Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-09-06 16:07:03 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Use SensitiveString at more places

Browse source
This commit is contained in:
the-djmaze 2024-02-21 00:59:09 +01:00
parent a473e5e223
commit d5d47ffed1
3 changed files with 39 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

17
snappymail/v/0.0.0/app/libraries/RainLoop/Model/Identity.php
View file

@ -3,6 +3,7 @@
namespace RainLoop\Model; namespace RainLoop\Model;
use MailSo\Base\Utils; use MailSo\Base\Utils;
use SnappyMail\SensitiveString;
class Identity implements \JsonSerializable class Identity implements \JsonSerializable
{ {
@ -27,8 +28,8 @@ class Identity implements \JsonSerializable
private bool $pgpEncrypt = false; private bool $pgpEncrypt = false;
private bool $pgpSign = false; private bool $pgpSign = false;
private string $SMimeKey = ''; private ?SensitiveString $smimeKey = null;
private string $SMimeCertificate = ''; private string $smimeCertificate = '';
function __construct(string $sId = '', string $sEmail = '') function __construct(string $sId = '', string $sEmail = '')
{ {
@ -100,8 +101,8 @@ class Identity implements \JsonSerializable
$this->sSentFolder = isset($aData['sentFolder']) ? $aData['sentFolder'] : ''; $this->sSentFolder = isset($aData['sentFolder']) ? $aData['sentFolder'] : '';
$this->pgpEncrypt = !empty($aData['pgpEncrypt']); $this->pgpEncrypt = !empty($aData['pgpEncrypt']);
$this->pgpSign = !empty($aData['pgpSign']); $this->pgpSign = !empty($aData['pgpSign']);
$this->SMimeKey = isset($aData['smimeKey']) ? $aData['smimeKey'] : ''; $this->smimeKey = new SensitiveString(isset($aData['smimeKey']) ? $aData['smimeKey'] : '');
$this->SMimeCertificate = isset($aData['smimeCertificate']) ? $aData['smimeCertificate'] : ''; $this->smimeCertificate = isset($aData['smimeCertificate']) ? $aData['smimeCertificate'] : '';
return true; return true;
} }
@ -123,8 +124,8 @@ class Identity implements \JsonSerializable
'sentFolder' => $this->sSentFolder, 'sentFolder' => $this->sSentFolder,
'pgpEncrypt' => $this->pgpEncrypt, 'pgpEncrypt' => $this->pgpEncrypt,
'pgpSign' => $this->pgpSign, 'pgpSign' => $this->pgpSign,
'smimeKey' => $this->SMimeKey, 'smimeKey' => (string) $this->smimeKey,
'smimeCertificate' => $this->SMimeCertificate 'smimeCertificate' => $this->smimeCertificate
); );
} }
@ -144,8 +145,8 @@ class Identity implements \JsonSerializable
'sentFolder' => $this->sSentFolder, 'sentFolder' => $this->sSentFolder,
'pgpEncrypt' => $this->pgpEncrypt, 'pgpEncrypt' => $this->pgpEncrypt,
'pgpSign' => $this->pgpSign, 'pgpSign' => $this->pgpSign,
'smimeKey' => $this->SMimeKey, 'smimeKey' => (string) $this->smimeKey,
'smimeCertificate' => $this->SMimeCertificate 'smimeCertificate' => $this->smimeCertificate
); );
} }

47
snappymail/v/0.0.0/app/libraries/RainLoop/Model/MainAccount.php
View file

@ -5,51 +5,62 @@ namespace RainLoop\Model;
use RainLoop\Utils; use RainLoop\Utils;
use RainLoop\Exceptions\ClientException; use RainLoop\Exceptions\ClientException;
use RainLoop\Providers\Storage\Enumerations\StorageType; use RainLoop\Providers\Storage\Enumerations\StorageType;
use SnappyMail\SensitiveString;
class MainAccount extends Account class MainAccount extends Account
{ {
/** private ?SensitiveString $sCryptKey = null;
* @var string
*/
private string $sCryptKey = '';
/* /*
public function resealCryptKey(string $sOldPass, string $sNewPass) : string public function resealCryptKey(
#[\SensitiveParameter]
string $sOldPass,
#[\SensitiveParameter]
string $sNewPass
) : bool
{ {
$oStorage = \RainLoop\Api::Actions()->StorageProvider(); $oStorage = \RainLoop\Api::Actions()->StorageProvider();
$sKey = $oStorage->Get($this, StorageType::ROOT, 'cryptkey'); $sKey = $oStorage->Get($this, StorageType::ROOT, '.cryptkey');
if ($sKey) { if ($sKey) {
$sKey = \SnappyMail\Crypt::DecryptUrlSafe($sKey, $sOldPass); $sKey = \SnappyMail\Crypt::DecryptUrlSafe($sKey, $sOldPass);
$sKey = \SnappyMail\Crypt::EncryptUrlSafe($sKey, $sNewPass); if ($sKey) {
$oStorage->Put($this, StorageType::ROOT, 'cryptkey', $sKey); $sKey = \SnappyMail\Crypt::EncryptUrlSafe($sKey, $sNewPass);
$sKey = \SnappyMail\Crypt::DecryptUrlSafe($sKey, $sNewPass); if ($sKey) {
$this->SetCryptKey($sKey); $oStorage->Put($this, StorageType::ROOT, '.cryptkey', $sKey);
$sKey = \SnappyMail\Crypt::DecryptUrlSafe($sKey, $sNewPass);
$this->SetCryptKey($sKey);
return true;
}
}
} }
return false;
} }
*/ */
public function CryptKey() : string public function CryptKey() : string
{ {
if (!$this->sCryptKey) { if (!$this->sCryptKey) {
$sKey = \sha1($this->IncPassword() . APP_SALT, true);
/* /*
// Seal the cryptkey so that people who change their login password // Seal the cryptkey so that people who change their login password
// can use the old password to re-seal the cryptkey // can use the old password to re-seal the cryptkey
$oStorage = \RainLoop\Api::Actions()->StorageProvider(); $oStorage = \RainLoop\Api::Actions()->StorageProvider();
$sKey = $oStorage->Get($this, StorageType::ROOT, 'cryptkey'); $sKey = $oStorage->Get($this, StorageType::ROOT, '.cryptkey');
if (!$sKey) { if (!$sKey) {
$sKey = $this->IncPassword(); $sKey = \sha1($this->IncPassword() . APP_SALT, true);
// $sKey = \random_bytes(32);
$sKey = \SnappyMail\Crypt::EncryptUrlSafe($sKey, $this->IncPassword()); $sKey = \SnappyMail\Crypt::EncryptUrlSafe($sKey, $this->IncPassword());
$oStorage->Put($this, StorageType::ROOT, 'cryptkey', $sKey); $oStorage->Put($this, StorageType::ROOT, '.cryptkey', $sKey);
} }
$sKey = \SnappyMail\Crypt::DecryptUrlSafe($sKey, $this->IncPassword()); $sKey = \SnappyMail\Crypt::DecryptUrlSafe($sKey, $this->IncPassword());
$this->SetCryptKey($sKey);
*/ */
$this->SetCryptKey($this->IncPassword()); $this->SetCryptKey($sKey);
} }
return $this->sCryptKey; return $this->sCryptKey;
} }
public function SetCryptKey(string $sKey) : void public function SetCryptKey(
#[\SensitiveParameter]
string $sKey
) : void
{ {
$this->sCryptKey = \sha1($sKey . APP_SALT, true); $this->sCryptKey = new SensitiveString($sKey);
} }
} }

2
snappymail/v/0.0.0/app/libraries/snappymail/pgp/backup.php
View file

@ -25,7 +25,7 @@ class Backup
$key = \SnappyMail\Crypt::Encrypt($key, $hash); $key = \SnappyMail\Crypt::Encrypt($key, $hash);
$key[1] = \base64_encode($key[1]); $key[1] = \base64_encode($key[1]);
$key[2] = \base64_encode($key[2]); $key[2] = \base64_encode($key[2]);
$key[] = \hash_hmac('sha1', $key[2], $hash); $key[3] = \hash_hmac('sha1', $key[2], $hash);
return !!\file_put_contents("{$dir}{$keyId}.key", \json_encode($key)); return !!\file_put_contents("{$dir}{$keyId}.key", \json_encode($key));
} }
if (\str_contains($key, 'PGP PUBLIC KEY')) { if (\str_contains($key, 'PGP PUBLIC KEY')) {