sireliah / dragit

Application for intuitive file sharing between devices.
GNU General Public License v3.0
140 stars 4 forks source link

Enqueue transfer requests (to prevent accepting them all without review) #34

Open nekohayo opened 2 years ago

nekohayo commented 2 years ago

Here's a small security issue. If you have three computers, and from two of the three you throw files at the third one at roughly the same time, the third computer will be prompted only once to accept the (first) transfer, but the 2nd transfer will get accepted along with them without review.

sireliah commented 2 years ago

I couldn't reproduce this locally on one machine now, but I suspect the issue is here.

That is:

  1. Sender ---- ([Metadata] I'm sending you hash xxxx) ----> Receiver
  2. Receiver (gets the user approval for the hash xxxx)
  3. Sender <--- ([Metadata] I'm accepting hash xxxx) ----- Receiver
  4. Sender ---- (sends whatever on the opened substream) ----> Receiver
  5. FIN

Although this doesn't solve the underlying problem with the receiver acceptance flow. I'll try to dig this a bit more.

Meanwhile while testing 3 peers I discovered that sending payloads from two peers to third one, the notification popup is not closed and prevents you from using the application, so you need to kill the app.