From 1ddfa95a843ddb9a4d90f22095d04a07304160ea Mon Sep 17 00:00:00 2001 From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com> Date: Tue, 4 Aug 2026 16:13:09 -0400 Subject: [PATCH] [auth] Vendor BitLogin 30b4f34 and allow WASM in the app CSP Picks up BitLogin's login-surface expansion (NIP-07 extension, NIP-46 remote signer with nostrconnect QR, passkey sign-in), three rounds of adversarial-audit fixes, and the mandatory recovery-phrase ceremony for passkey-created accounts. Vendored via scripts/build-bitlogin-widget.mjs, which pins the source commit in vendor/bitlogin.integrity.json; the shared-chunk hashes changed, so three old chunks are removed and three new ones added. CSP fix, required for sign-in to work at all: BitLogin's crypto worker compiles an Argon2id WASM module, and index.html's script-src had no 'wasm-unsafe-eval', so WebAssembly.compile would be blocked and every BitLogin password flow would fail -- silently, because the page still loads. This exact omission broke sign-in on bitlogin.network for four days. The keyword permits WASM compilation only; JS eval stays blocked, and the CSP comment's stale "no bundle uses wasm" claim is corrected. tests/csp-policy.test.mjs now pins the keyword for index.html so it cannot be dropped again. Baseline verified unchanged: npm run test:unit green, npm run lint clean, and the raw tests/*.test.mjs glob fails the same 10 pre-existing files before and after this change. test_integrity_note: change_type: ["new_tests"] scenarios: - id: SCN-csp-allows-wasm-for-bitlogin given: "index.html mounts , whose worker compiles an Argon2id WASM module" when: "the page's Content-Security-Policy script-src is evaluated" then: "'wasm-unsafe-eval' is present, so WebAssembly.compile is permitted while 'unsafe-eval' remains absent" observable_outcomes: - "script-src directive parsed from the index.html CSP meta tag contains 'wasm-unsafe-eval'" - "existing assertions still forbid 'unsafe-inline' and 'unsafe-eval'" determinism_controls: - "pure static parse of a committed HTML file; no clock, network, or browser" anti_cheat_rationale: prevents: - "silently relaxing script-src to make sign-in work" - "dropping the keyword and shipping a login page that cannot run Argon2id" relaxation: did_relax_any_assertion: false if_true_explain_spec_basis: "" --- index.html | 10 +- tests/csp-policy.test.mjs | 12 + vendor/bitlogin.integrity.json | 28 +- ...Tz11m56.js => bitlogin-shared-CEfP5Eg9.js} | 121 +- ...xVSgyOf.js => bitlogin-shared-Co4_WTb5.js} | 4 +- ...Zs4uvXt.js => bitlogin-shared-DeDxZ3Jc.js} | 2 +- vendor/bitlogin/bitlogin.js | 2305 ++++++++++++++-- vendor/bitlogin/cryptoWorker.js | 2357 ++++++++++------- 8 files changed, 3589 insertions(+), 1250 deletions(-) rename vendor/bitlogin/{bitlogin-shared-DTz11m56.js => bitlogin-shared-CEfP5Eg9.js} (99%) rename vendor/bitlogin/{bitlogin-shared-BxVSgyOf.js => bitlogin-shared-Co4_WTb5.js} (99%) rename vendor/bitlogin/{bitlogin-shared--Zs4uvXt.js => bitlogin-shared-DeDxZ3Jc.js} (99%) diff --git a/index.html b/index.html index a7acd634..845f565f 100644 --- a/index.html +++ b/index.html @@ -6,8 +6,12 @@ Content-Security-Policy: defense-in-depth against XSS. The critical directive is script-src, which is strict — only same-origin scripts, the hash of the inline theme-bootstrap below, and the nostr-tools CDN - fallbacks (js/nostrToolsBootstrap.js). No 'unsafe-inline'/'unsafe-eval' - (verified: no bundle uses eval/Function/wasm). This blocks injected + fallbacks (js/nostrToolsBootstrap.js). No 'unsafe-inline'/'unsafe-eval'. + 'wasm-unsafe-eval' IS required: BitLogin's crypto worker compiles an + Argon2id WASM module, and a script-src without it blocks + WebAssembly.compile and breaks every BitLogin password flow. That + keyword permits WASM compilation only — JS eval stays blocked. This + blocks injected script and object elements, inline handlers (none exist), and base-tag hijack, so an injected payload cannot execute and read the in-memory storage master key / signer / DM plaintext. connect/img/media stay broad @@ -19,7 +23,7 @@ --> bitvid | Decentralized Video Sharing diff --git a/tests/csp-policy.test.mjs b/tests/csp-policy.test.mjs index 6f3e1bea..274889c0 100644 --- a/tests/csp-policy.test.mjs +++ b/tests/csp-policy.test.mjs @@ -87,6 +87,18 @@ for (const file of ["index.html", "embed.html"]) { ["'self'"], "base-uri must be 'self'", ); + + // index.html mounts (components/login-modal.html), whose + // crypto worker compiles an Argon2id WASM module. Without + // 'wasm-unsafe-eval' the browser blocks WebAssembly.compile and EVERY + // BitLogin password flow fails -- silently, since the page still loads. + // This exact omission broke sign-in on bitlogin.network for four days. + if (file === "index.html") { + assert.ok( + scriptSrc.includes("'wasm-unsafe-eval'"), + "script-src must include 'wasm-unsafe-eval' or BitLogin sign-in breaks", + ); + } }); test(`${file}: every inline