browserpass / browserpass-legacy

Legacy Browserpass repo, development is now happening at:
https://github.com/browserpass/browserpass-extension
MIT License
998 stars 87 forks source link

allow the backend to use other charsets instead of utf-8 #305

Closed mowgli closed 5 years ago

mowgli commented 5 years ago

General information


Exact steps to reproduce the problem

All my system is in latin1 encoding including my filesystem.

When using pass (the command line tool) that is perfect working. In browser with browserpass, the path has invalid characters.

As my locale environment is proper set (de_DE without any utf-8) it would be pretty easy for the native app to use the correct encoding for file system operations. Additionally it could/should convert usernames and (optionally) password to utf-8 encoding when sending to the browser.

maximbaz commented 5 years ago

This would be pretty difficult to reproduce, I won't be able to migrate my file system to latin1 encoding :) would you be interested in investigating how to fix this? Or can you think of simpler repro steps?

mowgli commented 5 years ago

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

Hi Maxim,

Am So den 23. Dez 2018 um 11:04 schrieb Maxim Baz:

This would be pretty difficult to reproduce, I won't be able to migrate my file system to latin1 encoding :) would you be interested in investigating how to fix this? Or can you think of simpler repro steps?

Well, both. :-)

I can understand, that creating a filesystem with other encoding is a rather nightmare. That is the exact reason I have way around.

But it should be pretty easy to create a tar file with latin1 encoding file names inside. I could create one. As filesystem itself is encoding agnostic (at least on unix) that could be a test case.

On the other hand does I have an idea how to solve it. But I have no experiences in programming go.

Regards Klaus


Klaus Ethgen http://www.ethgen.ch/ pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen Klaus@Ethgen.ch Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C -----BEGIN PGP SIGNATURE----- Comment: Charset: ISO-8859-1

iQGzBAEBCgAdFiEEMWF28vh4/UMJJLQEpnwKsYAZ9qwFAlwfXzUACgkQpnwKsYAZ 9qz5OQwApG1dL7MPKA6aNVHRUD711VQW8wpqmLSw+GO+OOYO5A+85uasErWqd+Bg iPbkjGoM6fVM4+WL4lQI6I5QO405KK2QflCbJWBDTWJeyh1J5aLOEYLEjucGC5Ci KTY3on5Aklqh1G8duU8YwIUIWZLcwdS6PGpDS9DVyNeNpmdWO9rjjPCU2JkW9Z3k CZyEgNQJl73g3hlzgYwOVC4xKVJD5pn/8b/mduh7mrAAOVNdMHim5niHYqZDKMCB 4eNWIbolHsABMZW8uQaTLVvENq7FiaiJ0oukr7Wv/UYzQdmwyIRJyUlgtPndf/V+ sakvQxuWW/kaXOgTWoLyCpo6TeRxsRCxIt7SL70BuCeEI6mTYmIJxf4MRX5R30Ng IzXFoR7vyI/0Q3dov/N5XUitwlA6H4ucCCdTX0YAfej1Y4a7yxXnvbJTq3U+HWJK hJWGlAdC9tWvYtDkEbS8ZYkFPg54aEBouSrbRsr5CVvLpaYg5Y/rb2SyUt/9locx 4l8AR5c/ =DZGD -----END PGP SIGNATURE-----

maximbaz commented 5 years ago

Please do create an archive for testing 👍 It would be awesome if we could come up with a unit test showcasing the problem. I encourage you to try your idea on how to solve it, feel free to ask for guidance 😉 I think right here we can put test_store_3.tar and create a new test method in disk_test.go trying to read credentials from that password store and validating that they are correctly encoded in utf-8.

CONTRIBUTING.md should also be of some help.

maximbaz commented 5 years ago

We've discussed this a bit futher via email a while ago, it's not possible to replicate the scenario with a tar archive and unfortunately I don't have an ability to reproduce this. We realized that in Go strings are already utf-8 encoded, and there are two places in the code where we get strings: when retrieving a list of files (this is done in go-zglob library, which already returns us strings) and when decrypting a pass file by executing gpg process.

Since I don't have a possibility to reproduce and I won't be working on this issue myself, I'll close it as non-actionable. But if someone wants to explore this further, please do so and I'll be happy to help. I'll only add, I don't want to introduce any configuration option for this, I'd rather see encoding correctly determined (since pass is able to decode the password entry correctly, there should be no reason why browserpass can't).