Replaced insecure string comparison with `secrets.compare_digest` in `_check_token` to prevent timing attacks.
Added a test case for missing token to ensure robust error handling.
Co-authored-by: PR0M3TH3AN <[email protected]>
Introduced a random salt to key derivation for parent seed encryption to prevent rainbow table attacks. The salt is now stored in the `parent_seed.enc` file header (V3 format).
* Modified `src/utils/key_derivation.py` to accept optional `salt` argument.
* Modified `src/seedpass/core/encryption.py` to read/write salt in `parent_seed.enc` using V3 format (V3:salt:nonce:ciphertext).
* Modified `src/seedpass/core/manager.py` to generate salt for new seeds and read salt for existing ones.
* Added auto-upgrade logic for legacy (no salt) seeds upon access.
* Updated tests to verify salt usage and backward compatibility.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `InMemorySecret.get_bytes()` in `src/utils/memory_protection.py` to raise a `RuntimeError` if the secret has been wiped, replacing the previous `AttributeError`.
- Added `test_access_after_wipe_raises_error` to `src/tests/test_memory_protection.py` to verify this behavior.
Co-authored-by: PR0M3TH3AN <[email protected]>
The `backup_parent_seed` API endpoint was vulnerable to arbitrary file write via path traversal.
The `path` parameter was used directly to create a `Path` object, which was then passed to `_pm.handle_backup_reveal_parent_seed`.
This allowed an attacker to specify an arbitrary path (e.g., `../../evil_file`), which would be used by `encrypt_and_save_file` to write the encrypted seed to that location.
This commit fixes the vulnerability by validating that the `path` parameter is a valid filename (i.e., does not contain path separators or parent directory references) before processing it. This ensures that the backup file is always created within the intended fingerprint directory.
Co-authored-by: PR0M3TH3AN <[email protected]>
Removed the `print` statement in `src/seedpass/api.py` that leaked the
API token to stdout.
Enhanced the API server and CLI to support secure token management:
- Added `SEEDPASS_API_TOKEN` environment variable support in both
`api.py` and `cli.py`.
- Added a `--token` option to the `api start` CLI command.
- Redirected the auto-generated token output to stderr instead of stdout.
- Updated `api stop` to respect the `SEEDPASS_API_TOKEN` environment
variable.
These changes prevent the API token from being easily logged in insecure
environments where stdout is captured.
Co-authored-by: PR0M3TH3AN <[email protected]>
Removed the `test()` and `testall()` functions and the `if __name__ == "__main__":` block which were used for manual testing and are not needed by the codebase.
This improves maintainability and readability by focusing the module on its core functionality.
Co-authored-by: PR0M3TH3AN <[email protected]>
