refactor: async credential I/O, dropdown filtering, remove email masking

Author: bittoby

electron/main/index.ts

@@ -2310,11 +2310,14 @@ function registerIpcHandlers() {
   });
 
   // ==================== saved accounts handler ====================
+  // Security: use OS-backed encryption (safeStorage), strict validation, size limits,
+  // and generic error messages to avoid leaking paths or internal details.
   type SavedAccount = {
     email: string;
     token: string;
     username: string;
     user_id: number;
+    password: string;
   };
 
   const ACCOUNTS_FILE = path.join(
@@ -2323,25 +2326,89 @@ function registerIpcHandlers() {
     'saved_accounts.enc'
   );
 
+  const SAVED_ACCOUNTS_MAX = 20;
+  const SAVED_ACCOUNTS_MAX_FILE_BYTES = 1024 * 1024; // 1 MB max encrypted file
+  const SAVED_ACCOUNTS_MAX_DECRYPTED_BYTES = 512 * 1024; // 512 KB max decrypted JSON
+  const EMAIL_MAX_LENGTH = 320;
+  const PASSWORD_MAX_LENGTH = 2048;
+  const TOKEN_MAX_LENGTH = 4096;
+  const USERNAME_MAX_LENGTH = 256;
+  const CREDENTIALS_GENERIC_ERROR = 'Operation failed';
+
+  const trimEmail = (value: unknown): string => {
+    if (typeof value !== 'string') return '';
+    return value.trim().slice(0, EMAIL_MAX_LENGTH);
+  };
+
+  /** Normalize email for storage and comparison (lowercase, trimmed). */
+  const normalizeEmail = (value: unknown): string =>
+    trimEmail(value).toLowerCase();
+
+  const isValidEmailFormat = (email: string): boolean =>
+    email.length > 0 && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+
+  const sanitizeString = (value: unknown, maxLen: number): string =>
+    typeof value === 'string' ? value.slice(0, maxLen) : '';
+
   const readSavedAccounts = async (): Promise<SavedAccount[]> => {
     try {
       if (!safeStorage.isEncryptionAvailable()) {
         return [];
       }
       const encrypted = await fsp.readFile(ACCOUNTS_FILE).catch(() => null);
-      if (!encrypted) return [];
+      if (!encrypted || encrypted.length === 0) return [];
+      if (encrypted.length > SAVED_ACCOUNTS_MAX_FILE_BYTES) {
+        return [];
+      }
       const decrypted = safeStorage.decryptString(encrypted);
-      const parsed = JSON.parse(decrypted);
-      // Filter out any entries from the old password-based format.
-      // Only email and token are required; user_id may be string or number
-      // depending on what the login API actually returns at runtime.
-      return (Array.isArray(parsed) ? parsed : []).filter(
-        (a) =>
-          typeof a.email === 'string' &&
-          a.email.length > 0 &&
-          typeof a.token === 'string' &&
-          a.token.length > 0
-      );
+      if (
+        typeof decrypted !== 'string' ||
+        decrypted.length > SAVED_ACCOUNTS_MAX_DECRYPTED_BYTES
+      ) {
+        return [];
+      }
+      const parsed: unknown = JSON.parse(decrypted);
+      if (!Array.isArray(parsed)) return [];
+      const result: SavedAccount[] = [];
+      const seenEmails = new Set<string>();
+      for (const a of parsed) {
+        if (!a || typeof a !== 'object') continue;
+        const rawEmail = trimEmail((a as Record<string, unknown>).email);
+        if (!rawEmail || !isValidEmailFormat(rawEmail)) continue;
+        const email = rawEmail.toLowerCase();
+        if (seenEmails.has(email)) continue;
+        seenEmails.add(email);
+        const token = sanitizeString(
+          (a as Record<string, unknown>).token,
+          TOKEN_MAX_LENGTH
+        );
+        const password = sanitizeString(
+          (a as Record<string, unknown>).password,
+          PASSWORD_MAX_LENGTH
+        );
+        if (token.length === 0 && password.length === 0) continue;
+        const username = sanitizeString(
+          (a as Record<string, unknown>).username,
+          USERNAME_MAX_LENGTH
+        );
+        const rawId = (a as Record<string, unknown>).user_id;
+        const user_id =
+          typeof rawId === 'number' && Number.isFinite(rawId)
+            ? rawId
+            : typeof rawId === 'string'
+              ? parseInt(rawId, 10)
+              : 0;
+        if (!Number.isFinite(user_id) || user_id < 0) continue;
+        result.push({
+          email,
+          token,
+          username,
+          user_id: user_id as number,
+          password,
+        });
+        if (result.length >= SAVED_ACCOUNTS_MAX) break;
+      }
+      return result;
     } catch {
       return [];
     }
@@ -2351,9 +2418,10 @@ function registerIpcHandlers() {
     if (!safeStorage.isEncryptionAvailable()) {
       throw new Error('Encryption not available');
     }
+    const toWrite = accounts.slice(0, SAVED_ACCOUNTS_MAX);
     const dir = path.dirname(ACCOUNTS_FILE);
-    await fsp.mkdir(dir, { recursive: true });
-    const encrypted = safeStorage.encryptString(JSON.stringify(accounts));
+    await fsp.mkdir(dir, { recursive: true, mode: 0o700 });
+    const encrypted = safeStorage.encryptString(JSON.stringify(toWrite));
     await fsp.writeFile(ACCOUNTS_FILE, encrypted);
     await fsp.chmod(ACCOUNTS_FILE, 0o600);
   };
@@ -2362,23 +2430,50 @@ function registerIpcHandlers() {
     'credentials-save',
     async (
       _event,
-      email: string,
-      token: string,
-      username: string,
-      user_id: number
+      email: unknown,
+      token: unknown,
+      username: unknown,
+      user_id: unknown,
+      password: unknown
     ) => {
       try {
+        const emailStr = normalizeEmail(email);
+        if (!emailStr || !isValidEmailFormat(emailStr)) {
+          return { success: false, error: CREDENTIALS_GENERIC_ERROR };
+        }
+        const tokenStr = sanitizeString(token, TOKEN_MAX_LENGTH);
+        const passwordStr = sanitizeString(password, PASSWORD_MAX_LENGTH);
+        if (passwordStr.length === 0) {
+          return { success: false, error: CREDENTIALS_GENERIC_ERROR };
+        }
+        const usernameStr = sanitizeString(username, USERNAME_MAX_LENGTH);
+        const id =
+          typeof user_id === 'number' && Number.isFinite(user_id)
+            ? user_id
+            : typeof user_id === 'string'
+              ? parseInt(user_id, 10)
+              : 0;
+        if (!Number.isFinite(id) || id < 0) {
+          return { success: false, error: CREDENTIALS_GENERIC_ERROR };
+        }
         const accounts = await readSavedAccounts();
-        const index = accounts.findIndex((a) => a.email === email);
+        const index = accounts.findIndex((a) => a.email === emailStr);
+        const entry: SavedAccount = {
+          email: emailStr,
+          token: tokenStr,
+          username: usernameStr,
+          user_id: id as number,
+          password: passwordStr,
+        };
         if (index >= 0) {
-          accounts[index] = { email, token, username, user_id };
+          accounts[index] = entry;
         } else {
-          accounts.push({ email, token, username, user_id });
+          accounts.push(entry);
         }
         await writeSavedAccounts(accounts);
         return { success: true };
-      } catch (error) {
-        return { success: false, error: (error as Error).message };
+      } catch {
+        return { success: false, error: CREDENTIALS_GENERIC_ERROR };
       }
     }
   );
@@ -2387,20 +2482,24 @@ function registerIpcHandlers() {
     try {
       const accounts = await readSavedAccounts();
       return { success: true, accounts };
-    } catch (error) {
+    } catch {
       return { success: false, accounts: [] };
     }
   });
 
-  ipcMain.handle('credentials-remove', async (_event, email: string) => {
+  ipcMain.handle('credentials-remove', async (_event, email: unknown) => {
     try {
+      const emailStr = normalizeEmail(email);
+      if (!emailStr) {
+        return { success: true };
+      }
       const accounts = (await readSavedAccounts()).filter(
-        (a) => a.email !== email
+        (a) => a.email !== emailStr
       );
       await writeSavedAccounts(accounts);
       return { success: true };
-    } catch (error) {
-      return { success: false, error: (error as Error).message };
+    } catch {
+      return { success: false, error: CREDENTIALS_GENERIC_ERROR };
     }
   });
 

electron/preload/index.ts

@@ -206,8 +206,17 @@ contextBridge.exposeInMainWorld('electronAPI', {
     email: string,
     token: string,
     username: string,
-    userId: number
-  ) => ipcRenderer.invoke('credentials-save', email, token, username, userId),
+    userId: number,
+    password: string
+  ) =>
+    ipcRenderer.invoke(
+      'credentials-save',
+      email,
+      token,
+      username,
+      userId,
+      password
+    ),
   credentialsLoad: () => ipcRenderer.invoke('credentials-load'),
   credentialsRemove: (email: string) =>
     ipcRenderer.invoke('credentials-remove', email),