Waboodoo / HTTP-Shortcuts

Android app to create home screen shortcuts that trigger arbitrary HTTP requests
https://http-shortcuts.rmy.ch
MIT License
1.12k stars 111 forks source link

Is there any good way to use encryption functions like AES, DES in the script? Importing external function scripts just like 'require' maybe could help it. #387

Open QJZX opened 1 year ago

QJZX commented 1 year ago

Is your feature request related to a problem? Please describe.

When I want to use some special encryption method in the script, I need to import some script package like aes.js but I can't import it without packages.json

Describe the solution you'd like

I remember that node could use require. But it needs something like packages.json. Would you mind adding a param for define dependencies in the package.json and installing the modules to a project or global? If you think that is danger, we can set a white list for constraining.

Describe alternatives you've considered

I've seen the we use libnode.so, I know that nodejs could import extension script.

Additional context

We can set a parameter for defining the packages.json in the global or project, and there is a button behind the field. Clicking it could clean the node_modules and reinstall with the packages.json.

Waboodoo commented 1 year ago

I've considered this at some point, but then quickly decided against it. For starters, I wouldn't know how to make this work or if the Node runtime that I use could even support this, but furthermore, this would greatly increase complexity and would lead to so many things that need to be considered, such as where to store all these dependencies. It would also permanently fix Node as the runtime, which is not something I want to commit to if I can avoid it. So, in short, I have no plans of adding support for dependency management into the app. Unfortunately, for your original question about encryption this means that I have no good answer. What would your actual use-case be for these encryption functions?

QJZX commented 1 year ago

Oh, it's from my practice which is a tool can input some secure text to pc. I've wrote a golang program which is a http server can receive security text but content is encrypted by aes and encoded as base64. The sender is HTTP-Shortcuts.

Waboodoo commented 1 year ago

I see. If your main concern is to encrypt data in transit, I suggest you use HTTPS instead. The HTTP Shortcuts app supports self-signed certificates for this purpose.

QJZX commented 1 year ago

Some apis asked client use the encrypted data with opened encrypting method such as aes through the HTTPS. The libs of opened encrypting and decrypting are useful for comunicating with the existing api which ask client use appointed encrypting method.

QJZX commented 1 year ago

Just like logining operation for getting user session which api not support using personal permission token like github, required using encrypted password to transport.

QJZX commented 1 year ago

By the way, I think this app is powerful with sendIntent, gived some apps data from web which I don't want them could connect to network. Some apps will do some dirty operations when they could connect to network.

qgustavor commented 4 months ago

Use a browser library instead of a Node library, mostly old libraries of the era of then browsers offered 0 support for crypto (no WebCrypto), and inline the library code, or build your shortcut code using a bundler (like ESBuild, Rollup, Webpack and so on). There are a lot of JavaScript variables that can handle AES using pure JavaScript alone without requiring any support of Node-specifics. The JavaScript engine this app uses even includes support of non-standard features like String.prototype.substr, libraries for old browsers should work.