fix security issue

src/background.ts

@@ -14,7 +14,7 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
     }
     getQr(
         sender.tab, message.info.left, message.info.top, message.info.width,
-        message.info.height, message.info.windowWidth, message.info.passphrase);
+        message.info.height, message.info.windowWidth);
   } else if (message.action === 'cachePassphrase') {
     cachedPassphrase = message.value;
   } else if (message.action === 'passphrase') {
@@ -30,7 +30,7 @@ let contentTab: chrome.tabs.Tab;
 
 function getQr(
     tab: chrome.tabs.Tab, left: number, top: number, width: number,
-    height: number, windowWidth: number, passphrase: string) {
+    height: number, windowWidth: number) {
   chrome.tabs.captureVisibleTab(tab.windowId, {format: 'png'}, (dataUrl) => {
     contentTab = tab;
     const qr = new Image();
@@ -50,14 +50,14 @@ function getQr(
           width * devicePixelRatio, height * devicePixelRatio);
       const url = captureCanvas.toDataURL();
       qrcode.callback = (text) => {
-        getTotp(text, passphrase);
+        getTotp(text);
       };
       qrcode.decode(url);
     };
   });
 }
 
-async function getTotp(text: string, passphrase: string) {
+async function getTotp(text: string) {
   const id = contentTab.id;
   if (!id) {
     return;
@@ -123,7 +123,7 @@ async function getTotp(text: string, passphrase: string) {
           !/^[0-9a-f]+$/i.test(secret) && !/^[2-7a-z]+=*$/i.test(secret)) {
         chrome.tabs.sendMessage(id, {action: 'secretqr', secret});
       } else {
-        const encryption = new Encryption(passphrase);
+        const encryption = new Encryption(cachedPassphrase);
         const hash = CryptoJS.MD5(secret).toString();
         if (!/^[2-7a-z]+=*$/i.test(secret) && /^[0-9a-f]+$/i.test(secret) &&
             type === 'totp') {

src/content.ts

@@ -3,7 +3,7 @@ if (!document.getElementById('__ga_grayLayout__')) {
     switch (message.action) {
       case 'capture':
         sendResponse('beginCapture');
-        showGrayLayout(message.passphrase);
+        showGrayLayout();
         break;
       case 'errorsecret':
         alert(chrome.i18n.getMessage('errorsecret') + message.secret);
@@ -30,7 +30,7 @@ if (!document.getElementById('__ga_grayLayout__')) {
 sessionStorage.setItem('captureBoxPositionLeft', '0');
 sessionStorage.setItem('captureBoxPositionTop', '0');
 
-function showGrayLayout(passphrase: string) {
+function showGrayLayout() {
   let grayLayout = document.getElementById('__ga_grayLayout__');
   if (!grayLayout) {
     grayLayout = document.createElement('div');
@@ -47,7 +47,7 @@ function showGrayLayout(passphrase: string) {
     grayLayout.onmousedown = grayLayoutDown;
     grayLayout.onmousemove = grayLayoutMove;
     grayLayout.onmouseup = (event) => {
-      grayLayoutUp(event, passphrase);
+      grayLayoutUp(event);
     };
     grayLayout.oncontextmenu = (event) => {
       event.preventDefault();
@@ -108,7 +108,7 @@ function grayLayoutMove(event: MouseEvent) {
   return;
 }
 
-function grayLayoutUp(event: MouseEvent, passphrase: string) {
+function grayLayoutUp(event: MouseEvent) {
   const grayLayout = document.getElementById('__ga_grayLayout__');
   const captureBox = document.getElementById('__ga_captureBox__');
   if (!captureBox || !grayLayout) {
@@ -149,25 +149,16 @@ function grayLayoutUp(event: MouseEvent, passphrase: string) {
   // make sure captureBox and grayLayout is hidden
   setTimeout(() => {
     sendPosition(
-        captureBoxLeft, captureBoxTop, captureBoxWidth, captureBoxHeight,
-        passphrase);
+        captureBoxLeft, captureBoxTop, captureBoxWidth, captureBoxHeight);
   }, 200);
   return false;
 }
 
 function sendPosition(
-    left: number, top: number, width: number, height: number,
-    passphrase: string) {
+    left: number, top: number, width: number, height: number) {
   chrome.runtime.sendMessage({
     action: 'position',
-    info: {
-      left,
-      top,
-      width,
-      height,
-      windowWidth: window.innerWidth,
-      passphrase
-    }
+    info: {left, top, width, height, windowWidth: window.innerWidth}
   });
 }
 

src/qrdebug.ts

@@ -5,13 +5,13 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
     }
     getQrDebug(
         sender.tab, message.info.left, message.info.top, message.info.width,
-        message.info.height, message.info.windowWidth, message.info.passphrase);
+        message.info.height, message.info.windowWidth);
   }
 });
 
 function getQrDebug(
     tab: chrome.tabs.Tab, left: number, top: number, width: number,
-    height: number, windowWidth: number, passphrase: string) {
+    height: number, windowWidth: number) {
   chrome.tabs.captureVisibleTab(tab.windowId, {format: 'png'}, (dataUrl) => {
     const qr = new Image();
     qr.src = dataUrl;

src/ui/add-account.ts

@@ -87,15 +87,13 @@ async function addAccount(_ui: UI) {
           if (!tab || !tab.id) {
             return;
           }
-          chrome.tabs.sendMessage(
-              tab.id, {action: 'capture', passphrase: _ui.instance.passphrase},
-              (result) => {
-                if (result !== 'beginCapture') {
-                  _ui.instance.alert(_ui.instance.i18n.capture_failed);
-                } else {
-                  window.close();
-                }
-              });
+          chrome.tabs.sendMessage(tab.id, {action: 'capture'}, (result) => {
+            if (result !== 'beginCapture') {
+              _ui.instance.alert(_ui.instance.i18n.capture_failed);
+            } else {
+              window.close();
+            }
+          });
         });
         return;
       },