From 2875397fb887a5b09b5f39d6b3a75419a516dd07 Mon Sep 17 00:00:00 2001
From: Wojtek Kosior <koszko@koszko.org>
Date: Thu, 26 Aug 2021 11:50:36 +0200
Subject: improve signing\n\nSignature timestamp is now handled in a saner way.
 Sha256 implementation is no longer pulled in contexts that don't require it.

---
 common/misc.js    | 38 +----------------------------
 common/signing.js | 73 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 74 insertions(+), 37 deletions(-)
 create mode 100644 common/signing.js

(limited to 'common')

diff --git a/common/misc.js b/common/misc.js
index 8894d60..d6b9662 100644
--- a/common/misc.js
+++ b/common/misc.js
@@ -8,9 +8,7 @@
 
 /*
  * IMPORTS_START
- * IMPORT sha256
  * IMPORT browser
- * IMPORT is_chrome
  * IMPORT TYPE_NAME
  * IMPORT TYPE_PREFIX
  * IMPORTS_END
@@ -45,32 +43,6 @@ function gen_nonce(length) // Default 16
     return Uint8toHex(randomData);
 }
 
-function get_secure_salt()
-{
-    if (is_chrome)
-	return browser.runtime.getManifest().key.substring(0, 50);
-    else
-	return browser.runtime.getURL("dummy");
-}
-
-function extract_signed(signature, data, times)
-{
-    const now = new Date();
-    times = times || [[now], [now, -1]];
-
-    const reductor =
-	  (ok, time) => ok || signature === sign_data(data, ...time);
-    if (!times.reduce(reductor, false))
-	return undefined;
-
-    try {
-	return JSON.parse(decodeURIComponent(data));
-    } catch (e) {
-	/* This should not be reached - it's our self-produced valid JSON. */
-	console.log("Unexpected internal error - invalid JSON smuggled!", e);
-    }
-}
-
 /* csp rule that blocks all scripts except for those injected by us */
 function csp_rule(nonce)
 {
@@ -89,7 +61,7 @@ const report_only_header_name = "content-security-policy-report-only";
 
 function is_csp_header_name(string, include_report_only)
 {
-    string = string && string.toLowerCase() || "";
+    string = string && string.toLowerCase().trim() || "";
 
     return (include_report_only && string === report_only_header_name) ||
 	csp_header_names.has(string);
@@ -118,12 +90,6 @@ function is_privileged_url(url)
     return !!/^(chrome(-extension)?|moz-extension):\/\/|^about:/i.exec(url);
 }
 
-/* Sign a given string for a given time */
-function sign_data(data, now, hours_offset) {
-    let time = Math.floor(now / 3600000) + (hours_offset || 0);
-    return sha256(get_secure_salt() + time + data);
-}
-
 /* Parse a CSP header */
 function parse_csp(csp) {
     let directive, directive_array;
@@ -193,8 +159,6 @@ const matchers = {
 /*
  * EXPORTS_START
  * EXPORT gen_nonce
- * EXPORT extract_signed
- * EXPORT sign_data
  * EXPORT csp_rule
  * EXPORT is_csp_header_name
  * EXPORT nice_name
diff --git a/common/signing.js b/common/signing.js
new file mode 100644
index 0000000..2171714
--- /dev/null
+++ b/common/signing.js
@@ -0,0 +1,73 @@
+/**
+ * part of Hachette
+ * Functions related to "signing" of data, refactored to a separate file.
+ *
+ * Copyright (C) 2021 Wojtek Kosior
+ * Redistribution terms are gathered in the `copyright' file.
+ */
+
+/*
+ * IMPORTS_START
+ * IMPORT sha256
+ * IMPORT browser
+ * IMPORT is_chrome
+ * IMPORTS_END
+ */
+
+/*
+ * In order to make certain data synchronously accessible in certain contexts,
+ * hachette smuggles it in string form in places like cookies, URLs and headers.
+ * When using the smuggled data, we first need to make sure it isn't spoofed.
+ * For that, we use this pseudo-signing mechanism.
+ *
+ * Despite what name suggests, no assymetric cryptography is involved, as it
+ * would bring no additional benefits and would incur bigger performance
+ * overhead. Instead, we hash the string data together with some secret value
+ * that is supposed to be known only by this browser instance. Resulting hash
+ * sum plays the role of the signature. In the hash we also include current
+ * time. This way, even if signed data leaks (which shouldn't happen in the
+ * first place), an attacker won't be able to re-use it indefinitely.
+ *
+ * The secret shared between execution contexts has to be available
+ * synchronously. Under Mozilla, this is the extension's per-session id. Under
+ * Chromium, this is the key that resides in the manifest.
+ *
+ * An idea to (under Chromium) instead store the secret in a file fetched
+ * synchronously using XMLHttpRequest is being considered.
+ */
+
+function get_secret()
+{
+    if (is_chrome)
+	return browser.runtime.getManifest().key.substring(0, 50);
+    else
+	return browser.runtime.getURL("dummy");
+}
+
+function extract_signed(signature, signed_data)
+{
+    const match = /^([1-9][0-9]{12}|0)_(.*)$/.exec(signed_data);
+    if (!match)
+	return {fail: "bad format"};
+
+    const result = {time: parseInt(match[1]), data: match[2]};
+    if (sign_data(result.data, result.time)[0] !== signature)
+	result.fail = "bad signature";
+
+    return result;
+}
+
+/*
+ * Sign a given string for a given time. Time should be either 0 or in the range
+ * 10^12 <= time < 10^13.
+ */
+function sign_data(data, time) {
+    return [sha256(get_secret() + time + data), `${time}_${data}`];
+}
+
+/*
+ * EXPORTS_START
+ * EXPORT extract_signed
+ * EXPORT sign_data
+ * EXPORTS_END
+ */
-- 
cgit v1.2.3