search

davidmartos96 / sqflite_sqlcipher

SQLite flutter plugin
BSD 2-Clause "Simplified" License
102 stars 46 forks source link

Probable bug in encryption #37

Closed Abhijit-Revamp closed 3 years ago

Abhijit-Revamp commented 3 years ago

I am seeing a strange issue which seems like a bug. Here are the steps:

  1. Created a DB with password "Test Password"
  2. added table and records. Closed connection.
  3. Open DB with password "Test Password" --> All good --> Close Db
  4. Open DB with password different password (note the space in the end) "Test Password " - Connection expected to fail however can access all data (PROBLEM)
  5. Open DB with one more password password (note first 2 words are same as original) "Test Password Modified" - Connection expected to fail however can access all data (PROBLEM)
  6. Now use totally different password (like "abcd") --> Handles correctly with 'file is not database'. no access to tables or data

What I see is, if the original password is suffixed with anything, access to DB is allowed.

davidmartos96 commented 3 years ago

@Abhijit-Revamp Thanks for the report! I'm quite impressed with that behavior because the password is not manipulated in any way by the plugin. It's passed directly to the underlying native library. Does this happen on Android, iOS or both? Maybe the spaces are treated in a different way. Could you try the following? "Test", "Testtt", "Test Passwordddd"

Abhijit-Revamp commented 3 years ago

false alarm. Its not an issue with your code (and underlying code) its an issue with "restart" / "reload" option in flutter If the app is running, you change the password, somehow the underlying database connection is still cached (probably). So if you change the password and reload / restart debugging, database still fetches data.

Once you close the app and restart new debugging session, things work as expected.

This leads me to a probable issue. If one has to change the password while app is active, things may go haywire till the app is restarted.

Anyway, thanks for the prompt reply.