peach-android / 2ba9a732c7e9

fix: sanitize sync entries and re-cap password history on merge (v2.10.19) Audit finding MN-3, slice 4 (final) of the verified-fix queue. Sync is live, so unsanitized peer entries were a Major-class gap. - New vault/SyncEntrySanitizer (pure, mirrors the browser's sanitizeRestoredEntry): blank titles dropped; husk passkeys (missing credentialId/publicKeyCose/rpId/userHandle/userName) drop the whole entry; credential-less logins dropped unless a passkey is present — nested or the browser's flat shape, which consolidatePasskeyEntries merges on unlock, so browser->Android passkey sync keeps working - passwordHistory re-capped to 50 on merge (a peer could otherwise plant unbounded history) - Wired into VaultRepository.applyMergedRemoteEntries, the single funnel for inbound sync entries (id-binding + HV-1 clamping already existed) Tests: SyncEntrySanitizerTest (7). Full suite 924, only the 5 known pre-existing failures.

dev · 3 weeks ago · 2026-08-03 · 5.9 MB

parent: 96e60825c044