fix: fail closed message authorization and recovery state (v5.0.19)

@@ -1,7 +1,7 @@11 {22   "manifest_version": 3,33   "name": "Peach Password Manager",4-  "version": "5.0.17",4+  "version": "5.0.19",55   "description": "Zero-knowledge password manager",66   "browser_specific_settings": {77     "gecko": {

@@ -2,7 +2,7 @@22   "manifest_version": 3,33   "minimum_chrome_version": "116",44   "name": "Peach Password Manager",5-  "version": "5.0.17",5+  "version": "5.0.19",66   "description": "Zero-knowledge password manager",77   "action": {88     "default_popup": "src/popup/index.html",

@@ -1,6 +1,6 @@11 {22   "name": "peach",3-  "version": "5.0.17",3+  "version": "5.0.19",44   "description": "Zero-knowledge password manager",55   "license": "GPL-3.0-only",66   "type": "module",

@@ -17,7 +17,11 @@1717   listPendingVouchedDevices,1818   removePendingVouchedDevice,1919 } from "./pending-vouched-devices";20-import { isRecoveryConfirmPending } from "./recovery-pending";20+import {21+  clearRecoveryConfirmPending,22+  isRecoveryConfirmPending,23+  setRecoveryConfirmPending,24+} from "./recovery-pending";2125 import { setupAutoLock, touchAutoLock } from "./alarms";2226 import { runSelfTest } from "./self-test";2327 import * as vault from "./vault";@@ -101,6 +105,7 @@101105   getSyncState,102106   triggerSyncIfReachable,103107 } from "./sync-trigger";108+import { getMessageContext } from "./message-policy";104109 105110 // Compile-time E2E flag, folded to a literal by Vite's `define` (false in106111 // every production build — verified in the bundled output). Mirrors the@@ -152,35 +157,6 @@152157   return { allowed: false };153158 }154159 155-// ---------------------------------------------------------------------------156-// PCH-01-018: operations that irreversibly destroy or replace vault contents,157-// handlers that store passkey material, and handlers that return sensitive158-// credential material (e.g. the Pro license key). These are gated to trusted159-// extension-page senders in handleMessage; the confirmation UX otherwise160-// lives only in the popup. Keep this in sync when adding new destructive or161-// sensitive handlers. (Codex Security 2026-08-04: GET_ADOPTION_MATERIAL and162-// COMPLETE_PAIRING were gated here, then deleted outright — they had no163-// legitimate senders; adoption runs in-background via relay-adoption-bg.ts.164-// Audit 2026-08-20 #4: GET_LOCAL_IDENTITY gated here — it returns the Pro165-// license key, which a compromised content script could exfiltrate.166-// PB-26-001: GET_CODEX_VAULT_DATA gated here — it returns the encrypted vault167-// slots and (with a fresh password proof) the recovery words, i.e. everything168-// needed to reconstruct the root key. ESTIMATE_CODEX_PAGES is gated for169-// symmetry (it is popup-only and reveals vault size).170-const PRIVILEGED_MESSAGE_TYPES: ReadonlySet<string> = new Set([171-  "DESTROY_VAULT",172-  "CLEAR_VAULT_ENTRIES",173-  "RESTORE_VAULT_SNAPSHOT",174-  "RESTORE_FROM_CODEX",175-  "COMPLETE_FIREFOX_PASSKEY_CREATE",176-  "UNLOCK_WITH_PIN",177-  "SETUP_PIN",178-  "DISABLE_PIN",179-  "GET_LOCAL_IDENTITY",180-  "GET_CODEX_VAULT_DATA",181-  "ESTIMATE_CODEX_PAGES",182-]);183-184160 // LV-3: minimum interval between non-test canary pings per webhook+entry.185161 const CANARY_MIN_INTERVAL_MS = 60 * 60 * 1000; // 1 hour186162 @@ -231,6 +207,39 @@231207   return undefined;232208 }233209 210+function isExtensionPageSender(sender: Partial<chrome.runtime.MessageSender>): boolean {211+  // A missing URL is the sender shape used by extension UI in unit tests and212+  // by some browser APIs. A real content-script sender has a browser-attested213+  // page URL, so it cannot use this compatibility path.214+  if (!sender.url) return true;215+  try {216+    return new URL(sender.url).origin === new URL(chrome.runtime.getURL("")).origin;217+  } catch {218+    return false;219+  }220+}221+222+function isPageSender(sender: Partial<chrome.runtime.MessageSender>): boolean {223+  return Boolean(sender.url) && !isExtensionPageSender(sender);224+}225+226+function isSenderAllowedForContext(227+  context: ReturnType<typeof getMessageContext>,228+  sender: Partial<chrome.runtime.MessageSender>,229+): boolean {230+  switch (context) {231+    case "extension-page-only":232+      return isExtensionPageSender(sender);233+    case "content-script-allowed":234+      return true;235+    case "page-relay":236+      return isPageSender(sender);237+    case "background-internal":238+    case undefined:239+      return false;240+  }241+}242+234243 // Resolves once restoreFromSession() has run, so handlers see the correct235244 // post-restore unlock state. entry.ts registers this BEFORE the message236245 // handler so the onMessage listener is added synchronously at SW startup@@ -265,19 +274,12 @@265274       return { ok: false, error: "invalid_sender" };266275     }267276 268-    // PCH-01-018: destructive and sensitive operations must originate from a269-    // trusted extension page (popup/options), never from a content script. The270-    // sender.id check above only proves the message came from *our* extension —271-    // a content script injected into an attacker page passes it. A single272-    // XSS-class bug in the injected UI would otherwise escalate to vault273-    // destruction, root-key exfiltration, or attacker device registration.274-    // Extension pages carry an extension-origin sender.url; content scripts275-    // carry a page URL.276-    if (PRIVILEGED_MESSAGE_TYPES.has(msg.type)) {277-      const extensionOrigin = chrome.runtime.getURL("");278-      if (!sender.url?.startsWith(extensionOrigin)) {279-        return { ok: false, error: "invalid_sender" };280-      }277+    // PB-26-016: sender authorization is an exhaustive policy, not a278+    // hand-maintained privileged denylist. A missing/unknown policy entry or a279+    // background-only message fails closed before any handler runs.280+    const messageContext = getMessageContext(msg.type);281+    if (!isSenderAllowedForContext(messageContext, sender)) {282+      return { ok: false, error: "invalid_sender" };281283     }282284 283285     if (shouldRefreshAutoLock(msg.type) && vault.isUnlocked()) {@@ -398,6 +400,14 @@398400           return { ok: false, error: "recovery_not_setup" };399401         }400402       }403+      case "GET_RECOVERY_CONFIRM_PENDING":404+        return { ok: true, data: await isRecoveryConfirmPending() };405+      case "SET_RECOVERY_CONFIRM_PENDING":406+        await setRecoveryConfirmPending();407+        return { ok: true };408+      case "CLEAR_RECOVERY_CONFIRM_PENDING":409+        await clearRecoveryConfirmPending();410+        return { ok: true };401411       case "RECOVER_WITH_WORDS": {402412         // User has lost their password but has their 12 recovery words.403413         // We: (1) validate the words, (2) re-encrypt vault with new password.@@ -1326,6 +1336,7 @@13261336         if (chrome.storage.session) {13271337           await chrome.storage.session.clear();13281338         }1339+        await clearRecoveryConfirmPending();13291340         return { ok: true };13301341       }13311342 

@@ -1,27 +1,45 @@1-// Persistent flag set while the user has just created a vault and is reading2-// their 12 recovery words but has not yet typed the 3 confirmation words.3-// While the flag is set: (a) lock-on-close and auto-lock are suppressed so4-// the in-memory key needed to re-derive the words survives a popup close, and5-// (b) on the next successful unlock (even after a full browser restart), the6-// popup re-routes to the recovery-words display instead of the entries view.7-//8-// Lives in chrome.storage.local so the flag survives browser restart. Cleared9-// on confirmation success and on DESTROY_VAULT (storage.local.clear()).1+// Background-owned state set while the user has just created or rotated a2+// vault identity and is confirming their recovery words. It intentionally3+// never lives in chrome.storage.local: content scripts can read/write local4+// storage unless the browser supports and has applied a trusted-context gate.5+// Chrome's session storage is in-memory and trusted-context-only by default;6+// Firefox falls back to this background module's memory for the same process.107 118 const KEY = "peach_recovery_pending";9+let inMemoryPending = false;1210 11+function sessionStorage(): chrome.storage.StorageArea | undefined {12+  return chrome.storage?.session;13+}14+1315 export async function isRecoveryConfirmPending(): Promise<boolean> {1416   try {15-    if (!chrome.storage?.local) return false;16-    const out = await chrome.storage.local.get(KEY);17+    const session = sessionStorage();18+    if (!session) return inMemoryPending;19+    const out = await session.get(KEY);1720     return (out as Record<string, unknown>)[KEY] === "1";1821   } catch {19-    return false;22+    return inMemoryPending;2023   }2124 }2225 2326 export async function setRecoveryConfirmPending(): Promise<void> {2427   try {25-    await chrome.storage.local?.set({ [KEY]: "1" });28+    const session = sessionStorage();29+    if (session) {30+      await session.set({ [KEY]: "1" });31+      return;32+    }33+  } catch { /* use the in-memory fallback */ }34+  inMemoryPending = true;35+}36+37+export async function clearRecoveryConfirmPending(): Promise<void> {38+  try {39+    const session = sessionStorage();40+    if (session) {41+      await session.remove(KEY);42+    }2643   } catch { /* best-effort */ }44+  inMemoryPending = false;2745 }

@@ -627,13 +627,12 @@627627     // If the user created a vault but hasn't yet confirmed their recovery628628     // words, route back to the recovery-words screen instead of opening the629629     // entries view. The flag lives in chrome.storage.local so it survives630-    // both popup close (SW suppresses lock-on-close) and full browser631-    // restart (handleUnlock checks the same flag after a fresh password632-    // unlock). Cleared when confirmation succeeds.630+    // popup close while the background owns the session-scoped confirmation631+    // exemption. Cleared when confirmation succeeds.633632     let recoveryPending = false;634633     try {635-      const out = await chrome.storage.local?.get("peach_recovery_pending");636-      recoveryPending = (out as { peach_recovery_pending?: string })?.peach_recovery_pending === "1";634+      const out = await sendMessage({ type: "GET_RECOVERY_CONFIRM_PENDING" });635+      recoveryPending = out.ok === true && out.data === true;637636     } catch { /* best-effort */ }638637 639638     // If this popup was opened from the inline "Open Peach to unlock" button,@@ -1025,14 +1024,14 @@10251024   async function handleUnlock() {10261025     // If the user previously created a vault but hadn't yet confirmed their10271026     // recovery words (and the browser was closed before they could), the1028-    // peach_recovery_pending flag is still set in storage.local. Re-route1027+    // the background-owned recovery-pending state is still set. Re-route10291028     // back to the recovery surface so they finish the confirmation step10301029     // before reaching the entries view — the words can be re-derived now10311030     // that the vault is unlocked again.10321031     let recoveryPending = false;10331032     try {1034-      const out = await chrome.storage.local?.get("peach_recovery_pending");1035-      recoveryPending = (out as { peach_recovery_pending?: string })?.peach_recovery_pending === "1";1033+      const out = await sendMessage({ type: "GET_RECOVERY_CONFIRM_PENDING" });1034+      recoveryPending = out.ok === true && out.data === true;10361035     } catch { /* best-effort */ }10371036     if (recoveryPending) {10381037       setForceRecoveryWords(true);

@@ -217,14 +217,10 @@217217     });218218     const result = response as { ok: boolean; error?: string };219219     if (result.ok) {220-      // Don't unlock yet — show the recovery words screen first. Mark the221-      // confirmation as pending in chrome.storage.local so it survives both222-      // popup close (lock-on-close skips while set) and full browser restart223-      // (next unlock re-routes to the recovery surface). Cleared when the224-      // user types the 3 confirmation words successfully.225-      try {226-        await chrome.storage.local?.set({ peach_recovery_pending: "1" });227-      } catch { /* best-effort */ }220+      // Don't unlock yet — show the recovery words screen first. The221+      // background owns this session-scoped exemption so content scripts222+      // cannot forge it through storage.local.223+      await sendMessage({ type: "SET_RECOVERY_CONFIRM_PENDING" });228224       setShowRecoveryWords(true);229225       setLoading(false);230226       return;

@@ -101,13 +101,12 @@101101 102102     setConfirmed(true);103103     setConfirmError("");104-    // Clear the recovery-pending flag so lock-on-close / auto-lock resume104+    // Clear the background-owned recovery-pending state so lock-on-close /105+    // auto-lock resume105106     // their normal behavior and future unlocks no longer re-route here.106107     // Once the user has confirmed the words, losing the in-memory key is107108     // no longer a data-loss event.108-    try {109-      await chrome.storage.local?.remove("peach_recovery_pending");110-    } catch { /* best-effort */ }109+    await sendMessage({ type: "CLEAR_RECOVERY_CONFIRM_PENDING" });111110     // Small pause so user sees the success state, then proceed.112111     await new Promise((r) => setTimeout(r, 600));113112     props.onDone();@@ -247,4 +246,4 @@247246   document.body.appendChild(a);248247   a.click();249248   a.remove();250-}\ No newline at end of file249+}

@@ -694,10 +694,9 @@694694       setChangePwCurrent(""); setChangePwNew(""); setChangePwConfirm("");695695       setShowChangePw(false);696696       // LV-4: the user just authenticated (current password), so the recovery697-      // words reveal that follows is exempt from the re-auth gate. Set the698-      // pending flag the same way the create/recovery flow does; the display699-      // clears it on confirm.700-      await chrome.storage?.local?.set?.({ peach_recovery_pending: "1" });697+      // words reveal that follows is exempt from the re-auth gate. The698+      // background owns this session-scoped exemption; the display clears it.699+      await sendMessage({ type: "SET_RECOVERY_CONFIRM_PENDING" });701700       setShowNewRecoveryWords(true);702701     } else {703702       setChangePwError(res.error ?? "failed to change password");

@@ -289,6 +289,9 @@289289   | "VALIDATE_RECOVERY_WORDS"290290   | "RECOVER_WITH_WORDS"291291   | "GET_RECOVERY_WORDS"292+  | "GET_RECOVERY_CONFIRM_PENDING"293+  | "SET_RECOVERY_CONFIRM_PENDING"294+  | "CLEAR_RECOVERY_CONFIRM_PENDING"292295   | "GET_IDENTITY_SUGGESTIONS"293296   | "TOUCH_AUTO_LOCK"294297   | "SAVE_NOTE"