SpiderOak / Encryptr

Encryptr is a zero-knowledge cloud-based password manager / e-wallet powered by Crypton
GNU General Public License v3.0
1.58k stars 138 forks source link

Avoid char encoding issues and XAS #175

Closed devgeeks closed 8 years ago

devgeeks commented 8 years ago

Fixes #137 Fixes #174

In order to avoid both XAS and passwords with chars that wouldn't be copied to the clipboard, instead of taking the text from the actual HTML of the value field, add the key to the field in a data-attr, then use it to fetch the value from the model and load that onto the clipboard.

Then (for the XAS), make sure to use the {{! blah }} syntax of DoT to encode the value before displaying it.

kenmanheimer commented 8 years ago

I'm currently failing to get a debug build of Encryptr to run, so can't test the fixes.

The thing I wanted to examine: on the dot.js site, changing {{=...}} vs {{!...} in the in-line demo, there doesn't actually change much. Assuming that escaping of characters is desired, to prevent code operation, I see that I used {{= _.escape(...) }} in similar code for the SpiderOakMobile client - see this commit. This isn't necessary if your changes prevent the problem (and/or the problem is different than I'm inferring), but since I can't test it...

Also, a test for this should go on the high-priority pendings list... )-:

kenmanheimer commented 8 years ago

Problem with this in desktop browser - in permissive Chrome or plain Firefox:

The problem seems to be needing to use the dot.js "encode" {{!...}} form for the label and field values, as well. I've added a commit a60a2f8 that implements that.

devgeeks commented 8 years ago

@kenmanheimer I take it all back. This is great. Please merge it in.