Skip to content

Conversation

@quexten
Copy link
Contributor

@quexten quexten commented Oct 20, 2025

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-27115
https://bitwarden.atlassian.net/browse/VULN-185
https://bitwarden.atlassian.net/browse/PM-4185

📔 Objective

Forces the icon URI check for crypto v2 users. This adds some plumbing through the key store, which now also includes other non-key cryptographic state. The account security version is expected to be used in many other places that have access to the key store and we do not want to pass through an additional struct to all places.

Please see the tickets for context about what specifically this change achieves.

Further, this fixes the icon uri check to be constant time.

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation
    team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed
    issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

@claude

This comment was marked as resolved.

@quexten quexten changed the title Force icon uri checksum verification on user crypto v2 & make check c… Force icon uri checksum verification on user crypto v2 Oct 20, 2025
@quexten quexten changed the title Force icon uri checksum verification on user crypto v2 [PM-27115] Force icon uri checksum verification on user crypto v2 Oct 20, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Oct 20, 2025

Logo
Checkmarx One – Scan Summary & Detailsc81c87ea-ed2e-42c4-8156-3455143abaf1

Great job! No new security vulnerabilities introduced in this pull request

@sonarqubecloud
Copy link

@codecov
Copy link

codecov bot commented Oct 20, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.37%. Comparing base (79eb8c4) to head (b50d5b9).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #519      +/-   ##
==========================================
+ Coverage   78.36%   78.37%   +0.01%     
==========================================
  Files         291      291              
  Lines       29343    29366      +23     
==========================================
+ Hits        22994    23017      +23     
  Misses       6349     6349              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@quexten quexten marked this pull request as ready for review October 20, 2025 10:55
@quexten quexten requested review from a team as code owners October 20, 2025 10:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants