Merge pull request #56 from Chocapikk/fix/security-hardening

Fix: Critical security hardening

Author: SystemVll

src-tauri/Cargo.lock

@@ -26,3 +26,4 @@ libreauth = "0.18.1"
 uuid = { version = "1.20.0", features = ["v4"] }
 zeroize = { version = "1.8.2", features = ["zeroize_derive"] }
 memsec = "0.7.0"
+argon2 = "0.5"

src-tauri/Cargo.toml

@@ -7,32 +7,39 @@ mod vault;
 
 #[tauri::command]
 fn resolve_twofactor(password: &str, uid: &str) -> Value {
-    let mut container = driver::read(password);
-
-    let credentials = container.as_array_mut().unwrap();
-
-    let credential = credentials.iter_mut().find(|credential| {
-        let credential = credential.as_object().unwrap();
-        let id = credential.get("uid").unwrap().as_str().unwrap();
-
-        id == uid
-    });
-
-    let credential_obj = credential.unwrap().as_object_mut().unwrap();
-
-    let credentials = credential_obj
-        .get_mut("credential")
-        .unwrap()
-        .as_object_mut()
-        .unwrap();
-
-    let secret = credentials.get("twoFactor").unwrap().as_str().unwrap();
-    let totp = TOTPBuilder::new().base32_key(secret).finalize().unwrap();
-
-    let code = totp.generate();
-    let response: Value = json!({ "success": true, "code": code });
+    let container = driver::read(password);
 
-    response
+    let credentials = match container.as_array() {
+        Some(arr) => arr,
+        None => return json!({ "success": false, "message": "Failed to read vault" }),
+    };
+
+    let credential = match credentials.iter().find(|c| {
+        c.as_object()
+            .and_then(|obj| obj.get("uid"))
+            .and_then(|id| id.as_str())
+            .map(|id| id == uid)
+            .unwrap_or(false)
+    }) {
+        Some(c) => c,
+        None => return json!({ "success": false, "message": "Credential not found" }),
+    };
+
+    let secret = match credential
+        .get("credential")
+        .and_then(|c| c.get("twoFactor"))
+        .and_then(|t| t.as_str())
+    {
+        Some(s) => s,
+        None => return json!({ "success": false, "message": "No 2FA secret found" }),
+    };
+
+    let totp = match TOTPBuilder::new().base32_key(secret).finalize() {
+        Ok(t) => t,
+        Err(_) => return json!({ "success": false, "message": "Invalid 2FA secret" }),
+    };
+
+    json!({ "success": true, "code": totp.generate() })
 }
 
 #[tauri::command]
@@ -52,50 +59,60 @@ fn export_credentials(password: &str) -> Value {
         return json!({ "success": false, "message": "Authentication failed. Invalid password." });
     }
 
-    let response: Value = json!({ "success": true, "data": data });
-
-    response
+    json!({ "success": true, "data": data })
 }
 
 #[tauri::command]
 fn remove_credentials(password: &str, uid: &str) -> Value {
     let mut container = driver::read(password);
-    let credentials = container.as_array_mut().unwrap();
 
-    credentials.retain(|credential| {
-        let credential = credential.as_object().unwrap();
-        let id = credential.get("uid").unwrap().as_str().unwrap();
+    let credentials = match container.as_array_mut() {
+        Some(arr) => arr,
+        None => return json!({ "success": false, "message": "Failed to read vault" }),
+    };
 
-        id != uid
+    credentials.retain(|credential| {
+        credential
+            .as_object()
+            .and_then(|obj| obj.get("uid"))
+            .and_then(|id| id.as_str())
+            .map(|id| id != uid)
+            .unwrap_or(true)
     });
 
     driver::write(password, json!(credentials));
 
-    let response: Value = json!({ "success": true });
-
-    response
+    json!({ "success": true })
 }
 
 #[tauri::command]
 fn update_credential(password: &str, uid: &str, credential_type: &str, credential: Value) -> Value {
     let mut container = driver::read(password);
-    let credentials = container.as_array_mut().unwrap();
 
-    for item in credentials.iter_mut() {
-        let credential_obj = item.as_object_mut().unwrap();
-        let id = credential_obj.get("uid").unwrap().as_str().unwrap();
+    let credentials = match container.as_array_mut() {
+        Some(arr) => arr,
+        None => return json!({ "success": false, "message": "Failed to read vault" }),
+    };
 
-        if id == uid {
-            credential_obj.insert("type".to_string(), json!(credential_type));
-            credential_obj.insert("credential".to_string(), credential.clone());
-            break;
+    for item in credentials.iter_mut() {
+        if let Some(obj) = item.as_object_mut() {
+            let matches = obj
+                .get("uid")
+                .and_then(|id| id.as_str())
+                .map(|id| id == uid)
+                .unwrap_or(false);
+
+            if matches {
+                obj.insert("type".to_string(), json!(credential_type));
+                obj.insert("credential".to_string(), credential.clone());
+                break;
+            }
         }
     }
 
     driver::write(password, json!(credentials));
 
-    let response: Value = json!({ "success": true });
-    response
+    json!({ "success": true })
 }
 
 #[tauri::command]
@@ -104,7 +121,11 @@ fn add_credential(password: &str, credential_type: &str, credential: Value) -> V
 
     let uid = Uuid::new_v4().to_string();
 
-    let credentials = container.as_array_mut().unwrap();
+    let credentials = match container.as_array_mut() {
+        Some(arr) => arr,
+        None => return json!({ "success": false, "message": "Failed to read vault" }),
+    };
+
     credentials.push(json!({
         "uid": uid,
         "type": credential_type,
@@ -113,9 +134,7 @@ fn add_credential(password: &str, credential_type: &str, credential: Value) -> V
 
     driver::write(password, json!(credentials));
 
-    let response: Value = json!({ "success": true });
-
-    response
+    json!({ "success": true })
 }
 
 #[tauri::command]
@@ -125,30 +144,23 @@ fn get_credentials(password: &str) -> Result<Vec<Value>, String> {
         return Err("Authentication failed. Invalid password.".to_string());
     }
 
-    let response: Vec<Value> = data
+    let credentials = data
         .as_array()
-        .unwrap()
+        .ok_or("Invalid vault format")?;
+
+    let response: Vec<Value> = credentials
         .iter()
         .map(|credential| {
             let mut credential = credential.clone();
-            let credential_obj = credential.as_object_mut().unwrap();
-
-            let credentials = credential_obj
-                .get_mut("credential")
-                .unwrap()
-                .as_object_mut()
-                .unwrap();
-
-            let twofactor = credentials
-                .entry("twoFactor")
-                .or_insert(serde_json::Value::Bool(false));
-
-            if twofactor.is_boolean() {
-                *twofactor = serde_json::Value::Bool(false);
-            } else {
-                *twofactor = serde_json::Value::Bool(true);
+            if let Some(obj) = credential.as_object_mut() {
+                if let Some(creds) = obj.get_mut("credential").and_then(|c| c.as_object_mut()) {
+                    let has_twofactor = creds
+                        .get("twoFactor")
+                        .map(|t| t.is_string())
+                        .unwrap_or(false);
+                    creds.insert("twoFactor".to_string(), Value::Bool(has_twofactor));
+                }
             }
-
             credential
         })
         .collect();
@@ -162,20 +174,32 @@ fn register(password: &str) -> Value {
 
     driver::write(password, json!([]));
 
-    let response: Value = json!({ "success": true });
-
-    response
+    json!({ "success": true })
 }
 
 #[tauri::command]
 fn login(password: &str) -> bool {
-    let container = driver::read(password);
-
-    if container.is_array() {
-        return true;
+    let container_path = vault::get_container_path();
+    let encrypted_data = match std::fs::read(&container_path) {
+        Ok(data) => data,
+        Err(_) => return false,
+    };
+
+    // Try legacy format first (fast, no KDF)
+    if let Ok(plaintext) = vault::decrypt_legacy_public(password, &encrypted_data) {
+        if let Ok(container) = serde_json::from_str::<serde_json::Value>(&plaintext) {
+            if container.is_array() {
+                // Re-encrypt with Argon2id
+                driver::write(password, container);
+                return true;
+            }
+        }
+        return false;
     }
 
-    false
+    // Try new Argon2id format
+    let container = driver::read(password);
+    container.is_array()
 }
 
 #[tauri::command]