smorks / keepassnatmsg

KeePass plugin to expose credentials securely to a browser using Native Messaging
GNU General Public License v3.0
268 stars 25 forks source link

Support for urls with port numbers in them #88

Open jpann opened 2 years ago

jpann commented 2 years ago

I would like support for matching urls that contain port numbers in them. I was previously using keepasshttp and it correctly matched urls that had ports.

For example, if I am accessing LAN site that is at http://192.168.1.10:44306 and I have other entries in KeePass for sites at the following addresses: http://192.168.1.10:9779, http://192.168.1.10:8443, keepassnatmsg lists logins for every site that that has http://192.168.1.10, regardless of the port specified and I'm only allowed to grant access to all of the entries.

If I grant access, the KeePassNatMsg Settings plugin data for every entry listed entries is updated to include { "Allow" : ["192.168.1.10:44306"], "Deny" :[""] } in addition to whichever other Allowed addresses where already there.

I've tried this with or without various settings like 'Return only best matching entries', 'match URL schemes' and 'search string fields for URL' and explicitly adding the URL and port there.

This also happens if I use local hostnames, e.g. http://mycomputer:44306, http://mycomputer:8443.

It does seem like once the URL is added to all of the listed entries, the next time I go back to that URL, it only displays the entry for that site and port.

KeePass v2.49 keepassnatmsg v2.0.14 Chrome and FireFox with keepassxc-browser

smorks commented 2 years ago

i thought this worked at some point too! i will investigate. thanks for the report!

jpann commented 2 years ago

FWIW, while I see this with IP addresses, I am mainly using local domain names (e.g. http://mycomputer.mydomain:8090, http://hostname.domain:9000/, etc)

smorks commented 2 years ago

i changed this to an enhancement, because after testing it, it appears that when initially prompting you, it shows all entries that match the domain/ip, regardless of the port. but once you allow & save, then it only shows the entries that match, is that the behavior you are seeing too?

i see you've attempted to fix it yourself, were you successful?

jpann commented 2 years ago

i changed this to an enhancement, because after testing it, it appears that when initially prompting you, it shows all entries that match the domain/ip, regardless of the port. but once you allow & save, then it only shows the entries that match, is that the behavior you are seeing too?

Yes, but the matching domain/ip gets added to the KeePassNatMsg Settings as an additional "Allow" property for every entry that has that domain/ip. If I have a second entry with the same domain/ip but a different port, it lists all of the entries with that matching domain/ip, like you mentioned, and then after I allow and save, the next time I go back to that site, the matched entry is for some other completely different entry with that domain/ip but a different port, but this time it is only a single entry and not a list.

i see you've attempted to fix it yourself, were you successful?

So far it has been working OK, I have issues where I have to sometimes keep clicking on the "Fill Credentials" button before anything happens or sometimes the browser extension says it can't talk to the plugin, but I'm not sure if that is because of my change or just some weird environmental issue.

smorks commented 2 years ago

So far it has been working OK, I have issues where I have to sometimes keep clicking on the "Fill Credentials" button before anything happens or sometimes the browser extension says it can't talk to the plugin, but I'm not sure if that is because of my change or just some weird environmental issue.

did you want to submit it as a pull request? I can do some testing on it too.

diaodeng commented 9 months ago

@smorks 你好,能麻烦处理下按端口匹配的问题吗,像下面这种输如一个地址会把下面两个都匹配出来 image 有很多域名相同但是端口不同的网站对应的账密,账号还差不多,有点难受;

还有个比较奇怪的现象,如果不带请求协议会匹配不到,如下面这种记录,一个都匹配不出来(地址前没有写http://) image

目前使用kee插件不会出现上面的两种情况,但是kee不能识别引用的记录

使用的版本 image

Bond246 commented 7 months ago

I can confirm the same problem.

I have a lot of entrys for my local network with different port numbers. Normally i can allow or deny the request for a specific website and it will also write the port-number inside the deny-array but it doesn't work. The website seems to ignore the deny array of an entry.