From 4968bbf9613ddec64ecb87082ee62724c4d0147e Mon Sep 17 00:00:00 2001 From: ansuz Date: Wed, 11 Jan 2023 14:50:16 +0530 Subject: [PATCH 1/5] WIP limit on block size --- customize.dist/login.js | 2 +- lib/storage/block.js | 2 ++ lib/workers/index.js | 7 +++++++ 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/customize.dist/login.js b/customize.dist/login.js index efce968ca..ce1c4eb3d 100644 --- a/customize.dist/login.js +++ b/customize.dist/login.js @@ -99,7 +99,7 @@ define([ opt.channelHex = parsed.channel; opt.keys = parsed.keys; opt.edPublic = blockInfo.edPublic; - opt.User_name = blockInfo.User_name; + opt.User_name = blockInfo.User_name; // XXX do we actually use this? can we drop it? return opt; }; diff --git a/lib/storage/block.js b/lib/storage/block.js index fb82f0e41..9f02fc02b 100644 --- a/lib/storage/block.js +++ b/lib/storage/block.js @@ -116,6 +116,8 @@ Block.check = function (Env, publicKey, _cb) { // 'check' because 'exists' impli Fs.access(path, Fs.constants.F_OK, cb); }; +Block.MAX_SIZE = 256; // XXX confirm that this is sufficient, prevent user inputs that would result in larger blocks + Block.write = function (Env, publicKey, buffer, _cb) { var cb = Util.once(Util.mkAsync(_cb)); var path = Block.mkPath(Env, publicKey); diff --git a/lib/workers/index.js b/lib/workers/index.js index 7d82eab0f..c9955c2d2 100644 --- a/lib/workers/index.js +++ b/lib/workers/index.js @@ -6,6 +6,7 @@ const OS = require("os"); const { fork } = require('child_process'); const Workers = module.exports; const PID = process.pid; +const Block = require("../storage/block"); const DB_PATH = 'lib/workers/db-worker'; const MAX_JOBS = 16; @@ -472,6 +473,12 @@ Workers.initialize = function (Env, config, _cb) { }; Env.validateLoginBlock = function (publicKey, signature, block, cb) { + if (!block || !block.length || !block.length > Block.MAX_SIZE) { + return void setTimeout(function () { + cb('E_INVALID_BLOCK_SIZE'); + }); + } + sendCommand({ command: 'VALIDATE_LOGIN_BLOCK', publicKey: publicKey, From b0d10c3777d6976a6bc6a6513c1830153a81500f Mon Sep 17 00:00:00 2001 From: ansuz Date: Wed, 11 Jan 2023 15:08:16 +0530 Subject: [PATCH 2/5] oops - fix inverted not --- lib/workers/index.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/workers/index.js b/lib/workers/index.js index c9955c2d2..96cb0e795 100644 --- a/lib/workers/index.js +++ b/lib/workers/index.js @@ -473,7 +473,7 @@ Workers.initialize = function (Env, config, _cb) { }; Env.validateLoginBlock = function (publicKey, signature, block, cb) { - if (!block || !block.length || !block.length > Block.MAX_SIZE) { + if (!block || !block.length || block.length > Block.MAX_SIZE) { return void setTimeout(function () { cb('E_INVALID_BLOCK_SIZE'); }); From 08b6009a846c2666cd864e404174199dc10de139 Mon Sep 17 00:00:00 2001 From: ansuz Date: Tue, 7 Mar 2023 13:29:45 +0530 Subject: [PATCH 3/5] stop including username in login block --- customize.dist/login.js | 1 - www/common/cryptpad-common.js | 1 - 2 files changed, 2 deletions(-) diff --git a/customize.dist/login.js b/customize.dist/login.js index ce1c4eb3d..15707ca94 100644 --- a/customize.dist/login.js +++ b/customize.dist/login.js @@ -99,7 +99,6 @@ define([ opt.channelHex = parsed.channel; opt.keys = parsed.keys; opt.edPublic = blockInfo.edPublic; - opt.User_name = blockInfo.User_name; // XXX do we actually use this? can we drop it? return opt; }; diff --git a/www/common/cryptpad-common.js b/www/common/cryptpad-common.js index f417a4507..9911a6e72 100644 --- a/www/common/cryptpad-common.js +++ b/www/common/cryptpad-common.js @@ -2068,7 +2068,6 @@ define([ }).nThen(function (waitFor) { // Write the new login block var temp = { - User_name: accountName, User_hash: newHash, edPublic: edPublic, }; From d8ef2c83710341500cd983698fef9674e795f02e Mon Sep 17 00:00:00 2001 From: ansuz Date: Tue, 7 Mar 2023 13:30:30 +0530 Subject: [PATCH 4/5] print login block size when it exceeds the maximum --- lib/workers/index.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/workers/index.js b/lib/workers/index.js index 96cb0e795..d97f52225 100644 --- a/lib/workers/index.js +++ b/lib/workers/index.js @@ -475,6 +475,10 @@ Workers.initialize = function (Env, config, _cb) { Env.validateLoginBlock = function (publicKey, signature, block, cb) { if (!block || !block.length || block.length > Block.MAX_SIZE) { return void setTimeout(function () { + Env.Log.error('E_INVALID_BLOCK_SIZE', { + size: block.length, + }); + cb('E_INVALID_BLOCK_SIZE'); }); } From 0b6ac69e324d2bafd58804e1ece05c2c375b5580 Mon Sep 17 00:00:00 2001 From: ansuz Date: Tue, 7 Mar 2023 14:02:25 +0530 Subject: [PATCH 5/5] enforce maximum username length of 64 characters --- www/common/common-credential.js | 11 +++++++++-- www/register/main.js | 7 +++++++ 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/www/common/common-credential.js b/www/common/common-credential.js index ffbc482d6..b3be97308 100644 --- a/www/common/common-credential.js +++ b/www/common/common-credential.js @@ -3,7 +3,10 @@ var factory = function (AppConfig, Scrypt) { var Cred = {}; Cred.MINIMUM_PASSWORD_LENGTH = typeof(AppConfig.minimumPasswordLength) === 'number'? - AppConfig.minimumPasswordLength: 8; + AppConfig.minimumPasswordLength: 8; // TODO 14 or higher is a decent default for 2023 + + Cred.MINIMUM_NAME_LENGTH = 1; + Cred.MAXIMUM_NAME_LENGTH = 64; // https://stackoverflow.com/questions/46155/how-to-validate-an-email-address-in-javascript Cred.isEmail = function (email) { @@ -19,8 +22,12 @@ var factory = function (AppConfig, Scrypt) { return typeof(x) === 'string'; }; + // Maximum username length is enforced at registration time + // rather than in this function + // in order to maintain backwards compatibility with accounts + // that might have already registered with a longer name. Cred.isValidUsername = function (name) { - return !!(name && isString(name)); + return !!(isString(name) && name.length >= Cred.MINIMUM_NAME_LENGTH); }; Cred.isValidPassword = function (passwd) { diff --git a/www/register/main.js b/www/register/main.js index fa26f38b4..d772c770f 100644 --- a/www/register/main.js +++ b/www/register/main.js @@ -48,12 +48,19 @@ define([ var I_REALLY_WANT_TO_USE_MY_EMAIL_FOR_MY_USERNAME = false; var br = function () { return h('br'); }; + Messages.register_nameTooLong = "Usernames must be shorter than {0} characters"; // XXX var registerClick = function () { var uname = $uname.val().trim(); // trim whitespace surrounding the username since it is otherwise included in key derivation // most people won't realize that its presence is significant $uname.val(uname); + if (uname.length > Cred.MAXIMUM_NAME_LENGTH) { + let nameWarning = Messages._getKey('register_nameTooLong', [ Cred.MAXIMUM_NAME_LENGTH ]); + return void UI.alert(nameWarning, function () { + registering = false; + }); + } var passwd = $passwd.val(); var confirmPassword = $confirm.val();