From 122053abb2f05d40c756ca37cb27d939d04917e3 Mon Sep 17 00:00:00 2001 From: yflory Date: Mon, 7 Apr 2025 17:59:47 +0200 Subject: [PATCH 1/4] Fix u8 increment issue in file-crypto --- www/common/media-tag.js | 27 +++++++++++++++++++-------- www/file/file-crypto.js | 28 +++++++++++++++++++++------- 2 files changed, 40 insertions(+), 15 deletions(-) diff --git a/www/common/media-tag.js b/www/common/media-tag.js index ac02eed3f..55076c23e 100644 --- a/www/common/media-tag.js +++ b/www/common/media-tag.js @@ -347,16 +347,27 @@ var factory = function () { // Increment a nonce increment: function (N) { - var l = N.length; - while (l-- > 1) { - if (N[l] !== 255) { return void N[l]++; } - - // you don't need to worry about this running out. - // you'd need a REAAAALLY big file - if (l === 0) { throw new Error('E_NONCE_TOO_LARGE'); } - + // start from the last element directly without relying on confusing post-decrement behaviour + let l = N.length - 1; + while (l >= 0) { + // increment the least significant byte unless it's already at its maximum + if (N[l] !== 255) { + N[l] += 1; + return; + } + // if the loop reaches the most significant byte and the above block fails to return + // then the nonce's state-space has been exhausted + if (l === 0) { + throw new Error("E_NONCE_TOO_LARGE"); + } + // otherwise reset the lesser bytes to zero N[l] = 0; + // and proceed to the next more significant byte + l -= 1; } + // the loop body will never be executed if a zero-length nonce is supplied + // this handles that case + throw new Error("E_EMPTY_NONCE"); }, decodePrefix: function (A) { diff --git a/www/file/file-crypto.js b/www/file/file-crypto.js index 6a5bc9e33..c1175a41c 100644 --- a/www/file/file-crypto.js +++ b/www/file/file-crypto.js @@ -37,15 +37,29 @@ define([ return new Uint8Array(new Array(24).fill(0)); }; - var increment = function (N) { - var l = N.length; - while (l-- > 1) { - /* our linter suspects this is unsafe because we lack types - but as long as this is only used on nonces, it should be safe */ - if (N[l] !== 255) { return void N[l]++; } - if (l === 0) { throw new Error('E_NONCE_TOO_LARGE'); } + // New version of "increment" from @ansuz + const increment = N => { + // start from the last element directly without relying on confusing post-decrement behaviour + let l = N.length - 1; + while (l >= 0) { + // increment the least significant byte unless it's already at its maximum + if (N[l] !== 255) { + N[l] += 1; + return; + } + // if the loop reaches the most significant byte and the above block fails to return + // then the nonce's state-space has been exhausted + if (l === 0) { + throw new Error("E_NONCE_TOO_LARGE"); + } + // otherwise reset the lesser bytes to zero N[l] = 0; + // and proceed to the next more significant byte + l -= 1; } + // the loop body will never be executed if a zero-length nonce is supplied + // this handles that case + throw new Error("E_EMPTY_NONCE"); }; var joinChunks = function (chunks) { From 4b483fd5682d1cf7c02247643bfd145abeaf3558 Mon Sep 17 00:00:00 2001 From: mathilde-cryptpad <156299270+mathilde-cryptpad@users.noreply.github.com> Date: Wed, 9 Apr 2025 10:09:41 +0200 Subject: [PATCH 2/4] add latest version on bug report template, remove outdated ones --- .github/ISSUE_TEMPLATE/bug_resolution.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_resolution.yml b/.github/ISSUE_TEMPLATE/bug_resolution.yml index 474070d59..2d6e98cb5 100644 --- a/.github/ISSUE_TEMPLATE/bug_resolution.yml +++ b/.github/ISSUE_TEMPLATE/bug_resolution.yml @@ -89,13 +89,10 @@ body: label: Version description: What version of CryptPad are you running? options: + - 2025.3.0 - 2024.12.0 - 2024.9.1 - 2024.9.0 - - 2024.6.1 - - 2024.6.0 - - 2024.3.1 - - 2024.3.0 - Other validations: required: true From 8a931a6fe8db659ae52c52e9140c5aad981fde35 Mon Sep 17 00:00:00 2001 From: mathilde-cryptpad <156299270+mathilde-cryptpad@users.noreply.github.com> Date: Wed, 9 Apr 2025 13:05:19 +0200 Subject: [PATCH 3/4] mention whitepaper and threat model before explaining how to report a security vulnerability --- SECURITY.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 75100dbf0..66a1fe3b7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -22,4 +22,5 @@ We do also communicate about this topic on: ## Reporting a Vulnerability -Vulnerabilities can be reported using the GitHub Security interface. You can also send us an email at security@cryptpad.org +Brefore reaching out to us about a potential vulnerability, ensure it falls in the scope of our project. Please read thoroughly our [whitepaper](https://blog.cryptpad.org/2023/02/02/Whitepaper/) describing our threat model and what we consider acceptable or not security-wirse. If you are sure you found a real vulnerability, you can report it using the GitHub Security interface. You can also send us an email at security@cryptpad.org + From a24370f0f27ec81dec107d563e9573eb652e8a05 Mon Sep 17 00:00:00 2001 From: mathilde-cryptpad <156299270+mathilde-cryptpad@users.noreply.github.com> Date: Wed, 9 Apr 2025 13:06:28 +0200 Subject: [PATCH 4/4] fix typos in SECURITY.md --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 66a1fe3b7..3cadf5ceb 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -22,5 +22,5 @@ We do also communicate about this topic on: ## Reporting a Vulnerability -Brefore reaching out to us about a potential vulnerability, ensure it falls in the scope of our project. Please read thoroughly our [whitepaper](https://blog.cryptpad.org/2023/02/02/Whitepaper/) describing our threat model and what we consider acceptable or not security-wirse. If you are sure you found a real vulnerability, you can report it using the GitHub Security interface. You can also send us an email at security@cryptpad.org +Brefore reaching out about a potential vulnerability, ensure it falls within the scope of our project. Please read thoroughly our [whitepaper](https://blog.cryptpad.org/2023/02/02/Whitepaper/) describing our threat model and what we consider acceptable or not security-wise. If you are sure you found a real vulnerability, you can report it using the GitHub Security interface. You can also send us an email at security@cryptpad.org