Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PM-12102 | Fix LastPass importer not properly de-encrypting URLs #11366

Merged
merged 3 commits into from
Oct 7, 2024
Merged

PM-12102 | Fix LastPass importer not properly de-encrypting URLs #11366

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f3df442
PM-12102 | Fix LastPass importer not properly de-encrypting URLs
Tyrrrz Oct 2, 2024
7188aee
Reuse the original code for the unencrypted path
Tyrrrz Oct 2, 2024
fed7fe5
Add some comments
Tyrrrz Oct 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 12 additions & 4 deletions libs/importer/src/importers/lastpass/access/services/parser.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
/*
May return null when the chunk does not represent an account.
All secure notes are ACCTs but not all of them store account information.

TODO: Add a test for the folder case!
TODO: Add a test case that covers secure note account!
Comment on lines 26 to 27
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also couldn't find any existing tests for this parser. Should I leave it like that or add them?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ideally you would add them. In the meantime I'm going to approve and move this to QA, so we can hopefully include the fix soon.

*/
Expand Down Expand Up @@ -60,9 +60,17 @@

// 3: url
step = 3;
let url = Utils.fromBufferToUtf8(
this.decodeHexLoose(Utils.fromBufferToUtf8(this.readItem(reader))),
);
const urlEncoded = this.readItem(reader);

Check warning on line 63 in libs/importer/src/importers/lastpass/access/services/parser.ts

View check run for this annotation

Codecov / codecov/patch

libs/importer/src/importers/lastpass/access/services/parser.ts#L63 

Added line #L63 was not covered by tests
let url =
urlEncoded.length > 0 && urlEncoded[0] === 33 // 33 = '!'
? // URL is encrypted
await this.cryptoUtils.decryptAes256PlainWithDefault(
urlEncoded,
encryptionKey,
placeholder,
)
: // URL is not encrypted
Utils.fromBufferToUtf8(this.decodeHexLoose(Utils.fromBufferToUtf8(urlEncoded)));

// Ignore "group" accounts. They have no credentials.
if (url == "http://group") {
Expand Down
Loading