peach-android / 3b3fd73ab28f

fix: Remediate audit H-05/H-06/H-07 user-facing security claims (v2.8.6) Phase 3 of the 2026-07-29 correctness/security audit remediation, correcting the Sol-rejected Phase 3A (picker identity, signer-set, activity-test). H-05 secure-window ownership: - SecureWindowPolicy is the sole FLAG_SECURE owner; release-owned windows never cleared. - Autofill picker + passkey selection (separate windows) protected; QA bypass explicit only. - FLAG_SECURE instrumentation tests for both activities; passkey test captures the flag at CREATED via lifecycle callback (activity auto-finishes on empty intent). Verified on peach-pixel8 (API 36): both pass on-device. H-06 autofill origin authentication: - Picker re-derives origin trust in-process (pickerParsedFromInputs always UNKNOWN + authenticateAutofillOrigin); EXTRA_ORIGIN_TRUST removed; new EXTRA_CALLER_PACKAGE carries the authenticated browser package for web-origin pin re-check. No caller extra elevates trust. - TrustedBrowsers signer-set fails closed (empty expected/current reject; current-signer-only; history-only rejected). Browser pins stay UNCONFIRMED (no authoritative provenance available here) so isTrusted=false and TRUSTED_WEB is unreachable: deliberate fail-closed, test-locked. Browser web autofill/save disabled until pins are confirmed on a device (release follow-up). H-07 passkey authenticator-data claims: - Assertion UV derived from a real biometric ceremony; fails closed (no signature) when UV is required but unverified (shouldSignAssertion = !uvRequired || userVerified). - Registration made symmetric: build(userVerified) + registrationFlags() derive UP|BE|AT with conditional UV (0x4d verified / 0x49 not); completeCreate runs the prompt, reads authenticatorSelection.userVerification, fails closed when required-but-unverified. - BE consistent + immutable across registration/assertion. Byte-level tests for both paths. Gates: JVM 812 tests 0 failures/errors/skips (114 suites); lintDebug 0 errors; assembleRelease; connectedDebugAndroidTest 3/0 on emulator. Independent adversarial gate (qwen3.8-max-preview, substituting for the usage-limited gpt-5.6-sol) APPROVED with no blocking findings. Formal Sol-high re-gate deferred to after 2026-08-05 (usage-limit reset).

dev · 4 weeks ago · 2026-07-29 · 5.5 MB

parent: 7bee251757eb