 20:29:23 +0200 Subject: [PATCH 05/24] fixing logic when there are no icons and warning icons, add more test cases --- js/privatebin.js | 45 ++++++++----- js/test/Alert.js | 167 ++++++++++++++++++++++++++++++++-------------- tpl/bootstrap.php | 2 +- tpl/page.php | 2 +- 4 files changed, 145 insertions(+), 71 deletions(-) diff --git a/js/privatebin.js b/js/privatebin.js index c7d638d9..acaaf65c 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -1493,7 +1493,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { const alertType = [ 'loading', // not in bootstrap CSS, but using a plausible value here 'info', // status icon - 'warning', // not used yet + 'warning', // warning icon 'danger' // error icon ]; @@ -1537,28 +1537,35 @@ jQuery.PrivateBin = (function($, RawDeflate) { icon = null; // icons not supported in this case } } + let $translationTarget = $element; - // handle icon - if (icon !== null && // icon was passed - icon !== currentIcon[id] // and it differs from current icon - ) { - let $glyphIcon = $element.find(':first'); + // handle icon, if template uses one + const $glyphIcon = $element.find(':first'); + if ($glyphIcon.length) { + // if there is an icon, we need to provide an inner element + // to translate the message into, instead of the parent + $translationTarget = $(''); + $element.html(' ').prepend($glyphIcon).append($translationTarget); - // remove (previous) icon - $glyphIcon.removeClass(currentIcon[id]); + if (icon !== null && // icon was passed + icon !== currentIcon[id] // and it differs from current icon + ) { + // remove (previous) icon + $glyphIcon.removeClass(currentIcon[id]); - // any other thing as a string (e.g. 'null') (only) removes the icon - if (typeof icon === 'string') { - // set new icon - currentIcon[id] = 'glyphicon-' + icon; - $glyphIcon.addClass(currentIcon[id]); + // any other thing as a string (e.g. 'null') (only) removes the icon + if (typeof icon === 'string') { + // set new icon + currentIcon[id] = 'glyphicon-' + icon; + $glyphIcon.addClass(currentIcon[id]); + } } } // show text if (args !== null) { // add jQuery object to it as first parameter - args.unshift($element); + args.unshift($translationTarget); // pass it to I18n I18n._.apply(this, args); } @@ -1596,7 +1603,9 @@ jQuery.PrivateBin = (function($, RawDeflate) { */ me.showWarning = function(message, icon) { - $errorMessage.find(':first').removeClass(currentIcon[3]); + $errorMessage.find(':first') + .removeClass(currentIcon[3]) + .addClass(currentIcon[2]); handleNotification(2, $errorMessage, message, icon); }; @@ -2990,11 +2999,11 @@ jQuery.PrivateBin = (function($, RawDeflate) { me.init = function() { $attachment = $('#attachment'); - if($attachment.length){ + $dragAndDropFileName = $('#dragAndDropFileName'); + $dropzone = $('#dropzone'); + if($attachment.length) { $attachmentLink = $('#attachment a'); $attachmentPreview = $('#attachmentPreview'); - $dragAndDropFileName = $('#dragAndDropFileName'); - $dropzone = $('#dropzone'); $fileInput = $('#file'); addDragDropHandler(); diff --git a/js/test/Alert.js b/js/test/Alert.js index 8e3787d3..d59f38c1 100644 --- a/js/test/Alert.js +++ b/js/test/Alert.js @@ -24,6 +24,27 @@ describe('Alert', function () { jsc.property( 'shows a status message (bootstrap)', jsc.array(common.jscAlnumString()), + function (message) { + message = message.join(''); + const expected = ''; + $('body').html( + '' + ); + $.PrivateBin.Alert.init(); + $.PrivateBin.Alert.showStatus(message); + const result = $('body').html(); + return expected === result; + } + ); + + jsc.property( + 'shows a status message (bootstrap, custom icon)', + jsc.array(common.jscAlnumString()), jsc.array(common.jscAlnumString()), function (icon, message) { icon = icon.join(''); @@ -31,7 +52,7 @@ describe('Alert', function () { const expected = ''; + '" aria-hidden="true"> ' + message + ''; $('body').html( ''; + $('body').html( + '
    ' + ); + $.PrivateBin.Alert.init(); + $.PrivateBin.Alert.showWarning(message, icon); + const result = $('body').html(); + return expected === result; + } + ); + + jsc.property( + 'shows a warning message (bootstrap)', + jsc.array(common.jscAlnumString()), + jsc.array(common.jscAlnumString()), + function (message) { + message = message.join(''); + const expected = ''; + $('body').html( + '' + ); + $.PrivateBin.Alert.init(); + $.PrivateBin.Alert.showWarning(message); + const result = $('body').html(); + return expected === result; + } + ); + + jsc.property( + 'shows a warning message (bootstrap, custom icon)', + jsc.array(common.jscAlnumString()), + jsc.array(common.jscAlnumString()), + function (icon, message) { + icon = icon.join(''); + message = message.join(''); + const expected = ''; + $('body').html( + '' + ); + $.PrivateBin.Alert.init(); + $.PrivateBin.Alert.showWarning(message, icon); + const result = $('body').html(); + return expected === result; + } + ); + }); + describe('showError', function () { before(function () { cleanup(); @@ -72,13 +162,35 @@ describe('Alert', function () { 'shows an error message (bootstrap)', jsc.array(common.jscAlnumString()), jsc.array(common.jscAlnumString()), + function (icon, message) { + message = message.join(''); + const expected = ''; + $('body').html( + '' + ); + $.PrivateBin.Alert.init(); + $.PrivateBin.Alert.showError(message); + const result = $('body').html(); + return expected === result; + } + ); + + jsc.property( + 'shows an error message (bootstrap, custom icon)', + jsc.array(common.jscAlnumString()), + jsc.array(common.jscAlnumString()), function (icon, message) { icon = icon.join(''); message = message.join(''); const expected = ''; + '" aria-hidden="true"> ' + message + ''; $('body').html( ''; - $('body').html( - '
    ' - ); - $.PrivateBin.Alert.init(); - $.PrivateBin.Alert.showWarning(message, icon); - const result = $('body').html(); - return expected === result; - } - ); - - jsc.property( - 'shows a warning message (bootstrap)', - jsc.array(common.jscAlnumString()), - jsc.array(common.jscAlnumString()), - function (icon, message) { - icon = icon.join(''); - message = message.join(''); - const expected = ''; - $('body').html( - '' - ); - $.PrivateBin.Alert.init(); - $.PrivateBin.Alert.showWarning(message, icon); - const result = $('body').html(); - return expected === result; - } - ); - }); - describe('showRemaining', function () { before(function () { cleanup(); @@ -174,7 +239,7 @@ describe('Alert', function () { const expected = ''; + ' ' + string + message + number + ''; $('body').html( '
  • ' + message + '
'; + '" aria-hidden="true"> ' + message + ''; $('body').html( '
  • - + diff --git a/tpl/page.php b/tpl/page.php index afd58b30..aab3124c 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -49,7 +49,7 @@ if ($MARKDOWN): endif; ?> - + From 50881a75e60d334a5105f6596202a7ed1c6372ea Mon Sep 17 00:00:00 2001 From: El RIDO Date: Wed, 28 Aug 2019 20:36:26 +0200 Subject: [PATCH 06/24] ensure bots are prohibited completely from indexing --- robots.txt | 1 - 1 file changed, 1 deletion(-) diff --git a/robots.txt b/robots.txt index a1537be1..7aa8150f 100644 --- a/robots.txt +++ b/robots.txt @@ -5,5 +5,4 @@ # directory. User-agent: * -Allow: /index.php Disallow: / From 813e72d871e2d4919b5c6e26ad788279d94ae944 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Wed, 28 Aug 2019 20:37:14 +0200 Subject: [PATCH 07/24] don't encode HTML entities in translations if they contain links --- js/privatebin.js | 9 ++++----- tpl/bootstrap.php | 2 +- tpl/page.php | 2 +- 3 files changed, 6 insertions(+), 7 deletions(-) diff --git a/js/privatebin.js b/js/privatebin.js index acaaf65c..0398dbdc 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -566,12 +566,11 @@ jQuery.PrivateBin = (function($, RawDeflate) { // if $element is given, apply text to element if ($element !== null) { - // set the last text node of element - let content = $element.contents(); - if (content.length > 1) { - $element.html(' ' + output).prepend(content[0]); - } else { + // avoid HTML entity encoding if translation contains link + if (output.indexOf(' - + diff --git a/tpl/page.php b/tpl/page.php index aab3124c..c6560d2c 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -49,7 +49,7 @@ if ($MARKDOWN): endif; ?> - + From 5471757fa7a59e69281455cf96595938de31c8e4 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Sun, 8 Sep 2019 08:21:54 +0200 Subject: [PATCH 08/24] making webassembly optional, ensuring retry button works when wrong password is provided Tested configurations: - browser with WASM support (Firefox 68.0.2) - creates paste with zlib compression, no password - creates paste with zlib compression, with password - reads paste with zlib compression, no password - reads paste with zlib compression, with password + retry button works - reads paste without compression, no password - reads paste without compression, with password + retry button works - browser without WASM support (Chromium 76.0.3809.100, started via `chromium-browser --js-flags=--noexpose_wasm`) - creates paste without compression, no password, but shows WASM warning - creates paste without compression, with password, but shows WASM warning - fails to read paste with zlib compression, no password + shows WASM error - fails to read paste with zlib compression, with password + shows WASM error - reads paste without compression, no password - reads paste without compression, with password + retry button works --- js/privatebin.js | 115 ++++++++++++++++++------------------------- js/test/CryptTool.js | 11 +++-- tpl/bootstrap.php | 2 +- tpl/page.php | 2 +- 4 files changed, 56 insertions(+), 74 deletions(-) diff --git a/js/privatebin.js b/js/privatebin.js index 0398dbdc..412e31f4 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -780,15 +780,19 @@ jQuery.PrivateBin = (function($, RawDeflate) { * @private * @param {string} message * @param {string} mode + * @param {object} zlib + * @throws {string} * @return {ArrayBuffer} data */ - async function compress(message, mode) + async function compress(message, mode, zlib) { message = stringToArraybuffer( utf16To8(message) ); if (mode === 'zlib') { - let zlib = (await z); + if (typeof zlib === 'undefined') { + throw 'Error compressing paste, due to missing WebAssembly support.' + } return zlib.deflate(message).buffer; } return message; @@ -803,16 +807,16 @@ jQuery.PrivateBin = (function($, RawDeflate) { * @private * @param {ArrayBuffer} data * @param {string} mode + * @param {object} zlib + * @throws {string} * @return {string} message */ - async function decompress(data, mode) + async function decompress(data, mode, zlib) { if (mode === 'zlib' || mode === 'none') { if (mode === 'zlib') { - let zlib = (await z); if (typeof zlib === 'undefined') { - Alert.showError('Your browser doesn\'t support WebAssembly, used for zlib compression. You can create uncompressed documents, but can\'t read compressed ones.') - return ''; + throw 'Error decompressing paste, due to missing WebAssembly support.' } data = zlib.inflate( new Uint8Array(data) @@ -962,12 +966,13 @@ jQuery.PrivateBin = (function($, RawDeflate) { */ me.cipher = async function(key, password, message, adata) { + let zlib = (await z); // AES in Galois Counter Mode, keysize 256 bit, // authentication tag 128 bit, 10000 iterations in key derivation const compression = ( - typeof (await z) === 'undefined' ? + typeof zlib === 'undefined' ? 'none' : // client lacks support for WASM - $('body').data('compression') || 'zlib' + ($('body').data('compression') || 'zlib') ), spec = [ getRandomBytes(16), // initialization vector @@ -997,7 +1002,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { await window.crypto.subtle.encrypt( cryptoSettings(JSON.stringify(adata), spec), await deriveKey(key, password, spec), - await compress(message, compression) + await compress(message, compression, zlib) ).catch(Alert.showError) ) ), @@ -1018,7 +1023,8 @@ jQuery.PrivateBin = (function($, RawDeflate) { */ me.decipher = async function(key, password, data) { - let adataString, spec, cipherMessage; + let adataString, spec, cipherMessage, plaintext; + let zlib = (await z); if (data instanceof Array) { // version 2 adataString = JSON.stringify(data[1]); @@ -1045,20 +1051,29 @@ jQuery.PrivateBin = (function($, RawDeflate) { } spec[0] = atob(spec[0]); spec[1] = atob(spec[1]); + if (spec[7] === 'zlib') { + if (typeof zlib === 'undefined') { + throw 'Error decompressing paste, due to missing WebAssembly support.' + } + } try { - return await decompress( - await window.crypto.subtle.decrypt( - cryptoSettings(adataString, spec), - await deriveKey(key, password, spec), - stringToArraybuffer( - atob(cipherMessage) - ) - ).catch(Alert.showError), - spec[7] + plaintext = await window.crypto.subtle.decrypt( + cryptoSettings(adataString, spec), + await deriveKey(key, password, spec), + stringToArraybuffer( + atob(cipherMessage) + ) ); } catch(err) { + console.error(err); return ''; } + try { + return await decompress(plaintext, spec[7], zlib); + } catch(err) { + Alert.showError(err); + return err; + } }; /** @@ -4522,7 +4537,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { // if all tries failed, we can only return an error if (plaindata.length === 0) { - throw 'failed to decipher data'; + return false; } return plaindata; @@ -4551,8 +4566,11 @@ jQuery.PrivateBin = (function($, RawDeflate) { if (password.length === 0) { throw 'waiting on user to provide a password'; } else { - displayDecryptionError('failed to decipher paste text: Incorrect password?'); - throw 'waiting on user to provide correct password'; + Alert.hideLoading(); + // reset password, so it can be re-entered + Prompt.reset(); + TopNav.showRetryButton(); + throw 'Could not decrypt data. Did you enter a wrong password? Retry with the button at the top.'; } } @@ -4642,27 +4660,6 @@ jQuery.PrivateBin = (function($, RawDeflate) { }); } - /** - * displays and logs decryption errors - * - * @name PasteDecrypter.displayDecryptionError - * @private - * @function - * @param {string} message - */ - function displayDecryptionError(message) - { - Alert.hideLoading(); - - // log detailed error, but display generic translation - console.error(message); - Alert.showError('Could not decrypt data. Did you enter a wrong password? Retry with the button at the top.'); - - // reset password, so it can be re-entered - Prompt.reset(); - TopNav.showRetryButton(); - } - /** * show decrypted text in the display area, including discussion (if open) * @@ -4714,7 +4711,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { .catch((err) => { // wait for the user to type in the password, // then PasteDecrypter.run will be called again - console.error(err); + Alert.showError(err); }); }; @@ -4818,34 +4815,14 @@ jQuery.PrivateBin = (function($, RawDeflate) { 'subtle' in window.crypto && 'encrypt' in window.crypto.subtle && 'decrypt' in window.crypto.subtle && + 'Uint8Array' in window && 'Uint32Array' in window )) { return true; } - if (!( - 'WebAssembly' in window && - 'instantiate' in window.WebAssembly - )) { - return true; - } - try { - // [\0, 'a', 's', 'm', (uint_32) 1] - smallest valid wasm module - const module = new WebAssembly.Module(Uint8Array.of(0x0, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00)); - if ( - !( - module instanceof WebAssembly.Module && - new WebAssembly.Instance(module) instanceof WebAssembly.Instance - ) - ) { - return true; - } - } catch (e) { - return true; - } - - // not checking for async/await, ES6, Promise or Uint8Array support, - // as most browsers introduced these earlier then webassembly and webcrypto: + // not checking for async/await, ES6 or Promise support, as most + // browsers introduced these earlier then webassembly and webcrypto: // https://github.com/PrivateBin/PrivateBin/pull/431#issuecomment-493129359 return false; @@ -4881,7 +4858,9 @@ jQuery.PrivateBin = (function($, RawDeflate) { } z = zlib.catch(function () { - Alert.showWarning('Your browser doesn\'t support WebAssembly, used for zlib compression. You can create uncompressed documents, but can\'t read compressed ones.'); + if ($('body').data('compression') !== 'none') { + Alert.showWarning('Your browser doesn\'t support WebAssembly, used for zlib compression. You can create uncompressed documents, but can\'t read compressed ones.'); + } }); return true; } diff --git a/js/test/CryptTool.js b/js/test/CryptTool.js index 9589ef97..b3aaaa59 100644 --- a/js/test/CryptTool.js +++ b/js/test/CryptTool.js @@ -8,9 +8,6 @@ describe('CryptTool', function () { await new Promise(resolve => setTimeout(resolve, 1900)); }); - // ensure zlib is getting loaded - $.PrivateBin.InitialCheck.init(); - this.timeout(30000); it('can en- and decrypt any message', function () { jsc.assert(jsc.forall( @@ -21,13 +18,15 @@ describe('CryptTool', function () { // pause to let async functions conclude await new Promise(resolve => setTimeout(resolve, 300)); let clean = jsdom(); + // ensure zlib is getting loaded + $.PrivateBin.InitialCheck.init(); window.crypto = new WebCrypto(); message = message.trim(); let cipherMessage = await $.PrivateBin.CryptTool.cipher( key, password, message, [] ), plaintext = await $.PrivateBin.CryptTool.decipher( - key, password, cipherMessage + key, password, cipherMessage ); clean(); return message === plaintext; @@ -182,6 +181,8 @@ describe('CryptTool', function () { let message = fs.readFileSync('test/compression-sample.txt', 'utf8'), clean = jsdom(); window.crypto = new WebCrypto(); + // ensure zlib is getting loaded + $.PrivateBin.InitialCheck.init(); let cipherMessage = await $.PrivateBin.CryptTool.cipher( 'foo', 'bar', message, [] ), @@ -225,6 +226,8 @@ isWhile : interp (while expr sBody) (MemElem mem) = conseq_or_bottom inv (interp (nth_iterate sBody n) (MemElem mem)) `; let clean = jsdom(); + // ensure zlib is getting loaded + $.PrivateBin.InitialCheck.init(); window.crypto = new WebCrypto(); let cipherMessage = await $.PrivateBin.CryptTool.cipher( key, password, message, [] diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index c7f78684..45de8a8a 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -71,7 +71,7 @@ if ($MARKDOWN): endif; ?> - + diff --git a/tpl/page.php b/tpl/page.php index c6560d2c..c93423d4 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -49,7 +49,7 @@ if ($MARKDOWN): endif; ?> - + From b1c9ca65fa31440cba8268e560521e6aea306612 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Sun, 8 Sep 2019 08:39:28 +0200 Subject: [PATCH 09/24] trying to address eslint false positives --- .eslintrc | 1 + js/privatebin.js | 13 ++----------- tpl/bootstrap.php | 2 +- tpl/page.php | 2 +- 4 files changed, 5 insertions(+), 13 deletions(-) diff --git a/.eslintrc b/.eslintrc index 1c90b8e6..41a4e005 100644 --- a/.eslintrc +++ b/.eslintrc @@ -22,6 +22,7 @@ globals: jsc: false jsdom: true kjua: true + WebCrypto: true # http://eslint.org/docs/rules/ rules: diff --git a/js/privatebin.js b/js/privatebin.js index 412e31f4..cdfce541 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -9,19 +9,10 @@ * @version 1.3 * @name PrivateBin * @namespace + * + * global Base64, DOMPurify, FileReader, RawDeflate, history, navigator, prettyPrint, prettyPrintOne, showdown, kjua */ -/** global: Base64 */ -/** global: DOMPurify */ -/** global: FileReader */ -/** global: RawDeflate */ -/** global: history */ -/** global: navigator */ -/** global: prettyPrint */ -/** global: prettyPrintOne */ -/** global: showdown */ -/** global: kjua */ - jQuery.fn.draghover = function() { return this.each(function() { let collection = $(), diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index 45de8a8a..338cf406 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -71,7 +71,7 @@ if ($MARKDOWN): endif; ?> - + diff --git a/tpl/page.php b/tpl/page.php index c93423d4..567f4bbd 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -49,7 +49,7 @@ if ($MARKDOWN): endif; ?> - + From 7b029d3657fd7aadc09260b6f8b86358bad420ca Mon Sep 17 00:00:00 2001 From: El RIDO Date: Sun, 8 Sep 2019 08:55:19 +0200 Subject: [PATCH 10/24] trying to convince codacy about the eslint changes --- .eslintrc | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/.eslintrc b/.eslintrc index 41a4e005..afeb6c0c 100644 --- a/.eslintrc +++ b/.eslintrc @@ -1,3 +1,4 @@ +--- parserOptions: ecmaVersion: 2017 @@ -13,16 +14,16 @@ env: node: true globals: - DOMPurify: false - after: true - before: true - cleanup: true - describe: false - it: false - jsc: false - jsdom: true - kjua: true - WebCrypto: true + DOMPurify: readonly + after: writable + before: writable + cleanup: writable + describe: readonly + it: readonly + jsc: readonly + jsdom: writable + kjua: writable + WebCrypto: readonly # http://eslint.org/docs/rules/ rules: From ae11d168ced21edf16e735e53db76150a70e4ac9 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Sun, 8 Sep 2019 09:02:15 +0200 Subject: [PATCH 11/24] trying to convince codacy about the eslint changes --- .eslintrc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.eslintrc b/.eslintrc index afeb6c0c..5972d0f7 100644 --- a/.eslintrc +++ b/.eslintrc @@ -16,6 +16,7 @@ env: globals: DOMPurify: readonly after: writable + assert: writable before: writable cleanup: writable describe: readonly @@ -23,7 +24,7 @@ globals: jsc: readonly jsdom: writable kjua: writable - WebCrypto: readonly + WebCrypto: writable # http://eslint.org/docs/rules/ rules: From c2962af4f87e6dada72e78a7ad1fa3db882a0868 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Sun, 8 Sep 2019 09:08:21 +0200 Subject: [PATCH 12/24] trying different approach to convince codacy about false positive --- .eslintrc | 9 +++++---- js/test/InitialCheck.js | 1 + 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.eslintrc b/.eslintrc index 5972d0f7..63cb0c40 100644 --- a/.eslintrc +++ b/.eslintrc @@ -12,15 +12,16 @@ env: es6: true jquery: true node: true + mocha: true globals: DOMPurify: readonly - after: writable - assert: writable - before: writable +# after: writable +# assert: writable +# before: writable cleanup: writable describe: readonly - it: readonly +# it: readonly jsc: readonly jsdom: writable kjua: writable diff --git a/js/test/InitialCheck.js b/js/test/InitialCheck.js index 50c6dfb5..4e181f15 100644 --- a/js/test/InitialCheck.js +++ b/js/test/InitialCheck.js @@ -1,5 +1,6 @@ 'use strict'; var common = require('../common'); +/* global WebCrypto */ describe('InitialCheck', function () { describe('init', function () { From a363b2ff952c9218b6466d782b5751181eb153b0 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Sun, 8 Sep 2019 09:12:56 +0200 Subject: [PATCH 13/24] eslint env cleanup --- .eslintrc | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.eslintrc b/.eslintrc index 63cb0c40..8275c969 100644 --- a/.eslintrc +++ b/.eslintrc @@ -16,12 +16,8 @@ env: globals: DOMPurify: readonly -# after: writable -# assert: writable -# before: writable cleanup: writable describe: readonly -# it: readonly jsc: readonly jsdom: writable kjua: writable From 63426d6f8b1f3be77870407eb29bae13e0537a96 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Sat, 14 Sep 2019 09:41:52 +0200 Subject: [PATCH 14/24] splitting out PrivateBin.InitialCheck class into Legacy.Check and working on making it compatible with IE 11 --- js/common.js | 1 + js/legacy.js | 256 ++++++++++++++++++++++++++ js/privatebin.js | 180 +++--------------- js/test/{InitialCheck.js => Check.js} | 13 +- js/test/CryptTool.js | 6 +- tpl/bootstrap.php | 3 +- tpl/page.php | 3 +- 7 files changed, 299 insertions(+), 163 deletions(-) create mode 100644 js/legacy.js rename js/test/{InitialCheck.js => Check.js} (87%) diff --git a/js/common.js b/js/common.js index a12595d3..ea975e03 100644 --- a/js/common.js +++ b/js/common.js @@ -20,6 +20,7 @@ global.showdown = require('./showdown-1.9.1'); global.DOMPurify = require('./purify-1.0.11'); global.baseX = require('./base-x-3.0.5.1').baseX; require('./bootstrap-3.3.7'); +require('./legacy'); require('./privatebin'); // internal variables diff --git a/js/legacy.js b/js/legacy.js new file mode 100644 index 00000000..82a6bd12 --- /dev/null +++ b/js/legacy.js @@ -0,0 +1,256 @@ +/** + * PrivateBin + * + * a zero-knowledge paste bin + * + * @see {@link https://github.com/PrivateBin/PrivateBin} + * @copyright 2012 Sébastien SAUVAGE ({@link http://sebsauvage.net}) + * @license {@link https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License} + * @version 1.3 + * @name Legacy + * @namespace + * + * IMPORTANT NOTICE FOR DEVELOPERS: + * The logic in this file is intended to run in legacy browsers. Avoid any use of: + * - ES6 or newer in general + * - const/let, use the traditional var declarations instead + * - async/await or Promises, use traditional callbacks + * - shorthand function notation "() => output", use the full "function() {return output;}" style + * - IE doesn't support: + * - URL(), use the traditional window.location object + * - endsWith(), use indexof() + * - yes, this logic needs to support IE 5 or 6, to at least display the error message + */ + +// main application start, called when DOM is fully loaded +jQuery(document).ready(function() { + 'use strict'; + // run main controller + $.Legacy.Check.init(); +}); + +jQuery.Legacy = (function($) { + 'use strict'; + + /** + * compatibility check + * + * @name Check + * @class + */ + var Check = (function () { + var me = {}; + + /** + * Status of the initial check, true means it passed + * + * @private + * @prop {bool} + */ + var status = false; + + /** + * Initialization check did run + * + * @private + * @prop {bool} + */ + var init = false; + + /** + * blacklist of UserAgents (parts) known to belong to a bot + * + * @private + * @enum {Array} + * @readonly + */ + var badBotUA = [ + 'Bot', + 'bot' + ]; + + /** + * whitelist of top level domains to consider a secure context, + * regardless of protocol + * + * @private + * @enum {Array} + * @readonly + */ + var tld = [ + '.onion', + '.i2p' + ]; + + /** + * whitelist of hostnames to consider a secure context, + * regardless of protocol + * + * @private + * @enum {Array} + * @readonly + */ + // whitelists of TLDs & local hostnames + var hostname = [ + 'localhost', + '127.0.0.1', + '[::1]' + ]; + + /** + * check if the context is secure + * + * @private + * @name Check.isSecureContext + * @function + * @return {bool} + */ + function isSecureContext() + { + // use .isSecureContext if available + if (window.isSecureContext === true || window.isSecureContext === false) { + return window.isSecureContext; + } + + // HTTP is obviously insecure + if (window.location.protocol !== 'http:') { + return true; + } + + // filter out actually secure connections over HTTP + for (var i = 0; i < tld.length; i++) { + if ( + window.location.hostname.indexOf( + tld[i], + window.location.hostname.length - tld[i].length + ) !== -1 + ) { + return true; + } + } + + // whitelist localhost for development + for (var i = 0; i < hostname.length; i++) { + if (window.location.hostname === hostname[i]) { + return true; + } + } + + // totally INSECURE http protocol! + return false; + } + + /** + * checks whether this is a bot we dislike + * + * @private + * @name Check.isBadBot + * @function + * @return {bool} + */ + function isBadBot() { + // check whether a bot user agent part can be found in the current + // user agent + for (var i = 0; i < badBotUA.length; i++) { + if (navigator.userAgent.indexOf(badBotUA[i]) !== -1) { + return true; + } + } + return false; + } + + /** + * checks whether this is an unsupported browser, via feature detection + * + * @private + * @name Check.isOldBrowser + * @function + * @return {bool} + */ + function isOldBrowser() { + // webcrypto support + if (!( + 'crypto' in window && + 'getRandomValues' in window.crypto && + 'subtle' in window.crypto && + 'encrypt' in window.crypto.subtle && + 'decrypt' in window.crypto.subtle && + 'Uint8Array' in window && + 'Uint32Array' in window + )) { + return true; + } + + // not checking for async/await, ES6 or Promise support, as most + // browsers introduced these earlier then webassembly and webcrypto: + // https://github.com/PrivateBin/PrivateBin/pull/431#issuecomment-493129359 + + return false; + } + + /** + * returns if the check has concluded + * + * @name Check.getInit + * @function + * @return {bool} + */ + me.getInit = function() + { + return init; + } + + /** + * returns the current status of the check + * + * @name Check.getStatus + * @function + * @return {bool} + */ + me.getStatus = function() + { + return status; + } + + /** + * init on application start, returns an all-clear signal + * + * @name Check.init + * @function + */ + me.init = function() + { + // prevent bots from viewing a paste and potentially deleting data + // when burn-after-reading is set + if (isBadBot()) { + $.PrivateBin.Alert.showError('I love you too, bot…'); + init = true; + return; + } + + if (isOldBrowser()) { + // some browsers (Chrome based ones) would have webcrypto support if using HTTPS + if (!isSecureContext()) { + $.PrivateBin.Alert.showError(['Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.', 'https' + window.location.href.slice(4)]); + } + $('#oldnotice').removeClass('hidden'); + init = true; + return; + } + + if (!isSecureContext()) { + $('#httpnotice').removeClass('hidden'); + } + init = true; + + // only if everything passed, we set the status to true + status = true; + } + + return me; + })(); + + return { + Check: Check + }; +})(jQuery); diff --git a/js/privatebin.js b/js/privatebin.js index cdfce541..1db85ee0 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -14,6 +14,7 @@ */ jQuery.fn.draghover = function() { + 'use strict'; return this.each(function() { let collection = $(), self = $(this); @@ -4709,156 +4710,6 @@ jQuery.PrivateBin = (function($, RawDeflate) { return me; })(); - - /** - * initial (security) check - * - * @name InitialCheck - * @class - */ - const InitialCheck = (function () { - const me = {}; - - /** - * blacklist of UserAgents (parts) known to belong to a bot - * - * @private - * @enum {Array} - * @readonly - */ - const badBotUA = [ - 'Bot', - 'bot' - ]; - - /** - * check if the connection is insecure - * - * @private - * @name InitialCheck.isInsecureConnection - * @function - * @return {bool} - */ - function isInsecureConnection() - { - // use .isSecureContext if available - if (window.isSecureContext === true || window.isSecureContext === false) { - return !window.isSecureContext; - } - - const url = new URL(window.location); - - // HTTP is obviously insecure - if (url.protocol !== 'http:') { - return false; - } - - // filter out actually secure connections over HTTP - for (const tld of ['.onion', '.i2p']) { - if (url.hostname.endsWith(tld)) { - return false; - } - } - - // whitelist localhost for development - for (const hostname of ['localhost', '127.0.0.1', '[::1]']) { - if (url.hostname === hostname) { - return false; - } - } - - // totally INSECURE http protocol! - return true; - } - - /** - * checks whether this is a bot we dislike - * - * @private - * @name InitialCheck.isBadBot - * @function - * @return {bool} - */ - function isBadBot() { - // check whether a bot user agent part can be found in the current - // user agent - for (const UAfragment of badBotUA) { - if (navigator.userAgent.indexOf(UAfragment) >= 0) { - return true; - } - } - return false; - } - - /** - * checks whether this is an unsupported browser, via feature detection - * - * @private - * @name InitialCheck.isOldBrowser - * @function - * @return {bool} - */ - function isOldBrowser() { - // webcrypto support - if (!( - 'crypto' in window && - 'getRandomValues' in window.crypto && - 'subtle' in window.crypto && - 'encrypt' in window.crypto.subtle && - 'decrypt' in window.crypto.subtle && - 'Uint8Array' in window && - 'Uint32Array' in window - )) { - return true; - } - - // not checking for async/await, ES6 or Promise support, as most - // browsers introduced these earlier then webassembly and webcrypto: - // https://github.com/PrivateBin/PrivateBin/pull/431#issuecomment-493129359 - - return false; - } - - /** - * init on application start, returns an all-clear signal - * - * @name InitialCheck.init - * @function - * @return {bool} - */ - me.init = function() - { - // prevent bots from viewing a paste and potentially deleting data - // when burn-after-reading is set - if (isBadBot()) { - Alert.showError('I love you too, bot…'); - return false; - } - - if (isOldBrowser()) { - // some browsers (Chrome based ones) would have webcrypto support if using HTTPS - if (isInsecureConnection()) { - Alert.showError(['Your browser may require an HTTPS connection to support the WebCrypto API. Try switching to HTTPS.', 'https' + window.location.href.slice(4)]); - } - $('#oldnotice').removeClass('hidden'); - return false; - } - - if (isInsecureConnection()) { - $('#httpnotice').removeClass('hidden'); - } - - z = zlib.catch(function () { - if ($('body').data('compression') !== 'none') { - Alert.showWarning('Your browser doesn\'t support WebAssembly, used for zlib compression. You can create uncompressed documents, but can\'t read compressed ones.'); - } - }); - return true; - } - - return me; - })(); - /** * (controller) main PrivateBin logic * @@ -5033,13 +4884,29 @@ jQuery.PrivateBin = (function($, RawDeflate) { DiscussionViewer.prepareNewDiscussion(); }; + /** + * try initializing zlib or display a warning if it fails, + * extracted from main init to allow unit testing + * + * @name Controller.initZ + * @function + */ + me.initZ = function() + { + z = zlib.catch(function () { + if ($('body').data('compression') !== 'none') { + Alert.showWarning('Your browser doesn\'t support WebAssembly, used for zlib compression. You can create uncompressed documents, but can\'t read compressed ones.'); + } + }); + } + /** * application start * * @name Controller.init * @function */ - me.init = async function() + me.init = function() { // first load translations I18n.loadTranslations(); @@ -5057,10 +4924,18 @@ jQuery.PrivateBin = (function($, RawDeflate) { Prompt.init(); TopNav.init(); UiHelper.init(); - if (!InitialCheck.init()) { + + // check for legacy browsers before going any further + if (!$.Legacy.Check.getInit()) { + // Legacy check didn't complete, wait and try again + setTimeout(init, 500); + return; + } + if (!$.Legacy.Check.getStatus()) { // something major is wrong, stop right away return; } + me.initZ(); // check whether existing paste needs to be shown try { @@ -5100,7 +4975,6 @@ jQuery.PrivateBin = (function($, RawDeflate) { ServerInteraction: ServerInteraction, PasteEncrypter: PasteEncrypter, PasteDecrypter: PasteDecrypter, - InitialCheck: InitialCheck, Controller: Controller }; })(jQuery, RawDeflate); diff --git a/js/test/InitialCheck.js b/js/test/Check.js similarity index 87% rename from js/test/InitialCheck.js rename to js/test/Check.js index 4e181f15..dd49236c 100644 --- a/js/test/InitialCheck.js +++ b/js/test/Check.js @@ -2,7 +2,7 @@ var common = require('../common'); /* global WebCrypto */ -describe('InitialCheck', function () { +describe('Check', function () { describe('init', function () { this.timeout(30000); before(function () { @@ -23,7 +23,8 @@ describe('InitialCheck', function () { '' ); $.PrivateBin.Alert.init(); - const result1 = !$.PrivateBin.InitialCheck.init(), + $.Legacy.Check.init(); + const result1 = $.Legacy.Check.getInit() && !$.Legacy.Check.getStatus(), result2 = !$('#errormessage').hasClass('hidden'); clean(); return result1 && result2; @@ -50,7 +51,8 @@ describe('InitialCheck', function () { '' ); $.PrivateBin.Alert.init(); - const result1 = !$.PrivateBin.InitialCheck.init(), + $.Legacy.Check.init(); + const result1 = $.Legacy.Check.getInit() && !$.Legacy.Check.getStatus(), result2 = isSecureContext === $('#errormessage').hasClass('hidden'), result3 = !$('#oldnotice').hasClass('hidden'); clean(); @@ -70,9 +72,10 @@ describe('InitialCheck', function () { ''+ '' ); - $.PrivateBin.Alert.init(); window.crypto = new WebCrypto(); - const result1 = $.PrivateBin.InitialCheck.init(), + $.PrivateBin.Alert.init(); + $.Legacy.Check.init(); + const result1 = $.Legacy.Check.getInit() && $.Legacy.Check.getStatus(), result2 = secureProtocol === $('#httpnotice').hasClass('hidden'); clean(); return result1 && result2; diff --git a/js/test/CryptTool.js b/js/test/CryptTool.js index b3aaaa59..627a242f 100644 --- a/js/test/CryptTool.js +++ b/js/test/CryptTool.js @@ -19,7 +19,7 @@ describe('CryptTool', function () { await new Promise(resolve => setTimeout(resolve, 300)); let clean = jsdom(); // ensure zlib is getting loaded - $.PrivateBin.InitialCheck.init(); + $.PrivateBin.Controller.initZ(); window.crypto = new WebCrypto(); message = message.trim(); let cipherMessage = await $.PrivateBin.CryptTool.cipher( @@ -182,7 +182,7 @@ describe('CryptTool', function () { clean = jsdom(); window.crypto = new WebCrypto(); // ensure zlib is getting loaded - $.PrivateBin.InitialCheck.init(); + $.PrivateBin.Controller.initZ(); let cipherMessage = await $.PrivateBin.CryptTool.cipher( 'foo', 'bar', message, [] ), @@ -227,7 +227,7 @@ conseq_or_bottom inv (interp (nth_iterate sBody n) (MemElem mem)) `; let clean = jsdom(); // ensure zlib is getting loaded - $.PrivateBin.InitialCheck.init(); + $.PrivateBin.Controller.initZ(); window.crypto = new WebCrypto(); let cipherMessage = await $.PrivateBin.CryptTool.cipher( key, password, message, [] diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index 338cf406..42fac244 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -71,7 +71,8 @@ if ($MARKDOWN): endif; ?> - + + diff --git a/tpl/page.php b/tpl/page.php index 567f4bbd..5b0abc8e 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -49,7 +49,8 @@ if ($MARKDOWN): endif; ?> - + + From 713ce148a4e9c31b2ec318b0a6ae5f1a4a5d4cc7 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Sat, 14 Sep 2019 09:50:47 +0200 Subject: [PATCH 15/24] address Codacy's concern that i is already defined --- js/legacy.js | 4 ++-- tpl/bootstrap.php | 2 +- tpl/page.php | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/js/legacy.js b/js/legacy.js index 82a6bd12..8f0b23f2 100644 --- a/js/legacy.js +++ b/js/legacy.js @@ -130,8 +130,8 @@ jQuery.Legacy = (function($) { } // whitelist localhost for development - for (var i = 0; i < hostname.length; i++) { - if (window.location.hostname === hostname[i]) { + for (var j = 0; j < hostname.length; j++) { + if (window.location.hostname === hostname[j]) { return true; } } diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index 42fac244..bb34288a 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -71,7 +71,7 @@ if ($MARKDOWN): endif; ?> - + diff --git a/tpl/page.php b/tpl/page.php index 0d6bd3a7..a373f85a 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -49,8 +49,8 @@ if ($MARKDOWN): endif; ?> - - + + From 70c38db81de136de609992b2f770000974e6f8da Mon Sep 17 00:00:00 2001 From: El RIDO Date: Wed, 18 Sep 2019 07:47:26 +0200 Subject: [PATCH 19/24] adding ES6 and async feature detection to correctly flag old chromes and operas with the modern browser error --- js/legacy.js | 13 ++++++++++--- tpl/bootstrap.php | 2 +- tpl/page.php | 2 +- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/js/legacy.js b/js/legacy.js index e50a64d9..64f565a6 100644 --- a/js/legacy.js +++ b/js/legacy.js @@ -174,9 +174,16 @@ return true; } - // not checking for async/await, ES6 or Promise support, as most - // browsers introduced these earlier then webassembly and webcrypto: - // https://github.com/PrivateBin/PrivateBin/pull/431#issuecomment-493129359 + // async & ES6 support + try { + eval('async () => {}'); + } catch (e) { + if (e instanceof SyntaxError) { + return true; + } else { + throw e; // throws CSP error + } + } return false; } diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index c8ffa8b7..d484edfa 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -71,7 +71,7 @@ if ($MARKDOWN): endif; ?> - + @@ -447,10 +444,6 @@ endif; -