fix: security hardening across IPC, spawn, and debug logging

[djdanielsson]

Summary

Security audit and code review identified 3 vulnerabilities and 3 verification items. This PR remediates all of them.

Findings & Fixes

[VULN-001] Command Injection on Windows — High severity (FIXED)

• Location: src/main.ts — executeBw()
• Issue: spawn() was called with shell: true and arguments joined into a single string, allowing shell metacharacter injection on Windows
• Fix: Replaced with spawn(process.env.ComSpec ?? "cmd.exe", ["/c", getBwPath(), ...args]) — passes arguments as an array to cmd.exe /c, preserving .cmd wrapper resolution without injection risk

[VULN-002] AES-CBC Usage Undocumented — Medium severity (DOCUMENTED)

• Location: src/session-storage.ts — encryptWithSessionKey()
• Issue: Uses AES-256-CBC instead of AES-GCM, which could be mistaken for a security oversight
• Fix: Added JSDoc explaining this is required for compatibility with the official Bitwarden CLI (EncryptionType 2, AesCbc256_HmacSha256_B64), and that the encrypt-then-MAC construction provides authentication

[VULN-003] RSA-OAEP SHA-1 Undocumented — Medium severity (DOCUMENTED)

• Location: src/ipc/native-messaging-client.ts — handleSetupEncryption()
• Issue: RSA-OAEP uses SHA-1, which is deprecated for new designs but required by the Bitwarden Desktop app protocol
• Fix: Added comment explaining SHA-1's collision weaknesses do not affect OAEP security (used for mask generation, not collision resistance)

[VERIFY-001] IPC Message Size Unbounded (FIXED)

• Location: src/ipc/ipc-socket.service.ts — processIncomingData()
• Issue: No upper bound on incoming IPC message size — a rogue server could cause unbounded memory allocation
• Fix: Added 10 MB max message size check; messages exceeding this cause immediate disconnect

[VERIFY-002] Socket Path Override Not Logged (MITIGATED)

• Location: src/ipc/ipc-socket.service.ts — getSocketCandidates()
• Issue: BWBIO_IPC_SOCKET_PATH env var silently overrides the socket path
• Fix: Added verbose-level log message when the override is active

[VERIFY-003] Debug Logging Exposes Secrets (FIXED)

• Location: src/ipc/native-messaging-client.ts — handleMessage() and processDecryptedMessage()
• Issue: Debug mode (BWBIO_DEBUG=true) logged full message contents including userKeyB64 (user encryption key) and sharedSecret (IPC channel key)
• Fix: Both functions now destructure out sensitive fields before logging (const { sensitiveField: _, ...safeMessage } = message)

Dependency Vulnerabilities (FIXED)

• Ran npm audit fix resolving 6 of 8 devDependency vulnerabilities (handlebars, lodash-es, rollup, undici, picomatch, tar). Remaining 2 are bundled inside npm itself and await an npm release. None affect runtime — the project has zero runtime dependencies.

Test plan

• npm run typecheck passes
• npm run lint passes (no new errors in src/)
• npm test — all 40 unit tests pass
• Manual test on Windows to verify cmd.exe /c spawn works for .cmd wrappers
• Manual test with BWBIO_DEBUG=true to verify secrets are redacted from logs

Made with Cursor

[djdanielsson]

I used some Claude security skills to run some security audits and these were the findings and fixes for them, some seemed useful so I decided to open a PR.

[yaroslavrick]

Important PR, actually, for such things as password manager wrappers