Audit logs, stricter signing, and fetch rpc gasPrice #124

hashmesan · 2022-02-23T19:15:20Z

Changes in this PR (1.2.7)

Audit Logs

Audit logs are event logging stored in chrome.storage (higher storage limits than localStorage). It stores all the internalEvents, externalEvents, as well as any decrypt fails, successful send one, send token, stake, sign transaction.

Logs can be downloaded from settings menu as JSON.

Strict Signing

Any signing in the .vue files were moved into the services level, isolating from view possible access
Remove "privateKey" states variables in vue, thus removing from memory
Remove of static "harmony" instances which privateKeys were injected and kept in memory

Misc

Dynamic RPC gasPrice fetching
Previous un-merged PR for docker build process

…ecksums

* Using metamask ob-store to sync chrome storage and logs * pass password instead of private key down to service level * event logging for decrypt key error, sign, send, sign, and staking * removal of harmony static instance (storing private key) * removal of privatekey in vue states

…ion-wallet into audit+strict

hashmesan · 2022-02-23T21:14:39Z

BUILD: onewallet.zip

Checksums

f154b1cb14edddb503f0eb206fc02619  dist/background.js
a977b17761041948fbf5fb078e3516d5  dist/content-script.js
56b83367de1bad67f158c51ac140006a  dist/inject-script.js
65279d2f01367823f85977f02fd36293  dist/popup.js
604c6d74953a59aedc1af4c4f0b94e16  dist/popup.html

polymorpher · 2022-03-05T07:16:38Z

src/popup/pages/Settings/Security/Logs.vue

+        chrome.runtime.sendMessage(
+            { action: GET_LOGS },
+            async (state) => {
+                var blob = new Blob([JSON.stringify(state, null, '\t')], {type: "application/json;charset=utf-8"});


JSON stringify can be quite slow if state has a large number of rows (array elements). But I think in most cases it should be fine

polymorpher · 2022-03-05T07:36:34Z

The change looks good. Reviewing all code from scratch and testing

polymorpher · 2022-03-05T09:19:11Z

src/popup/pages/API/SignTransaction.vue

@@ -275,12 +275,11 @@ export default {
        this.$notify({
          group: "notify",
          type: "error",
-          text: err.message,
+          text: this.caption,


Sanitize this to prevent injection? See Matthew's report

Added lodash escape in new commit

polymorpher · 2022-03-05T09:22:45Z

Code looks good (checked independent of the diffs)

polymorpher · 2022-03-05T09:40:46Z

package.json

@@ -10,7 +10,7 @@
  },
  "scripts": {
    "dev": "NODE_ENV=development webpack --progress --watch",
-    "build": "NODE_ENV=production webpack --progress && md5sum dist/*.js dist/*.html > dist/checksums.md5"
+    "build": "NODE_ENV=production webpack --progress && cd dist && find -type f -exec md5sum {} \\;|sort -s > checksums.md5"


find... filter for .html and .js?

Changed so the output path in md5 doesn't have the "dist" so you can compare checksum easier. Everything is relative to the current directory. Also opened up to any files checksums just in case...

polymorpher · 2022-03-09T04:56:44Z

Hash confirmed. Transfer and Delegate operations are tested. Signing (smart contract call), personal sign (offline), undelegate, and collectreward are not tested yet

9dd83b1e280ac286a73d1dd77d1a630e  onewallet.zip



f154b1cb14edddb503f0eb206fc02619  onewallet/background.js
a977b17761041948fbf5fb078e3516d5  onewallet/content-script.js
56b83367de1bad67f158c51ac140006a  onewallet/inject-script.js
b848e51f945486bc2ed9c6d132be76fa  onewallet/popup.js
604c6d74953a59aedc1af4c4f0b94e16  onewallet/popup.html

hashmesan · 2022-03-10T21:29:26Z

@polymorpher

New checksum is

f154b1cb14edddb503f0eb206fc02619  dist/background.js
a977b17761041948fbf5fb078e3516d5  dist/content-script.js
56b83367de1bad67f158c51ac140006a  dist/inject-script.js
65279d2f01367823f85977f02fd36293  dist/popup.js
604c6d74953a59aedc1af4c4f0b94e16  dist/popup.html

polymorpher · 2022-03-10T22:33:00Z

New changes look good. Also I got hashes

f154b1cb14edddb503f0eb206fc02619  onewallet/background.js
a977b17761041948fbf5fb078e3516d5  onewallet/content-script.js
56b83367de1bad67f158c51ac140006a  onewallet/inject-script.js
ce8793e5caccd76ef073947346e533ca  onewallet/popup.js
604c6d74953a59aedc1af4c4f0b94e16  onewallet/popup.html

hashmesan · 2022-03-11T00:08:56Z

It was cached. I added echo to break it..

FROM node:14

WORKDIR /usr/src/app
RUN echo 1 # increment this
RUN git clone https://github.com/harmony-one/chrome-extension-wallet.git
WORKDIR /usr/src/app/chrome-extension-wallet
RUN git fetch origin pull/124/head
RUN npm install
RUN npm run build

It matches now:

f154b1cb14edddb503f0eb206fc02619  dist/background.js
a977b17761041948fbf5fb078e3516d5  dist/content-script.js
56b83367de1bad67f158c51ac140006a  dist/inject-script.js
ce8793e5caccd76ef073947346e533ca  dist/popup.js
604c6d74953a59aedc1af4c4f0b94e16  dist/popup.html

hashmesan · 2022-03-11T16:51:49Z

@polymorpher Previous build didn't checkout PR.

This is the correct Dockerfile

FROM node:14

WORKDIR /usr/src/app
RUN git clone https://github.com/harmony-one/chrome-extension-wallet.git
WORKDIR /usr/src/app/chrome-extension-wallet
RUN git fetch origin pull/124/head && git checkout FETCH_HEAD
RUN git log -3
RUN npm install
RUN npm run build

and build without cache

docker build -t chrome-build --no-cache .

polymorpher · 2022-03-12T08:43:56Z

okay, hashes are

27271cad9dc90f25a7f2eab2861eab2b  onewallet/background.js
156770284f99f8e9019a15f7419c34f5  onewallet/content-script.js
c163f7329920e2e512dcfc3e63410711  onewallet/inject-script.js
6fe27b144e95dfd5110067afde96ed54  onewallet/popup.js
604c6d74953a59aedc1af4c4f0b94e16  onewallet/popup.html

polymorpher · 2022-03-14T19:48:08Z

I think this is ready for a release

hashmesan · 2022-03-15T19:56:17Z

Signatures match -- all go for release.

012cf6a10129e2275d79d6adac7f3b02  ./fonts/MaterialIcons-Regular.woff
1484aa61aca6d60d7818332e5b8664c6  ./images/harmony-big.png
156770284f99f8e9019a15f7419c34f5  ./content-script.js   YES
27271cad9dc90f25a7f2eab2861eab2b  ./background.js YES
2b470564821c19dc383cf82898a868e4  ./images/ethereum.svg
4528eed8118cc703671f71957fd87c4d  ./images/[email protected]
4d0322f2fda4a30ee3a898757c47977f  ./icons/48.ico
570eb83859dc23dd0eec423a49e147fe  ./fonts/MaterialIcons-Regular.woff2
604c6d74953a59aedc1af4c4f0b94e16  ./popup.html
68913d3bc039d80bd467980faa9d51d3  ./icons/32.ico
6fe27b144e95dfd5110067afde96ed54  ./popup.js YEES
874b4b4ebaec45c6c0e05387e9f6d691  ./icons/128.ico
8e32989352f3d547ebc63d3510b55f0a  ./images/ledger.svg
8ed9856b3f59fcf36200322dc557deef  ./images/NFT_Icon.png
9016d84af20bc6da450d59f12aea1312  ./images/[email protected]
a022c272f8a0684cb05231175d5e7801  ./images/logo-blue.png
a37b0c01c0baf1888ca812cc0508f6e2  ./fonts/MaterialIcons-Regular.ttf
aee863680e754c3dca89e3b36a51aec1  ./images/harmony.png
c163f7329920e2e512dcfc3e63410711  ./inject-script.js YES
d41d8cd98f00b204e9800998ecf8427e  ./checksums.md5
d46d16a8c8e007d131c9723b385f9fff  ./images/harmony-small.png
e79bfd88537def476913f3ed52f4f4b3  ./fonts/MaterialIcons-Regular.eot
f49efa127672ce747c4420b7e82722ad  ./manifest.json
facc320e952f28067026f857a6a87862  ./icons/16.ico

polymorpher · 2022-03-16T04:11:59Z

merge this? since it is already deployed

hashmesan · 2022-03-17T16:26:08Z

Updated build. All the scripts checksums are the same. The only file changed is the manifest.json.
onewallet.zip

polymorpher · 2022-03-18T19:36:16Z

27271cad9dc90f25a7f2eab2861eab2b  onewallet/background.js
156770284f99f8e9019a15f7419c34f5  onewallet/content-script.js
c163f7329920e2e512dcfc3e63410711  onewallet/inject-script.js
d4a7f353b15d476b897c16a138cf877e  onewallet/popup.js
604c6d74953a59aedc1af4c4f0b94e16  onewallet/popup.html

polymorpher · 2022-03-18T19:36:25Z

I also changed version to 1.2.8

…tension-wallet into audit+strict

…odal to re-implement the modal;

hashmesan · 2022-03-19T14:19:11Z

New build for modaljs fix

onewallet.zip

83c6ac4975b001cb2912c50515f600e9  ./inject-script.js
9750b2210ecf5a2742b08f91f89da993  ./background.js
b97a025a8fe2532f9f9fa638c5756992  ./popup.js
c0684567a05868201c4bd8290b75da5f  ./manifest.json
f867f05b8c8ea89abe5b0eea2f87ac5b  ./content-script.js

polymorpher · 2022-03-19T19:17:42Z

I built with termsModal set to width: "100%", height: "600px”

9750b2210ecf5a2742b08f91f89da993  onewallet/background.js
f867f05b8c8ea89abe5b0eea2f87ac5b  onewallet/content-script.js
83c6ac4975b001cb2912c50515f600e9  onewallet/inject-script.js
b97a025a8fe2532f9f9fa638c5756992  onewallet/popup.js
604c6d74953a59aedc1af4c4f0b94e16  onewallet/popup.html
c0684567a05868201c4bd8290b75da5f  onewallet/manifest.json

hashmesan added 10 commits January 24, 2022 17:08

Docker build process for consistent fingerprint

9dfdc39

add package-lock.json so we have consistent build deps, and output ch…

6b495bf

…ecksums

moving sign to service layer

76bfaf0

add time to eventlogging, download logs UI

3ab8d36

get gasPrice from RPC

dd2abe3

logging on all in/out events

8f8bd6d

supress logging, fixed staking tx

13f2bcf

Merge branch 'master' of https://github.com/harmony-one/chrome-extens…

9b5fb4b

…ion-wallet into audit+strict

updated package-lock to include metamask/obs-store

63378ab

polymorpher reviewed Mar 5, 2022

View reviewed changes

hashmesan added 2 commits March 7, 2022 12:57

escape text

3ef22a4

end of service accept & footer

f9e45e6

ensure terms accept show on create wallet

ad52c2d

removed unused activeTab - chrome store rejecting

e9359e9

hashmesan added 3 commits March 18, 2022 13:40

Added auth route to trigger terms for existing user

0cdd3f7

Updated modal link

b596c28

Changed link on red bar on account

0835caf

hashmesan added 3 commits March 18, 2022 16:43

bump to 1.2.8

5d948f9

Merge branch 'audit+strict' of https://github.com/hashmesan/chrome-ex…

14fd787

…tension-wallet into audit+strict

Route overriding for terms Modal is not working well. Using vue-js-md…

a33eabb

…odal to re-implement the modal;

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Audit logs, stricter signing, and fetch rpc gasPrice #124

Audit logs, stricter signing, and fetch rpc gasPrice #124

hashmesan commented Feb 23, 2022

hashmesan commented Feb 23, 2022

polymorpher Mar 5, 2022

polymorpher commented Mar 5, 2022

polymorpher Mar 5, 2022

hashmesan Mar 7, 2022

polymorpher commented Mar 5, 2022

polymorpher Mar 5, 2022

hashmesan Mar 7, 2022

polymorpher commented Mar 9, 2022

hashmesan commented Mar 10, 2022

polymorpher commented Mar 10, 2022 •

edited

Loading

hashmesan commented Mar 11, 2022

hashmesan commented Mar 11, 2022

polymorpher commented Mar 12, 2022

polymorpher commented Mar 14, 2022

hashmesan commented Mar 15, 2022

polymorpher commented Mar 16, 2022

hashmesan commented Mar 17, 2022

polymorpher commented Mar 18, 2022

polymorpher commented Mar 18, 2022

hashmesan commented Mar 19, 2022

polymorpher commented Mar 19, 2022

Audit logs, stricter signing, and fetch rpc gasPrice #124

Are you sure you want to change the base?

Audit logs, stricter signing, and fetch rpc gasPrice #124

Conversation

hashmesan commented Feb 23, 2022

Changes in this PR (1.2.7)

Audit Logs

Strict Signing

Misc

hashmesan commented Feb 23, 2022

polymorpher Mar 5, 2022

Choose a reason for hiding this comment

polymorpher commented Mar 5, 2022

polymorpher Mar 5, 2022

Choose a reason for hiding this comment

hashmesan Mar 7, 2022

Choose a reason for hiding this comment

polymorpher commented Mar 5, 2022

polymorpher Mar 5, 2022

Choose a reason for hiding this comment

hashmesan Mar 7, 2022

Choose a reason for hiding this comment

polymorpher commented Mar 9, 2022

hashmesan commented Mar 10, 2022

polymorpher commented Mar 10, 2022 • edited Loading

hashmesan commented Mar 11, 2022

hashmesan commented Mar 11, 2022

polymorpher commented Mar 12, 2022

polymorpher commented Mar 14, 2022

hashmesan commented Mar 15, 2022

polymorpher commented Mar 16, 2022

hashmesan commented Mar 17, 2022

polymorpher commented Mar 18, 2022

polymorpher commented Mar 18, 2022

hashmesan commented Mar 19, 2022

polymorpher commented Mar 19, 2022

polymorpher commented Mar 10, 2022 •

edited

Loading