mirror of
https://github.com/zhom/donutbrowser.git
synced 2026-08-28 13:50:26 +02:00
1101 lines
37 KiB
Rust
1101 lines
37 KiB
Rust
//! Re-sealing the copied profile with Wayfern's key, and stripping the state
|
|
//! that is bound to the machine it came from.
|
|
//!
|
|
//! Every encrypted store in a Chromium profile goes through one
|
|
//! `os_crypt_async::Encryptor`, so "migrate the secrets" is really one loop
|
|
//! over a handful of `(table, column)` pairs plus the cookie store, which is
|
|
//! the only one with extra framing.
|
|
|
|
use super::copy;
|
|
use super::layout;
|
|
use super::os_crypt::{Decrypted, SourceKeyring, TargetKey};
|
|
use super::report::{warning, ProfileImportReport};
|
|
use rusqlite::{Connection, OpenFlags};
|
|
use sha2::{Digest, Sha256};
|
|
use std::path::Path;
|
|
|
|
/// Cookie DB schema versions this code understands.
|
|
///
|
|
/// 24 is current (`kCurrentVersionNumber`); it frames the encrypted plaintext
|
|
/// as `SHA256(host_key) || value`. 23 is the last version Chromium will still
|
|
/// migrate forward, and it has no prefix. Anything older is deleted by
|
|
/// Chromium on open, so carrying it over would be a silent loss.
|
|
const COOKIE_VERSION_CURRENT: i64 = 24;
|
|
const COOKIE_VERSION_MIN: i64 = 23;
|
|
|
|
/// `(table, column)` pairs holding a bare os_crypt value — no extra framing.
|
|
/// Sourced from the Chromium 151 tree rather than from memory:
|
|
/// `login_database.cc`, `password_notes_table.cc`, `token_service_table.cc`,
|
|
/// `payments_autofill_table.cc`.
|
|
const LOGIN_COLUMNS: &[(&str, &str)] = &[("logins", "password_value"), ("password_notes", "value")];
|
|
|
|
const WEB_DATA_COLUMNS: &[(&str, &str)] = &[
|
|
("credit_cards", "card_number_encrypted"),
|
|
("local_ibans", "value_encrypted"),
|
|
("local_stored_cvc", "value_encrypted"),
|
|
("server_stored_cvc", "value_encrypted"),
|
|
("generic_payment_instruments", "serialized_value_encrypted"),
|
|
("token_service", "encrypted_token"),
|
|
];
|
|
|
|
#[derive(Default)]
|
|
struct Counts {
|
|
migrated: usize,
|
|
unrecoverable: usize,
|
|
}
|
|
|
|
fn table_exists(conn: &Connection, table: &str) -> bool {
|
|
conn
|
|
.query_row(
|
|
"SELECT 1 FROM sqlite_master WHERE type='table' AND name=?1",
|
|
[table],
|
|
|_| Ok(()),
|
|
)
|
|
.is_ok()
|
|
}
|
|
|
|
/// Read a stored ciphertext, accepting either SQLite storage class.
|
|
///
|
|
/// The columns are declared BLOB, but Chromium does not always bind them as
|
|
/// one: the cookie v23->v24 migration writes `encrypted_value` with
|
|
/// `sqlite3_bind_text` (`sqlite_persistent_cookie_store.cc` `BindString`), and
|
|
/// `password_notes.value` is written with `BindString` on every platform. BLOB
|
|
/// columns have no affinity, so those values keep storage class TEXT forever.
|
|
/// `row.get::<_, Vec<u8>>` demands a Blob and errors on Text — which would read
|
|
/// back as empty and silently blank the secret. Chromium itself reads these
|
|
/// with `ColumnString`/`ColumnBlobAsString`, which accept both; so do we.
|
|
fn column_bytes(row: &rusqlite::Row<'_>, index: usize) -> Vec<u8> {
|
|
row
|
|
.get_ref(index)
|
|
.ok()
|
|
.and_then(|value| value.as_bytes().ok())
|
|
.map(<[u8]>::to_vec)
|
|
.unwrap_or_default()
|
|
}
|
|
|
|
fn open_rw(path: &Path) -> Option<Connection> {
|
|
if !path.is_file() {
|
|
return None;
|
|
}
|
|
match Connection::open_with_flags(path, OpenFlags::SQLITE_OPEN_READ_WRITE) {
|
|
Ok(conn) => Some(conn),
|
|
Err(e) => {
|
|
log::warn!("Could not open {} for re-encryption: {e}", path.display());
|
|
None
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Re-seal one plain `(table, column)` pair.
|
|
fn reencrypt_column(
|
|
conn: &Connection,
|
|
table: &str,
|
|
column: &str,
|
|
source: &SourceKeyring,
|
|
target: &TargetKey,
|
|
) -> Counts {
|
|
let mut counts = Counts::default();
|
|
if !table_exists(conn, table) {
|
|
return counts;
|
|
}
|
|
|
|
// Table and column names are compile-time constants from the lists above,
|
|
// never user input, so interpolating them is safe.
|
|
let rows: Vec<(i64, Vec<u8>)> = {
|
|
let Ok(mut stmt) = conn.prepare(&format!(
|
|
"SELECT rowid, {column} FROM {table} WHERE {column} IS NOT NULL"
|
|
)) else {
|
|
return counts;
|
|
};
|
|
let Ok(mapped) = stmt.query_map([], |row| Ok((row.get::<_, i64>(0)?, column_bytes(row, 1))))
|
|
else {
|
|
return counts;
|
|
};
|
|
mapped.flatten().collect()
|
|
};
|
|
|
|
for (rowid, stored) in rows {
|
|
if stored.is_empty() {
|
|
continue;
|
|
}
|
|
let plaintext = match source.decrypt(&stored) {
|
|
Decrypted::Value(v) => v,
|
|
// Already plaintext: seal it so the store is uniform.
|
|
Decrypted::NotEncrypted => stored.clone(),
|
|
Decrypted::Unrecoverable => {
|
|
counts.unrecoverable += 1;
|
|
// Blank rather than leave a blob no key can open. Chromium logs a
|
|
// decrypt failure for every such row on every load, and the user gets
|
|
// a password entry that can never be revealed.
|
|
let _ = conn.execute(
|
|
&format!("UPDATE {table} SET {column} = X'' WHERE rowid = ?1"),
|
|
[rowid],
|
|
);
|
|
continue;
|
|
}
|
|
};
|
|
|
|
let Some(sealed) = target.encrypt(&plaintext) else {
|
|
counts.unrecoverable += 1;
|
|
continue;
|
|
};
|
|
if conn
|
|
.execute(
|
|
&format!("UPDATE {table} SET {column} = ?1 WHERE rowid = ?2"),
|
|
rusqlite::params![sealed, rowid],
|
|
)
|
|
.is_ok()
|
|
{
|
|
counts.migrated += 1;
|
|
} else {
|
|
counts.unrecoverable += 1;
|
|
}
|
|
}
|
|
|
|
counts
|
|
}
|
|
|
|
/// Re-seal the cookie store.
|
|
///
|
|
/// Cookies are the one store with extra framing: since schema v24 the
|
|
/// encrypted plaintext is `SHA256(host_key) || value`, and Chromium drops any
|
|
/// row whose prefix does not match (`kHashFailed`) as well as any row where
|
|
/// both `value` and `encrypted_value` are non-empty.
|
|
fn reencrypt_cookies(
|
|
default_dir: &Path,
|
|
source: &SourceKeyring,
|
|
target: &TargetKey,
|
|
report: &mut ProfileImportReport,
|
|
) {
|
|
let path = layout::host_cookie_path(default_dir);
|
|
let Some(conn) = open_rw(&path) else {
|
|
return;
|
|
};
|
|
if !table_exists(&conn, "cookies") {
|
|
return;
|
|
}
|
|
|
|
let version: i64 = conn
|
|
.query_row("SELECT value FROM meta WHERE key='version'", [], |r| {
|
|
r.get::<_, String>(0)
|
|
})
|
|
.ok()
|
|
.and_then(|v| v.parse().ok())
|
|
.unwrap_or(COOKIE_VERSION_CURRENT);
|
|
|
|
if version < COOKIE_VERSION_MIN {
|
|
// Chromium deletes and recreates a store this old on first launch, so
|
|
// copying it would look like a successful import of nothing.
|
|
drop(conn);
|
|
let _ = std::fs::remove_file(&path);
|
|
report.warn(warning::STORE_TOO_OLD);
|
|
return;
|
|
}
|
|
if version > COOKIE_VERSION_CURRENT {
|
|
drop(conn);
|
|
let _ = std::fs::remove_file(&path);
|
|
report.warn(warning::STORE_TOO_NEW);
|
|
return;
|
|
}
|
|
|
|
// Only a v24 store carries the hash prefix; a v23 one does not.
|
|
let source_has_prefix = version >= COOKIE_VERSION_CURRENT;
|
|
|
|
let rows: Vec<(i64, String, String, Vec<u8>)> = {
|
|
let Ok(mut stmt) = conn.prepare("SELECT rowid, host_key, value, encrypted_value FROM cookies")
|
|
else {
|
|
return;
|
|
};
|
|
let Ok(mapped) = stmt.query_map([], |row| {
|
|
Ok((
|
|
row.get::<_, i64>(0)?,
|
|
row.get::<_, String>(1)?,
|
|
row.get::<_, String>(2).unwrap_or_default(),
|
|
column_bytes(row, 3),
|
|
))
|
|
}) else {
|
|
return;
|
|
};
|
|
mapped.flatten().collect()
|
|
};
|
|
|
|
let mut doomed: Vec<i64> = Vec::new();
|
|
|
|
for (rowid, host_key, plain_value, stored) in rows {
|
|
let value = if stored.is_empty() {
|
|
// Written plaintext, either by an old Chromium or by our own cookie
|
|
// import. Seal it so the store ends up uniform.
|
|
plain_value.into_bytes()
|
|
} else {
|
|
match source.decrypt(&stored) {
|
|
Decrypted::Value(mut decrypted) => {
|
|
if source_has_prefix {
|
|
let expected: [u8; 32] = Sha256::digest(host_key.as_bytes()).into();
|
|
if decrypted.len() >= 32 && decrypted[..32] == expected {
|
|
decrypted.drain(..32);
|
|
} else if decrypted.len() >= 32 {
|
|
// The prefix is mandatory at v24 and does not match. The row is
|
|
// corrupt or belongs to another host; Chromium would drop it.
|
|
doomed.push(rowid);
|
|
report.cookies_unrecoverable += 1;
|
|
continue;
|
|
}
|
|
}
|
|
decrypted
|
|
}
|
|
Decrypted::NotEncrypted => stored.clone(),
|
|
Decrypted::Unrecoverable => {
|
|
doomed.push(rowid);
|
|
report.cookies_unrecoverable += 1;
|
|
continue;
|
|
}
|
|
}
|
|
};
|
|
|
|
// v24 framing, unconditionally: we normalise the store to the current
|
|
// version below, so every row must carry the prefix.
|
|
let mut framed = Sha256::digest(host_key.as_bytes()).to_vec();
|
|
framed.extend_from_slice(&value);
|
|
|
|
let Some(sealed) = target.encrypt(&framed) else {
|
|
doomed.push(rowid);
|
|
report.cookies_unrecoverable += 1;
|
|
continue;
|
|
};
|
|
|
|
// `value` must be cleared: a row with both set is dropped at load.
|
|
if conn
|
|
.execute(
|
|
"UPDATE cookies SET encrypted_value = ?1, value = '' WHERE rowid = ?2",
|
|
rusqlite::params![sealed, rowid],
|
|
)
|
|
.is_ok()
|
|
{
|
|
report.cookies_migrated += 1;
|
|
} else {
|
|
doomed.push(rowid);
|
|
report.cookies_unrecoverable += 1;
|
|
}
|
|
}
|
|
|
|
for rowid in doomed {
|
|
let _ = conn.execute("DELETE FROM cookies WHERE rowid = ?1", [rowid]);
|
|
}
|
|
|
|
// Every row now uses v24 framing, so declare the store current and spare
|
|
// Chromium a migration that would double-prefix what we just wrote.
|
|
let _ = conn.execute(
|
|
"UPDATE meta SET value = ?1 WHERE key = 'version'",
|
|
[COOKIE_VERSION_CURRENT.to_string()],
|
|
);
|
|
let _ = conn.execute(
|
|
"UPDATE meta SET value = ?1 WHERE key = 'last_compatible_version'",
|
|
[COOKIE_VERSION_CURRENT.to_string()],
|
|
);
|
|
}
|
|
|
|
/// Re-seal every store, and count what came across.
|
|
pub fn reencrypt_profile(
|
|
default_dir: &Path,
|
|
source: &SourceKeyring,
|
|
target: &TargetKey,
|
|
report: &mut ProfileImportReport,
|
|
) {
|
|
reencrypt_cookies(default_dir, source, target, report);
|
|
|
|
if let Some(conn) = open_rw(&default_dir.join("Login Data")) {
|
|
for (table, column) in LOGIN_COLUMNS {
|
|
let counts = reencrypt_column(&conn, table, column, source, target);
|
|
report.passwords_migrated += counts.migrated;
|
|
report.passwords_unrecoverable += counts.unrecoverable;
|
|
}
|
|
}
|
|
|
|
if let Some(conn) = open_rw(&default_dir.join("Web Data")) {
|
|
for (table, column) in WEB_DATA_COLUMNS {
|
|
let counts = reencrypt_column(&conn, table, column, source, target);
|
|
report.payment_methods_migrated += counts.migrated;
|
|
report.payment_methods_unrecoverable += counts.unrecoverable;
|
|
}
|
|
}
|
|
|
|
if source.saw_app_bound.get() {
|
|
report.warn(warning::APP_BOUND_ENCRYPTED);
|
|
}
|
|
}
|
|
|
|
/// Strip the `protection` block from `Secure Preferences`.
|
|
///
|
|
/// The MACs in it are keyed by a seed that only Google-branded builds compile
|
|
/// in, plus a machine id, so they can never validate under Wayfern and every
|
|
/// `ENFORCE_ON_LOAD` pref resets on first launch regardless. Deleting the
|
|
/// whole file would be worse: `extensions.settings` lives here and is
|
|
/// registered at `NO_ENFORCEMENT`, so it survives an invalid MAC — that is the
|
|
/// only reason imported extensions appear at all.
|
|
fn sanitize_secure_preferences(path: &Path, report: &mut ProfileImportReport) {
|
|
let Ok(raw) = std::fs::read_to_string(path) else {
|
|
return;
|
|
};
|
|
let Ok(mut value) = serde_json::from_str::<serde_json::Value>(&raw) else {
|
|
return;
|
|
};
|
|
let Some(object) = value.as_object_mut() else {
|
|
return;
|
|
};
|
|
|
|
if object.remove("protection").is_some() {
|
|
report.warn(warning::SECURE_PREFERENCES_RESET);
|
|
}
|
|
strip_absolute_extension_paths(object, report);
|
|
|
|
if let Ok(serialized) = serde_json::to_string(&value) {
|
|
let _ = std::fs::write(path, serialized);
|
|
}
|
|
}
|
|
|
|
/// Absolute in the *source's* path syntax, not merely the host's.
|
|
///
|
|
/// `Path::is_absolute` answers for the platform it is compiled on, so a Windows
|
|
/// path in a profile imported onto macOS reads as relative and the dead entry
|
|
/// survives. Profiles move between platforms routinely (that is what the ZIP
|
|
/// import is for), so mirror `base::IsPathAbsolute` instead: a POSIX leading
|
|
/// slash, a UNC double separator, or a drive letter.
|
|
fn is_absolute_in_any_syntax(path: &str) -> bool {
|
|
let bytes = path.as_bytes();
|
|
match bytes {
|
|
[b'/', ..] => true,
|
|
[a, b, ..] if matches!(a, b'\\' | b'/') && matches!(b, b'\\' | b'/') => true,
|
|
[drive, b':', sep, ..] if drive.is_ascii_alphabetic() && matches!(sep, b'\\' | b'/') => true,
|
|
_ => false,
|
|
}
|
|
}
|
|
|
|
/// Drop extension entries whose `path` is absolute.
|
|
///
|
|
/// A relative path (`<id>/<version>_0`) is a real user extension living inside
|
|
/// the profile, and it came across with the copy. An absolute one points into
|
|
/// the source browser's app bundle at a pinned build — a component extension
|
|
/// that Wayfern registers for itself, and a dead path if left behind.
|
|
fn strip_absolute_extension_paths(
|
|
root: &mut serde_json::Map<String, serde_json::Value>,
|
|
report: &mut ProfileImportReport,
|
|
) {
|
|
let Some(settings) = root
|
|
.get_mut("extensions")
|
|
.and_then(|e| e.get_mut("settings"))
|
|
.and_then(|s| s.as_object_mut())
|
|
else {
|
|
return;
|
|
};
|
|
|
|
let doomed: Vec<String> = settings
|
|
.iter()
|
|
.filter(|(_, entry)| {
|
|
entry
|
|
.get("path")
|
|
.and_then(|p| p.as_str())
|
|
.is_some_and(is_absolute_in_any_syntax)
|
|
})
|
|
.map(|(id, _)| id.clone())
|
|
.collect();
|
|
|
|
if !doomed.is_empty() {
|
|
report.warn(warning::EXTENSIONS_PARTIAL);
|
|
}
|
|
for id in doomed {
|
|
settings.remove(&id);
|
|
}
|
|
report.extensions_migrated = settings.len();
|
|
}
|
|
|
|
/// Remove per-machine state from `Preferences`.
|
|
fn sanitize_preferences(path: &Path, report: &mut ProfileImportReport) {
|
|
let Ok(raw) = std::fs::read_to_string(path) else {
|
|
return;
|
|
};
|
|
let Ok(mut value) = serde_json::from_str::<serde_json::Value>(&raw) else {
|
|
return;
|
|
};
|
|
let Some(object) = value.as_object_mut() else {
|
|
return;
|
|
};
|
|
|
|
// Download paths point at directories on the source machine.
|
|
for (section, key) in [
|
|
("download", "default_directory"),
|
|
("savefile", "default_directory"),
|
|
("download", "last_directory"),
|
|
("selectfile", "last_directory"),
|
|
] {
|
|
if let Some(map) = object.get_mut(section).and_then(|s| s.as_object_mut()) {
|
|
map.remove(key);
|
|
}
|
|
}
|
|
|
|
// Tell Chromium the previous session ended cleanly, or the imported profile
|
|
// opens with a "restore pages?" bubble for a crash that never happened.
|
|
if let Some(profile) = object.get_mut("profile").and_then(|p| p.as_object_mut()) {
|
|
profile.insert(
|
|
"exit_type".to_string(),
|
|
serde_json::Value::String("Normal".to_string()),
|
|
);
|
|
profile.insert("exited_cleanly".to_string(), serde_json::Value::Bool(true));
|
|
}
|
|
|
|
// Languages are part of the fingerprint Wayfern applies at launch. Carrying
|
|
// the source machine's list would contradict it, which is exactly the kind
|
|
// of inconsistency an anti-detect profile exists to avoid.
|
|
if let Some(intl) = object.get_mut("intl").and_then(|i| i.as_object_mut()) {
|
|
intl.remove("accept_languages");
|
|
intl.remove("selected_languages");
|
|
}
|
|
|
|
strip_absolute_extension_paths(object, report);
|
|
|
|
if let Ok(serialized) = serde_json::to_string(&value) {
|
|
let _ = std::fs::write(path, serialized);
|
|
}
|
|
}
|
|
|
|
/// Count what survived, for the report.
|
|
fn tally(default_dir: &Path, report: &mut ProfileImportReport) {
|
|
if let Some(conn) = open_rw(&default_dir.join("History")) {
|
|
if let Ok(count) = conn.query_row("SELECT count(*) FROM urls", [], |r| r.get::<_, i64>(0)) {
|
|
report.history_entries = count.max(0) as usize;
|
|
}
|
|
}
|
|
|
|
if let Ok(raw) = std::fs::read_to_string(default_dir.join("Bookmarks")) {
|
|
if let Ok(value) = serde_json::from_str::<serde_json::Value>(&raw) {
|
|
report.bookmarks = count_bookmarks(value.get("roots"));
|
|
}
|
|
}
|
|
|
|
report.local_storage_origins =
|
|
copy::count_leveldb_origins(&default_dir.join("Local Storage").join("leveldb"));
|
|
}
|
|
|
|
fn count_bookmarks(node: Option<&serde_json::Value>) -> usize {
|
|
let Some(node) = node else { return 0 };
|
|
match node {
|
|
serde_json::Value::Object(map) => {
|
|
if map.get("type").and_then(|t| t.as_str()) == Some("url") {
|
|
return 1;
|
|
}
|
|
map.values().map(|v| count_bookmarks(Some(v))).sum()
|
|
}
|
|
serde_json::Value::Array(items) => items.iter().map(|v| count_bookmarks(Some(v))).sum(),
|
|
_ => 0,
|
|
}
|
|
}
|
|
|
|
/// Everything that has to happen to a freshly copied `Default/` before the
|
|
/// browser sees it.
|
|
pub fn finalize_profile(
|
|
default_dir: &Path,
|
|
source: &SourceKeyring,
|
|
target: &TargetKey,
|
|
report: &mut ProfileImportReport,
|
|
) {
|
|
sanitize_preferences(&default_dir.join("Preferences"), report);
|
|
sanitize_secure_preferences(&default_dir.join("Secure Preferences"), report);
|
|
|
|
if source.is_empty() {
|
|
// No source key. Say so — but still run the pass. Rows that were stored in
|
|
// plaintext (an old profile, a browser that could not reach its keyring,
|
|
// or our own cookie importer) are perfectly recoverable and get sealed
|
|
// with the target key; only the genuinely encrypted ones are lost, and
|
|
// they were lost the moment the key was unavailable. Skipping the pass
|
|
// here would report zero cookies carried for a profile that has plenty.
|
|
report.warn(warning::SECRETS_NOT_MIGRATED);
|
|
}
|
|
reencrypt_profile(default_dir, source, target, report);
|
|
|
|
tally(default_dir, report);
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
use crate::profile_import::os_crypt::{derive_key, CryptoKey};
|
|
use tempfile::TempDir;
|
|
|
|
fn source_keyring_with(password: &[u8]) -> SourceKeyring {
|
|
// Match the host's CBC iteration count so tests exercise the real path.
|
|
#[cfg(target_os = "linux")]
|
|
let key = CryptoKey::Aes128Cbc(derive_key(
|
|
password,
|
|
super::super::os_crypt::POSIX_ITERATIONS,
|
|
));
|
|
#[cfg(not(target_os = "linux"))]
|
|
let key = CryptoKey::Aes128Cbc(derive_key(password, super::super::os_crypt::MAC_ITERATIONS));
|
|
|
|
#[cfg(target_os = "linux")]
|
|
return SourceKeyring {
|
|
v11: Some(key),
|
|
..Default::default()
|
|
};
|
|
#[cfg(not(target_os = "linux"))]
|
|
SourceKeyring {
|
|
v10: Some(key),
|
|
..Default::default()
|
|
}
|
|
}
|
|
|
|
fn seal_as_source(keyring: &SourceKeyring, plaintext: &[u8]) -> Vec<u8> {
|
|
let (tag, key) = if let Some(k) = keyring.v10.as_ref() {
|
|
(b"v10", k)
|
|
} else {
|
|
(b"v11", keyring.v11.as_ref().unwrap())
|
|
};
|
|
let mut out = tag.to_vec();
|
|
out.extend_from_slice(&key.encrypt(plaintext).unwrap());
|
|
out
|
|
}
|
|
|
|
fn make_cookie_db(path: &Path, version: i64) -> Connection {
|
|
std::fs::create_dir_all(path.parent().unwrap()).unwrap();
|
|
let conn = Connection::open(path).unwrap();
|
|
conn
|
|
.execute_batch(
|
|
"CREATE TABLE cookies(
|
|
creation_utc INTEGER NOT NULL,
|
|
host_key TEXT NOT NULL,
|
|
top_frame_site_key TEXT NOT NULL DEFAULT '',
|
|
name TEXT NOT NULL,
|
|
value TEXT NOT NULL DEFAULT '',
|
|
encrypted_value BLOB NOT NULL DEFAULT '',
|
|
path TEXT NOT NULL DEFAULT '/'
|
|
);
|
|
CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR);",
|
|
)
|
|
.unwrap();
|
|
conn
|
|
.execute(
|
|
"INSERT INTO meta VALUES('version', ?1)",
|
|
[version.to_string()],
|
|
)
|
|
.unwrap();
|
|
conn
|
|
.execute(
|
|
"INSERT INTO meta VALUES('last_compatible_version', ?1)",
|
|
[version.to_string()],
|
|
)
|
|
.unwrap();
|
|
conn
|
|
}
|
|
|
|
#[test]
|
|
fn v24_cookie_is_reframed_for_the_target_key() {
|
|
let dir = TempDir::new().unwrap();
|
|
let default_dir = dir.path().join("Default");
|
|
let cookie_path = layout::host_cookie_path(&default_dir);
|
|
|
|
let source = source_keyring_with(b"source-password");
|
|
let mut framed = Sha256::digest(b"example.com").to_vec();
|
|
framed.extend_from_slice(b"tasty");
|
|
let sealed = seal_as_source(&source, &framed);
|
|
|
|
let conn = make_cookie_db(&cookie_path, 24);
|
|
conn
|
|
.execute(
|
|
"INSERT INTO cookies(creation_utc, host_key, top_frame_site_key, name, value, encrypted_value, path)
|
|
VALUES(0, 'example.com', '', 'sid', '', ?1, '/')",
|
|
rusqlite::params![sealed],
|
|
)
|
|
.unwrap();
|
|
drop(conn);
|
|
|
|
let target = TargetKey::ensure(dir.path()).unwrap();
|
|
let mut report = ProfileImportReport::default();
|
|
reencrypt_cookies(&default_dir, &source, &target, &mut report);
|
|
|
|
assert_eq!(report.cookies_migrated, 1);
|
|
assert_eq!(report.cookies_unrecoverable, 0);
|
|
|
|
// Read it back exactly the way Wayfern will.
|
|
let conn = Connection::open(&cookie_path).unwrap();
|
|
let (value, encrypted): (String, Vec<u8>) = conn
|
|
.query_row("SELECT value, encrypted_value FROM cookies", [], |r| {
|
|
Ok((r.get(0)?, r.get(1)?))
|
|
})
|
|
.unwrap();
|
|
assert!(
|
|
value.is_empty(),
|
|
"a row with both value and encrypted_value set is dropped at load"
|
|
);
|
|
|
|
let target_keyring = target_as_keyring(dir.path());
|
|
let Decrypted::Value(plain) = target_keyring.decrypt(&encrypted) else {
|
|
panic!("target must be able to open what it sealed");
|
|
};
|
|
assert_eq!(&plain[..32], &Sha256::digest(b"example.com")[..]);
|
|
assert_eq!(&plain[32..], b"tasty");
|
|
}
|
|
|
|
#[test]
|
|
fn cookie_sealed_as_sqlite_text_is_still_recovered() {
|
|
// Chromium's own v23->v24 migration binds `encrypted_value` with
|
|
// BindString, so an established profile's cookies carry storage class TEXT
|
|
// in a column declared BLOB. Reading them as a strict blob returns empty,
|
|
// which used to blank every cookie and report it as migrated.
|
|
let dir = TempDir::new().unwrap();
|
|
let default_dir = dir.path().join("Default");
|
|
let cookie_path = layout::host_cookie_path(&default_dir);
|
|
|
|
let source = source_keyring_with(b"source-password");
|
|
let mut framed = Sha256::digest(b"example.com").to_vec();
|
|
framed.extend_from_slice(b"tasty");
|
|
let sealed = seal_as_source(&source, &framed);
|
|
|
|
let conn = make_cookie_db(&cookie_path, 24);
|
|
conn
|
|
.execute(
|
|
"INSERT INTO cookies(creation_utc, host_key, top_frame_site_key, name, value, encrypted_value, path)
|
|
VALUES(0, 'example.com', '', 'sid', '', CAST(?1 AS TEXT), '/')",
|
|
rusqlite::params![sealed],
|
|
)
|
|
.unwrap();
|
|
let stored_type: String = conn
|
|
.query_row("SELECT typeof(encrypted_value) FROM cookies", [], |r| {
|
|
r.get(0)
|
|
})
|
|
.unwrap();
|
|
assert_eq!(
|
|
stored_type, "text",
|
|
"fixture must reproduce Chromium's binding"
|
|
);
|
|
drop(conn);
|
|
|
|
let target = TargetKey::ensure(dir.path()).unwrap();
|
|
let mut report = ProfileImportReport::default();
|
|
reencrypt_cookies(&default_dir, &source, &target, &mut report);
|
|
|
|
assert_eq!(report.cookies_migrated, 1);
|
|
let conn = Connection::open(&cookie_path).unwrap();
|
|
let encrypted: Vec<u8> = conn
|
|
.query_row("SELECT encrypted_value FROM cookies", [], |r| r.get(0))
|
|
.unwrap();
|
|
let Decrypted::Value(plain) = target_as_keyring(dir.path()).decrypt(&encrypted) else {
|
|
panic!("expected a readable cookie");
|
|
};
|
|
assert_eq!(&plain[32..], b"tasty", "the cookie value must survive");
|
|
}
|
|
|
|
#[test]
|
|
fn password_note_sealed_as_sqlite_text_is_still_recovered() {
|
|
// `password_notes.value` is written with BindString on every platform, so
|
|
// this is not an edge case — it is how the column always looks.
|
|
let dir = TempDir::new().unwrap();
|
|
let default_dir = dir.path().join("Default");
|
|
std::fs::create_dir_all(&default_dir).unwrap();
|
|
|
|
let source = source_keyring_with(b"source-password");
|
|
let sealed = seal_as_source(&source, b"a private note");
|
|
|
|
let conn = Connection::open(default_dir.join("Login Data")).unwrap();
|
|
conn
|
|
.execute_batch(
|
|
"CREATE TABLE logins(password_value BLOB);
|
|
CREATE TABLE password_notes(id INTEGER PRIMARY KEY, value BLOB);",
|
|
)
|
|
.unwrap();
|
|
conn
|
|
.execute(
|
|
"INSERT INTO password_notes(value) VALUES(CAST(?1 AS TEXT))",
|
|
rusqlite::params![sealed],
|
|
)
|
|
.unwrap();
|
|
drop(conn);
|
|
|
|
let target = TargetKey::ensure(dir.path()).unwrap();
|
|
let mut report = ProfileImportReport::default();
|
|
reencrypt_profile(&default_dir, &source, &target, &mut report);
|
|
|
|
assert_eq!(report.passwords_migrated, 1);
|
|
let conn = Connection::open(default_dir.join("Login Data")).unwrap();
|
|
let stored: Vec<u8> = conn
|
|
.query_row("SELECT value FROM password_notes", [], |r| r.get(0))
|
|
.unwrap();
|
|
let Decrypted::Value(plain) = target_as_keyring(dir.path()).decrypt(&stored) else {
|
|
panic!("note must be readable with the target key");
|
|
};
|
|
assert_eq!(plain, b"a private note");
|
|
}
|
|
|
|
#[test]
|
|
fn windows_extension_paths_are_recognised_as_absolute_on_every_host() {
|
|
let dir = TempDir::new().unwrap();
|
|
let path = dir.path().join("Secure Preferences");
|
|
std::fs::write(
|
|
&path,
|
|
serde_json::json!({
|
|
"extensions": { "settings": {
|
|
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa": { "path": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/1.0_0" },
|
|
"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb": { "path": "C:\\Program Files\\Google\\Chrome\\Application\\151.0.0\\resources\\pdf" },
|
|
"cccccccccccccccccccccccccccccccc": { "path": "//host/share/ext" }
|
|
}}
|
|
})
|
|
.to_string(),
|
|
)
|
|
.unwrap();
|
|
|
|
let mut report = ProfileImportReport::default();
|
|
sanitize_secure_preferences(&path, &mut report);
|
|
|
|
let value: serde_json::Value =
|
|
serde_json::from_str(&std::fs::read_to_string(&path).unwrap()).unwrap();
|
|
let settings = value["extensions"]["settings"].as_object().unwrap();
|
|
assert_eq!(
|
|
settings.len(),
|
|
1,
|
|
"a Windows-syntax path is still absolute when imported onto macOS"
|
|
);
|
|
assert!(settings.contains_key("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"));
|
|
assert_eq!(report.extensions_migrated, 1);
|
|
}
|
|
|
|
#[test]
|
|
fn plaintext_cookie_is_sealed_and_value_cleared() {
|
|
let dir = TempDir::new().unwrap();
|
|
let default_dir = dir.path().join("Default");
|
|
let cookie_path = layout::host_cookie_path(&default_dir);
|
|
|
|
let conn = make_cookie_db(&cookie_path, 24);
|
|
conn
|
|
.execute(
|
|
"INSERT INTO cookies(creation_utc, host_key, top_frame_site_key, name, value, encrypted_value, path)
|
|
VALUES(0, 'example.com', '', 'sid', 'plain', X'', '/')",
|
|
[],
|
|
)
|
|
.unwrap();
|
|
drop(conn);
|
|
|
|
let target = TargetKey::ensure(dir.path()).unwrap();
|
|
let source = source_keyring_with(b"unused");
|
|
let mut report = ProfileImportReport::default();
|
|
reencrypt_cookies(&default_dir, &source, &target, &mut report);
|
|
|
|
assert_eq!(report.cookies_migrated, 1);
|
|
let conn = Connection::open(&cookie_path).unwrap();
|
|
let (value, encrypted): (String, Vec<u8>) = conn
|
|
.query_row("SELECT value, encrypted_value FROM cookies", [], |r| {
|
|
Ok((r.get(0)?, r.get(1)?))
|
|
})
|
|
.unwrap();
|
|
assert!(value.is_empty());
|
|
let Decrypted::Value(plain) = target_as_keyring(dir.path()).decrypt(&encrypted) else {
|
|
panic!("expected a readable cookie");
|
|
};
|
|
assert_eq!(&plain[32..], b"plain");
|
|
}
|
|
|
|
#[test]
|
|
fn v23_cookie_has_no_prefix_to_strip_and_is_upgraded_to_v24() {
|
|
let dir = TempDir::new().unwrap();
|
|
let default_dir = dir.path().join("Default");
|
|
let cookie_path = layout::host_cookie_path(&default_dir);
|
|
|
|
let source = source_keyring_with(b"source-password");
|
|
// v23 stores the bare value, with no SHA256(host) prefix.
|
|
let sealed = seal_as_source(&source, b"tasty");
|
|
|
|
let conn = make_cookie_db(&cookie_path, 23);
|
|
conn
|
|
.execute(
|
|
"INSERT INTO cookies(creation_utc, host_key, top_frame_site_key, name, value, encrypted_value, path)
|
|
VALUES(0, 'example.com', '', 'sid', '', ?1, '/')",
|
|
rusqlite::params![sealed],
|
|
)
|
|
.unwrap();
|
|
drop(conn);
|
|
|
|
let target = TargetKey::ensure(dir.path()).unwrap();
|
|
let mut report = ProfileImportReport::default();
|
|
reencrypt_cookies(&default_dir, &source, &target, &mut report);
|
|
|
|
assert_eq!(report.cookies_migrated, 1);
|
|
let conn = Connection::open(&cookie_path).unwrap();
|
|
let version: String = conn
|
|
.query_row("SELECT value FROM meta WHERE key='version'", [], |r| {
|
|
r.get(0)
|
|
})
|
|
.unwrap();
|
|
assert_eq!(
|
|
version, "24",
|
|
"we wrote v24 framing, so the store must declare v24 or Chromium re-prefixes it"
|
|
);
|
|
|
|
let encrypted: Vec<u8> = conn
|
|
.query_row("SELECT encrypted_value FROM cookies", [], |r| r.get(0))
|
|
.unwrap();
|
|
let Decrypted::Value(plain) = target_as_keyring(dir.path()).decrypt(&encrypted) else {
|
|
panic!("expected a readable cookie");
|
|
};
|
|
assert_eq!(&plain[32..], b"tasty");
|
|
}
|
|
|
|
#[test]
|
|
fn unrecoverable_cookie_row_is_deleted_and_counted() {
|
|
let dir = TempDir::new().unwrap();
|
|
let default_dir = dir.path().join("Default");
|
|
let cookie_path = layout::host_cookie_path(&default_dir);
|
|
|
|
let conn = make_cookie_db(&cookie_path, 24);
|
|
let mut app_bound = b"v20".to_vec();
|
|
app_bound.extend_from_slice(&[0u8; 48]);
|
|
conn
|
|
.execute(
|
|
"INSERT INTO cookies(creation_utc, host_key, top_frame_site_key, name, value, encrypted_value, path)
|
|
VALUES(0, 'example.com', '', 'sid', '', ?1, '/')",
|
|
rusqlite::params![app_bound],
|
|
)
|
|
.unwrap();
|
|
drop(conn);
|
|
|
|
let target = TargetKey::ensure(dir.path()).unwrap();
|
|
let source = source_keyring_with(b"source-password");
|
|
let mut report = ProfileImportReport::default();
|
|
reencrypt_cookies(&default_dir, &source, &target, &mut report);
|
|
|
|
assert_eq!(report.cookies_unrecoverable, 1);
|
|
assert_eq!(report.cookies_migrated, 0);
|
|
let conn = Connection::open(&cookie_path).unwrap();
|
|
let remaining: i64 = conn
|
|
.query_row("SELECT count(*) FROM cookies", [], |r| r.get(0))
|
|
.unwrap();
|
|
assert_eq!(remaining, 0, "a row no key can open is dead weight");
|
|
}
|
|
|
|
#[test]
|
|
fn cookie_store_older_than_chromium_migrates_is_removed_with_a_warning() {
|
|
let dir = TempDir::new().unwrap();
|
|
let default_dir = dir.path().join("Default");
|
|
let cookie_path = layout::host_cookie_path(&default_dir);
|
|
make_cookie_db(&cookie_path, 22);
|
|
|
|
let target = TargetKey::ensure(dir.path()).unwrap();
|
|
let source = source_keyring_with(b"x");
|
|
let mut report = ProfileImportReport::default();
|
|
reencrypt_cookies(&default_dir, &source, &target, &mut report);
|
|
|
|
assert!(report
|
|
.warnings
|
|
.contains(&warning::STORE_TOO_OLD.to_string()));
|
|
assert!(!cookie_path.exists());
|
|
}
|
|
|
|
#[test]
|
|
fn passwords_are_reencrypted() {
|
|
let dir = TempDir::new().unwrap();
|
|
let default_dir = dir.path().join("Default");
|
|
std::fs::create_dir_all(&default_dir).unwrap();
|
|
|
|
let source = source_keyring_with(b"source-password");
|
|
let sealed = seal_as_source(&source, b"hunter2");
|
|
|
|
let conn = Connection::open(default_dir.join("Login Data")).unwrap();
|
|
conn
|
|
.execute_batch("CREATE TABLE logins(origin_url VARCHAR, password_value BLOB);")
|
|
.unwrap();
|
|
conn
|
|
.execute(
|
|
"INSERT INTO logins VALUES('https://example.com', ?1)",
|
|
rusqlite::params![sealed],
|
|
)
|
|
.unwrap();
|
|
drop(conn);
|
|
|
|
let target = TargetKey::ensure(dir.path()).unwrap();
|
|
let mut report = ProfileImportReport::default();
|
|
reencrypt_profile(&default_dir, &source, &target, &mut report);
|
|
|
|
assert_eq!(report.passwords_migrated, 1);
|
|
let conn = Connection::open(default_dir.join("Login Data")).unwrap();
|
|
let stored: Vec<u8> = conn
|
|
.query_row("SELECT password_value FROM logins", [], |r| r.get(0))
|
|
.unwrap();
|
|
let Decrypted::Value(plain) = target_as_keyring(dir.path()).decrypt(&stored) else {
|
|
panic!("password must be readable with the target key");
|
|
};
|
|
assert_eq!(plain, b"hunter2");
|
|
}
|
|
|
|
#[test]
|
|
fn missing_optional_tables_are_not_an_error() {
|
|
// `password_notes` and most payment tables only exist on some schemas.
|
|
let dir = TempDir::new().unwrap();
|
|
let default_dir = dir.path().join("Default");
|
|
std::fs::create_dir_all(&default_dir).unwrap();
|
|
let conn = Connection::open(default_dir.join("Login Data")).unwrap();
|
|
conn
|
|
.execute_batch("CREATE TABLE logins(password_value BLOB);")
|
|
.unwrap();
|
|
drop(conn);
|
|
|
|
let target = TargetKey::ensure(dir.path()).unwrap();
|
|
let source = source_keyring_with(b"x");
|
|
let mut report = ProfileImportReport::default();
|
|
reencrypt_profile(&default_dir, &source, &target, &mut report);
|
|
assert_eq!(report.passwords_migrated, 0);
|
|
}
|
|
|
|
#[test]
|
|
fn secure_preferences_keeps_extensions_and_drops_protection() {
|
|
let dir = TempDir::new().unwrap();
|
|
let path = dir.path().join("Secure Preferences");
|
|
std::fs::write(
|
|
&path,
|
|
serde_json::json!({
|
|
"protection": { "macs": { "extensions": { "settings": "deadbeef" } }, "super_mac": "x" },
|
|
"extensions": { "settings": {
|
|
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa": { "path": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/1.0_0" },
|
|
"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb": { "path": "/Applications/Chromium.app/Contents/Resources/x" }
|
|
}}
|
|
})
|
|
.to_string(),
|
|
)
|
|
.unwrap();
|
|
|
|
let mut report = ProfileImportReport::default();
|
|
sanitize_secure_preferences(&path, &mut report);
|
|
|
|
let value: serde_json::Value =
|
|
serde_json::from_str(&std::fs::read_to_string(&path).unwrap()).unwrap();
|
|
assert!(value.get("protection").is_none());
|
|
let settings = value["extensions"]["settings"].as_object().unwrap();
|
|
assert!(
|
|
settings.contains_key("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"),
|
|
"a relative path is the user's real extension and must survive"
|
|
);
|
|
assert!(
|
|
!settings.contains_key("bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"),
|
|
"an absolute path points into the source browser's bundle"
|
|
);
|
|
assert_eq!(report.extensions_migrated, 1);
|
|
assert!(report
|
|
.warnings
|
|
.contains(&warning::SECURE_PREFERENCES_RESET.to_string()));
|
|
}
|
|
|
|
#[test]
|
|
fn preferences_lose_machine_paths_and_crash_state() {
|
|
let dir = TempDir::new().unwrap();
|
|
let path = dir.path().join("Preferences");
|
|
std::fs::write(
|
|
&path,
|
|
serde_json::json!({
|
|
"download": { "default_directory": "/Users/someone-else/Downloads" },
|
|
"profile": { "exit_type": "Crashed", "exited_cleanly": false, "name": "Person 1" },
|
|
"intl": { "accept_languages": "de,de-DE" }
|
|
})
|
|
.to_string(),
|
|
)
|
|
.unwrap();
|
|
|
|
let mut report = ProfileImportReport::default();
|
|
sanitize_preferences(&path, &mut report);
|
|
|
|
let value: serde_json::Value =
|
|
serde_json::from_str(&std::fs::read_to_string(&path).unwrap()).unwrap();
|
|
assert!(value["download"].get("default_directory").is_none());
|
|
assert_eq!(value["profile"]["exit_type"], "Normal");
|
|
assert_eq!(value["profile"]["exited_cleanly"], true);
|
|
assert!(value["intl"].get("accept_languages").is_none());
|
|
assert_eq!(
|
|
value["profile"]["name"], "Person 1",
|
|
"unrelated preferences must be preserved"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn plaintext_cookies_still_migrate_when_no_source_key_is_available() {
|
|
// A declined Keychain prompt loses the encrypted rows, but a profile whose
|
|
// cookies were stored in plaintext has nothing to lose. Reporting zero for
|
|
// it would be the same silent-empty-import failure this work exists to fix.
|
|
let dir = TempDir::new().unwrap();
|
|
let default_dir = dir.path().join("Default");
|
|
let cookie_path = layout::host_cookie_path(&default_dir);
|
|
|
|
let conn = make_cookie_db(&cookie_path, 24);
|
|
conn
|
|
.execute(
|
|
"INSERT INTO cookies(creation_utc, host_key, top_frame_site_key, name, value, encrypted_value, path)
|
|
VALUES(0, 'example.com', '', 'sid', 'plain', X'', '/')",
|
|
[],
|
|
)
|
|
.unwrap();
|
|
let mut sealed_elsewhere = b"v10".to_vec();
|
|
sealed_elsewhere.extend_from_slice(&[9u8; 32]);
|
|
conn
|
|
.execute(
|
|
"INSERT INTO cookies(creation_utc, host_key, top_frame_site_key, name, value, encrypted_value, path)
|
|
VALUES(1, 'other.example', '', 'sid', '', ?1, '/')",
|
|
rusqlite::params![sealed_elsewhere],
|
|
)
|
|
.unwrap();
|
|
drop(conn);
|
|
|
|
let target = TargetKey::ensure(dir.path()).unwrap();
|
|
let empty = SourceKeyring::default();
|
|
let mut report = ProfileImportReport::default();
|
|
finalize_profile(&default_dir, &empty, &target, &mut report);
|
|
|
|
assert_eq!(
|
|
report.cookies_migrated, 1,
|
|
"the plaintext row is recoverable"
|
|
);
|
|
assert_eq!(report.cookies_unrecoverable, 1, "the sealed row is not");
|
|
assert!(report
|
|
.warnings
|
|
.contains(&warning::SECRETS_NOT_MIGRATED.to_string()));
|
|
}
|
|
|
|
#[test]
|
|
fn bookmarks_are_counted_recursively() {
|
|
let roots = serde_json::json!({
|
|
"bookmark_bar": { "type": "folder", "children": [
|
|
{ "type": "url", "url": "https://a.example" },
|
|
{ "type": "folder", "children": [{ "type": "url", "url": "https://b.example" }] }
|
|
]},
|
|
"other": { "type": "folder", "children": [] }
|
|
});
|
|
assert_eq!(count_bookmarks(Some(&roots)), 2);
|
|
}
|
|
|
|
/// Load the freshly minted `os_crypt_key` back as a keyring, so tests assert
|
|
/// against what Wayfern will actually do rather than against our own writer.
|
|
fn target_as_keyring(user_data_dir: &Path) -> SourceKeyring {
|
|
let contents =
|
|
std::fs::read(user_data_dir.join(crate::profile_import::os_crypt::KEY_FILE_NAME)).unwrap();
|
|
#[cfg(target_os = "windows")]
|
|
{
|
|
let bytes: [u8; 32] = contents.as_slice().try_into().unwrap();
|
|
SourceKeyring {
|
|
v10: Some(CryptoKey::Aes256Gcm(bytes)),
|
|
..Default::default()
|
|
}
|
|
}
|
|
#[cfg(target_os = "macos")]
|
|
{
|
|
SourceKeyring {
|
|
v10: Some(CryptoKey::Aes128Cbc(derive_key(
|
|
&contents,
|
|
super::super::os_crypt::MAC_ITERATIONS,
|
|
))),
|
|
..Default::default()
|
|
}
|
|
}
|
|
#[cfg(target_os = "linux")]
|
|
{
|
|
SourceKeyring {
|
|
v11: Some(CryptoKey::Aes128Cbc(derive_key(
|
|
&contents,
|
|
super::super::os_crypt::POSIX_ITERATIONS,
|
|
))),
|
|
..Default::default()
|
|
}
|
|
}
|
|
}
|
|
}
|