key the declined-card digest to root-key material and reject legacy unsalted records (PB-26-108, v5.0.45)

@@ -0,0 +1,201 @@1+// PB-26-108: declined-card metadata must not be offline-enumerable.2+//3+// `peach_settings` lives unencrypted in chrome.storage.local, and on Firefox a4+// content script can read it directly. The declined-card record was a truncated5+// SHA-256 over `last4|expMonth|expYear` "salted" with a per-vault random value6+// stored right next to it. A stored salt defeats precomputed tables, not an7+// attacker holding the file: the candidate space is ~10^4 last-four values x 128+// months x a handful of years, so the card's last four and expiry were9+// recoverable by brute force in seconds.10+//11+// The fix keys the digest with material that is never at rest — a value derived12+// from the vault root key, available only while unlocked. Storage alone no13+// longer contains the inputs needed to recompute a record, so enumeration has14+// nothing to enumerate against.15+16+import { beforeEach, describe, expect, it, vi } from "vitest";17+18+type StorageShape = Record<string, unknown>;19+20+function installChromeMock(storage: StorageShape, sessionStorage: StorageShape) {21+  const chrome = {22+    storage: {23+      local: {24+        get: vi.fn(async (key?: string | string[]) => {25+          if (!key) return { ...storage };26+          const keys = Array.isArray(key) ? key : [key];27+          return keys.reduce<StorageShape>((acc, k) => {28+            acc[k] = storage[k];29+            return acc;30+          }, {});31+        }),32+        set: vi.fn(async (next: StorageShape) => { Object.assign(storage, next); }),33+        remove: vi.fn(async (keys: string | string[]) => {34+          for (const k of Array.isArray(keys) ? keys : [keys]) delete storage[k];35+        }),36+      },37+      session: {38+        get: vi.fn(async () => ({ ...sessionStorage })),39+        set: vi.fn(async (next: StorageShape) => { Object.assign(sessionStorage, next); }),40+        remove: vi.fn(async () => {}),41+      },42+    },43+    alarms: { clear: vi.fn(), create: vi.fn(), onAlarm: { addListener: vi.fn() } },44+    idle: { setDetectionInterval: vi.fn(), onStateChanged: { addListener: vi.fn() } },45+    runtime: {46+      id: "test-extension-id",47+      getURL: vi.fn((path: string) => `chrome-extension://test-extension-id/${path}`),48+    },49+  } as unknown as typeof globalThis.chrome;50+  (globalThis as Record<string, unknown>).chrome = chrome;51+}52+53+/** The pre-fix record: unsalted, truncated SHA-256 over the card's own fields. */54+async function legacyUnsaltedFingerprint(last4: string, month: string, year: string): Promise<string> {55+  const buf = await crypto.subtle.digest(56+    "SHA-256",57+    new TextEncoder().encode(`${last4}|${month}|${year}`),58+  );59+  return Array.from(new Uint8Array(buf).slice(0, 8))60+    .map((b) => b.toString(16).padStart(2, "0"))61+    .join("");62+}63+64+describe("PB-26-108: declined-card metadata at rest", () => {65+  let storage: StorageShape;66+  let sessionStorage: StorageShape;67+68+  beforeEach(() => {69+    vi.resetModules();70+    storage = {};71+    sessionStorage = {};72+    installChromeMock(storage, sessionStorage);73+    vi.stubGlobal("fetch", vi.fn(async () => { throw new Error("no network"); }));74+  });75+76+  async function freshVault(password: string) {77+    const vault = await import("./vault");78+    await vault.createVault(password);79+    return vault;80+  }81+82+  function persistedSettings(): Record<string, unknown> {83+    return storage.peach_settings as Record<string, unknown>;84+  }85+86+  it("persists no plaintext domain ledger and no card-fingerprint salt", async () => {87+    const vault = await freshVault("card-meta-pass-12345");88+    await vault.declineCardSaveOffer("4242", "12", "2029");89+90+    const blob = persistedSettings();91+    expect(blob.manualSummonDomains).toBeUndefined();92+    expect(blob.manualSummonSalt).toBeUndefined();93+    expect(blob.cardFingerprintSalt).toBeUndefined();94+    expect(blob.declinedCardFingerprints).toHaveLength(1);95+  });96+97+  // The enumeration attack, run with nothing but the contents of storage. The98+  // attacker enumerates every last-four value for the card's real expiry and99+  // keys the digest with whatever storage offers — the stored salt under the100+  // old scheme, nothing at all under the new one.101+  //102+  // Bug this catches: restoring a stored `cardFingerprintSalt` next to the103+  // records makes this loop terminate on "4242", which is exactly the104+  // ~1.2M-candidate offline recovery the finding is about.105+  it("a declined card cannot be recovered by brute force from storage alone", async () => {106+    const vault = await freshVault("card-brute-pass-12345");107+    await vault.declineCardSaveOffer("4242", "12", "2029");108+109+    const blob = persistedSettings();110+    const [stored] = blob.declinedCardFingerprints as string[];111+    const storedSalt = blob.cardFingerprintSalt as string | undefined;112+    expect(stored).toBeDefined();113+114+    const digest = async (value: string, salt: string) => {115+      const buf = await crypto.subtle.digest(116+        "SHA-256",117+        new TextEncoder().encode(`${salt}:${value}`),118+      );119+      return Array.from(new Uint8Array(buf).slice(0, 16))120+        .map((b) => b.toString(16).padStart(2, "0"))121+        .join("");122+    };123+124+    for (let candidate = 0; candidate < 10_000; candidate += 1) {125+      const last4 = candidate.toString().padStart(4, "0");126+      const fingerprint = await legacyUnsaltedFingerprint(last4, "12", "2029");127+      const guess = storedSalt ? await digest(fingerprint, storedSalt) : fingerprint;128+      expect(guess).not.toBe(stored);129+    }130+  });131+132+  // Same card, different vault (therefore different root key) — the record is133+  // a function of secret material, not of the card.134+  it("the same card records a different value under a different root key", async () => {135+    const first = await freshVault("card-key-a-pass-12345");136+    await first.declineCardSaveOffer("4242", "12", "2029");137+    const firstRecord = (persistedSettings().declinedCardFingerprints as string[])[0];138+139+    vi.resetModules();140+    storage = {};141+    sessionStorage = {};142+    installChromeMock(storage, sessionStorage);143+    const second = await freshVault("card-key-b-pass-12345");144+    await second.declineCardSaveOffer("4242", "12", "2029");145+    const secondRecord = (persistedSettings().declinedCardFingerprints as string[])[0];146+147+    expect(firstRecord).toBeDefined();148+    expect(secondRecord).toBeDefined();149+    expect(secondRecord).not.toBe(firstRecord);150+  });151+152+  it("a legacy unsalted record is no longer accepted", async () => {153+    const vault = await freshVault("card-legacy-pass-12345");154+    // Materialise the settings blob with an unrelated decline, then plant a155+    // legacy-format record the way an upgraded profile would carry one.156+    await vault.declineCardSaveOffer("1111", "01", "2027");157+    const legacy = await legacyUnsaltedFingerprint("4242", "12", "2029");158+    (persistedSettings().declinedCardFingerprints as string[]).push(legacy);159+160+    expect(await vault.isCardDeclined("4242", "12", "2029")).toBe(false);161+  });162+163+  it("a legacy unsalted record is pruned on the next decline", async () => {164+    const vault = await freshVault("card-prune-pass-12345");165+    const legacy = await legacyUnsaltedFingerprint("1111", "01", "2027");166+    await vault.declineCardSaveOffer("4242", "12", "2029");167+    (persistedSettings().declinedCardFingerprints as string[]).unshift(legacy);168+169+    await vault.declineCardSaveOffer("9999", "06", "2030");170+171+    const records = persistedSettings().declinedCardFingerprints as string[];172+    expect(records).not.toContain(legacy);173+    expect(records).toHaveLength(2);174+    // The genuine declines survive the prune.175+    expect(await vault.isCardDeclined("4242", "12", "2029")).toBe(true);176+    expect(await vault.isCardDeclined("9999", "06", "2030")).toBe(true);177+  });178+179+  // Locked means the root key is gone, so no record can be checked. Offers are180+  // not shown while locked, so this is not a functional regression.181+  it("declines cannot be evaluated while the vault is locked", async () => {182+    const vault = await freshVault("card-locked-pass-12345");183+    await vault.declineCardSaveOffer("4242", "12", "2029");184+    expect(await vault.isCardDeclined("4242", "12", "2029")).toBe(true);185+186+    vault.lock();187+188+    expect(await vault.isCardDeclined("4242", "12", "2029")).toBe(false);189+  });190+191+  // The feature itself must still work: a declined card stays declined for192+  // exactly that card.193+  it("still distinguishes cards by last four and expiry", async () => {194+    const vault = await freshVault("card-distinct-pass-12345");195+    await vault.declineCardSaveOffer("4242", "12", "2029");196+197+    expect(await vault.isCardDeclined("4242", "12", "2029")).toBe(true);198+    expect(await vault.isCardDeclined("4242", "11", "2029")).toBe(false);199+    expect(await vault.isCardDeclined("1111", "12", "2029")).toBe(false);200+  });201+});