New: Use safeStorage for passwords and tokens

Author: ollm

CHANGELOG.md

@@ -24,7 +24,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Custom mouse wheel shortcuts [`1db0fc7`](https://github.com/ollm/OpenComic/commit/1db0fc7721e33e0e423f0b57590fd65b80cd5df7)
 - Option to configure mouse wheel sensitivity when zooming [`8a80d0a`](https://github.com/ollm/OpenComic/commit/8a80d0acee57daa693ae7029c3f48127958b6a79)
 - Option to ignore files and folders that match Regex or File pattern [`670bced`](https://github.com/ollm/OpenComic/commit/670bced3ed7413145119b401f974e15ea482ddf5)
-- Authentication support for OPDS (Basic and Digest)
+- Authentication support for OPDS (Basic and Digest) [`11c3aa8`](https://github.com/ollm/OpenComic/commit/11c3aa88efbff8adcc3fabbf4b066dcb7120b10a)
+- Use safeStorage for passwords and tokens
 
 ##### 🐛 Bug Fixes
 

scripts/migration.js

@@ -212,6 +212,43 @@ function migrateIgnoreFilesRegex(data)
 	return data;
 }
 
+function migratePasswordsAndTokensToSafeStorag(data)
+{
+	console.time('Migration: passwordsAndTokensToSafeStorag');
+
+	if(data.config.trackingSites)
+	{
+		for(let key in data.config.trackingSites)
+		{
+			const site = data.config.trackingSites[key];
+
+			site.access.pass = storage.safe.encrypt(site.access.pass);
+			site.access.token = storage.safe.encrypt(site.access.token);
+			site.session.token = storage.safe.encrypt(site.session.token);
+		}
+	}
+
+	if(data.servers)
+	{
+		for(const server of data.servers)
+		{
+			server.pass = storage.safe.encrypt(server.pass);
+		}
+	}
+
+	if(data.opdsCatalogs)
+	{
+		for(const catalog of data.opdsCatalogs)
+		{
+			catalog.pass = storage.safe.encrypt(catalog.pass);
+		}
+	}
+
+	console.timeEnd('Migration: passwordsAndTokensToSafeStorag');
+
+	return data;
+}
+
 function start(data)
 {
 	let changes = data.config.changes;
@@ -239,6 +276,9 @@ function start(data)
 	if(changes < 108)
 		data = migrateIgnoreFilesRegex(data);
 
+	if(changes < 110) // Use safeStorage for passwords and tokens
+		data = migratePasswordsAndTokensToSafeStorag(data);
+
 	data = opds.addNewDefaultCatalogs(data, changes);
 
 	return data;

scripts/opds.js

@@ -720,7 +720,7 @@ function edit(key, save = false)
 		opdsCatalog.title = values.title;
 		opdsCatalog.url = values.url;
 		opdsCatalog.user = values.user;
-		opdsCatalog.pass = values.pass;
+		opdsCatalog.pass = storage.safe.encrypt(values.pass);
 		opdsCatalog.showOnLeft = values.showOnLeft;
 
 		storage.set('opdsCatalogs', opdsCatalogs);
@@ -731,7 +731,7 @@ function edit(key, save = false)
 	else
 	{
 		handlebarsContext.opdsCatalog = opdsCatalogs[key];
-		handlebarsContext.opdsCatalog.pass = opdsCatalogs[key].pass;
+		handlebarsContext.opdsCatalog.pass = storage.safe.decrypt(opdsCatalogs[key].pass);
 
 		events.dialog({
 			header: language.global.catalogs,

scripts/opds/auth.js

@@ -7,7 +7,7 @@ function headers(url)
 	{
 		const data = parseAuth(currentCatalog.auth);
 		data.user = currentCatalog.user || '';
-		data.pass = currentCatalog.pass || '';
+		data.pass = storage.safe.decrypt(currentCatalog.pass || '');
 		data.uri = new URL(url).pathname;
 
 		let auth = false;
@@ -64,7 +64,7 @@ function parseAuth(auth)
 		algorithm: '',
 		qop: '',
 		nonceCount: '',
-		cnonce: md5(crypto.randomUUID()),
+		cnonce: crypto.hash('md5', crypto.randomUUID(), 'hex'),
 	};
 
 	const matches = [...auth.matchAll(/([^\s=]+)=(["'](?:[^"']+)|(?:[^\s"',]+))/g)];
@@ -95,7 +95,7 @@ async function requestCredentials(response, forceCredentials = false)
 	const auth = response.headers.get('www-authenticate');
 	const data = parseAuth(auth || '');
 
-	if(!currentCatalog.username || !currentCatalog.password || forceCredentials)
+	if(!currentCatalog.user || !currentCatalog.pass || forceCredentials)
 	{
 		const promise = new Promise(function(resolve, reject) {
 
@@ -132,7 +132,7 @@ function requestCredentialsDialog(siteName = false, save = null)
 
 			opds.updateCatalog(currentCatalog.index, {
 				user: user,
-				pass: pass,
+				pass: storage.safe.encrypt(pass),
 			});
 
 			credentialsResolve();

scripts/server-client.js

@@ -669,7 +669,7 @@ var client = function(path) {
 			port: getPort(server.path),
 			domain: server.domain,
 			user: server.user,
-			pass: server.pass,
+			pass: storage.safe.decrypt(server.pass),
 			share: getShare(server.path),
 			path: server.path,
 		};

scripts/settings.js

@@ -291,7 +291,7 @@ function getServerInputValues()
 		name: name,
 		path: path,
 		user: user,
-		pass: pass,
+		pass: storage.safe.encrypt(pass),
 		domain: domain,
 		showOnLibrary: showOnLibrary,
 		filesInSubfolders: filesInSubfolders,
@@ -432,6 +432,7 @@ function editServer(key, save = false)
 	{
 		let servers = storage.get('servers');
 		handlebarsContext.server = servers[key];
+		handlebarsContext.server.pass = storage.safe.decrypt(servers[key].pass);
 
 		events.dialog({
 			header: language.settings.servers.main,

scripts/storage.js

@@ -1,6 +1,8 @@
-var changes = 109; // Update this if readingPagesConfig is updated
+const safe = require(p.join(appDir, 'scripts/storage/safe.js'));
 
-var readingPagesConfig = {
+const changes = 110; // Update this if readingPagesConfig is updated
+
+const readingPagesConfig = {
 	readingConfigName: '',
 	readingView: 'slide',
 	readingViewConfig: {
@@ -89,7 +91,7 @@ var readingPagesConfig = {
 	},
 };
 
-var storageDefault = {
+const storageDefault = {
 	config: {
 		appVersion: _package.version,
 		changes: changes,
@@ -414,8 +416,9 @@ var storageDefault = {
 			lastAccess: 0,
 		}
 	},
-},
-storageJson = {};
+};
+
+const storageJson = {};
 
 function getDownloadsPath()
 {
@@ -802,4 +805,5 @@ module.exports = {
 	readingPagesConfig: readingPagesConfig,
 	changes: changes,
 	getDownloadsPath: getDownloadsPath,
+	safe: safe,
 };

scripts/storage/safe.js

@@ -0,0 +1,42 @@
+
+var _isEncryptionAvailable = null;
+
+function isEncryptionAvailable()
+{
+	if(_isEncryptionAvailable !== null) return _isEncryptionAvailable;
+	
+	_isEncryptionAvailable = electronRemote.safeStorage.isEncryptionAvailable();
+	return _isEncryptionAvailable;
+}
+
+function encrypt(string)
+{
+	if(!string || /^\$safeStorage:/.test(string) || !isEncryptionAvailable())
+		return string;
+
+	return '$safeStorage:'+electronRemote.safeStorage.encryptString(string).toString('base64');
+}
+
+var decryptCache = {};
+
+function decrypt(string)
+{
+	if(/^\$safeStorage:/.test(string))
+	{
+		if(!decryptCache[string])
+		{
+			const buffer = Buffer.from(string.slice(13), 'base64');
+			decryptCache[string] = electronRemote.safeStorage.decryptString(buffer);
+		}
+
+		return decryptCache[string];
+	}
+
+	return string;
+}
+
+module.exports = {
+	isEncryptionAvailable: isEncryptionAvailable,
+	encrypt: encrypt,
+	decrypt: decrypt,
+};

scripts/tracking.js

@@ -4,10 +4,14 @@ function loadSiteScript(site)
 {
 	if(!sitesScripts[site])
 	{
-		var siteData = trackingSites.site(site);
+		const siteData = app.copy(trackingSites.site(site));
 
 		if(siteData)
 		{
+			siteData.config.access.pass = storage.safe.decrypt(siteData.config.access.pass);
+			siteData.config.access.token = storage.safe.decrypt(siteData.config.access.token);
+			siteData.config.session.token = storage.safe.decrypt(siteData.config.session.token);
+
 			sitesScripts[site] = require(siteData.script);
 			sitesScripts[site].setSiteData(siteData);
 		}
@@ -16,10 +20,14 @@ function loadSiteScript(site)
 
 function setSiteData(site)
 {
-	var siteData = trackingSites.site(site);
+	const siteData = app.copy(trackingSites.site(site));
 
 	if(siteData)
 	{
+		siteData.config.access.pass = storage.safe.decrypt(siteData.config.access.pass);
+		siteData.config.access.token = storage.safe.decrypt(siteData.config.access.token);
+		siteData.config.session.token = storage.safe.decrypt(siteData.config.session.token);
+
 		loadSiteScript(site);
 		sitesScripts[site].setSiteData(siteData);
 	}
@@ -270,7 +278,7 @@ function login(site, fromConfig = false)
 // Save session token
 function setSessionToken(site = '', token = '')
 {
-	saveSiteConfig(site, 'session', {valid: true, token: token});
+	saveSiteConfig(site, 'session', {valid: true, token: storage.safe.encrypt(token)});
 }
 
 // Remove session token