Kunzisoft / KeePassDX

Lightweight vault and password manager for Android, KeePassDX allows editing encrypted data in a single file in KeePass format and fill in the forms in a secure way.
https://www.keepassdx.com/
GNU General Public License v3.0
4.32k stars 261 forks source link

Items are lost after a merge #1516

Open malyv opened 1 year ago

malyv commented 1 year ago

Describe the bug

After merge there are many entries missing in db. I use Syncthing to transfer master copy of db to prevent data lost. Then I manually make a local copy of db for KeePassDX.

To Reproduce

Steps to reproduce the behavior:

  1. Make 2 identical db's, master and local
  2. Open local db, Click on 'Merge from', select master db
  3. After merge there are a lot of missing items, e.g. all 27 items from one group are missing

Expected behavior

After the merge there should be more or at least as many items as before the merge

KeePass Database

KeePassDX:

Android:

Additional context If I do the same in KeePassXC, there are no entries lost.

J-Jamet commented 1 year ago

I can't reproduce the problem, please upload two test databases with a reproducible procedure so I can identify where the problem is coming from.

malyv commented 1 year ago

I found that the error is somehow related to the deleted entries in the database. This does not happen with a newly established database.

In the original KeePass, under maintenance, I run delete for 'deleted objects information'. If I open 'db after maintenance' in mobile in KeePassDX and start merge with 'copy of db after maintenance' everything is OK.

But if I open 'db after maintenance' on mobile in KeePassDX and run merge with 'db before maintenance' -> all items are lost (except two recently added ones).

I prepared a test database for you by manually deleting items from 'db before maintenance' and leaving about 6 unimportant ones, deleted the trash, changed the master password, it is still about 24kB in size.

However, I still don't know if it's safe to send the modified database like this, since there are probably some remnants of deleted items and I don't know if they also contain sensitive data. If you say it's safe for me, please let me know where I can send the test database and password (preferably not a public place).

J-Jamet commented 1 year ago

I don't recommend using your own database for testing even if you delete all the data. But it already tells us that if it is a new database, there is no problem, so there is probably a specificity in your own database.

I can't remember the data modified by the "deleted objects information" parameter, so I'll have to study the issue.