bitwarden-browser/src/services/nativeMessaging.service.ts

import { Injectable } from '@angular/core';
import { ipcRenderer } from 'electron';
import Swal from 'sweetalert2';

import { CryptoService } from 'jslib-common/abstractions/crypto.service';
import { CryptoFunctionService } from 'jslib-common/abstractions/cryptoFunction.service';
import { I18nService } from 'jslib-common/abstractions/i18n.service';
import { LogService } from 'jslib-common/abstractions/log.service';
import { MessagingService } from 'jslib-common/abstractions/messaging.service';
import { PlatformUtilsService } from 'jslib-common/abstractions/platformUtils.service';
import { StateService } from 'jslib-common/abstractions/state.service';
import { VaultTimeoutService } from 'jslib-common/abstractions/vaultTimeout.service';

import { Utils } from 'jslib-common/misc/utils';

import { SymmetricCryptoKey } from 'jslib-common/models/domain/symmetricCryptoKey';

import { KeySuffixOptions } from 'jslib-common/enums/keySuffixOptions';

const MessageValidTimeout = 10 * 1000;
const EncryptionAlgorithm = 'sha1';

@Injectable()
export class NativeMessagingService {
    private sharedSecrets = new Map<string, SymmetricCryptoKey>();

    constructor(private cryptoFunctionService: CryptoFunctionService, private cryptoService: CryptoService,
        private platformUtilService: PlatformUtilsService, private logService: LogService,
        private i18nService: I18nService, private messagingService: MessagingService,
        private vaultTimeoutService: VaultTimeoutService, private stateService: StateService) {
        ipcRenderer.on('nativeMessaging', async (_event: any, message: any) => {
            this.messageHandler(message);
        });
    }

    private async messageHandler(msg: any) {
        const appId = msg.appId;
        const rawMessage = msg.message;

        // Request to setup secure encryption
        if (rawMessage.command === 'setupEncryption') {
            const remotePublicKey = Utils.fromB64ToArray(rawMessage.publicKey).buffer;

            // Valudate the UserId to ensure we are logged into the same account.
            if (rawMessage.userId !== await this.stateService.getUserId()) {
                ipcRenderer.send('nativeMessagingReply', {command: 'wrongUserId', appId: appId});
                return;
            }

            if (await this.stateService.getEnableBrowserIntegrationFingerprint()) {
                ipcRenderer.send('nativeMessagingReply', {command: 'verifyFingerprint', appId: appId});

                const fingerprint = (await this.cryptoService.getFingerprint(await this.stateService.getUserId(), remotePublicKey)).join(' ');

                this.messagingService.send('setFocus');

                // Await confirmation that fingerprint is correct
                const submitted = await Swal.fire({
                    titleText: this.i18nService.t('verifyBrowserTitle'),
                    html: `${this.i18nService.t('verifyBrowserDesc')}<br><br><strong>${fingerprint}</strong>`,
                    showCancelButton: true,
                    cancelButtonText: this.i18nService.t('cancel'),
                    showConfirmButton: true,
                    confirmButtonText: this.i18nService.t('approve'),
                    allowOutsideClick: false,
                });

                if (submitted.value !== true) {
                    return;
                }
            }

            this.secureCommunication(remotePublicKey, appId);
            return;
        }

        const message = JSON.parse(await this.cryptoService.decryptToUtf8(rawMessage, this.sharedSecrets.get(appId)));

        // Shared secret is invalidated, force re-authentication
        if (message == null) {
            ipcRenderer.send('nativeMessagingReply', {command: 'invalidateEncryption', appId: appId});
            return;
        }

        if (Math.abs(message.timestamp - Date.now()) > MessageValidTimeout) {
            this.logService.error('NativeMessage is to old, ignoring.');
            return;
        }

        switch (message.command) {
            case 'biometricUnlock':
                if (! this.platformUtilService.supportsBiometric()) {
                    return this.send({command: 'biometricUnlock', response: 'not supported'}, appId);
                }

                if (! await this.vaultTimeoutService.isBiometricLockSet()) {
                    this.send({command: 'biometricUnlock', response: 'not enabled'}, appId);

                    return await Swal.fire({
                        title: this.i18nService.t('biometricsNotEnabledTitle'),
                        text: this.i18nService.t('biometricsNotEnabledDesc'),
                        showCancelButton: true,
                        cancelButtonText: this.i18nService.t('cancel'),
                        showConfirmButton: false,
                    });
                }

                const keyB64 = (await this.cryptoService.getKeyFromStorage(KeySuffixOptions.Biometric)).keyB64;

                if (keyB64 != null) {
                    this.send({ command: 'biometricUnlock', response: 'unlocked', keyB64: keyB64 }, appId);
                } else {
                    this.send({ command: 'biometricUnlock', response: 'canceled' }, appId);
                }

                break;
            default:
                this.logService.error('NativeMessage, got unknown command.');
        }
    }

    private async send(message: any, appId: string) {
        message.timestamp = Date.now();

        const encrypted = await this.cryptoService.encrypt(JSON.stringify(message), this.sharedSecrets.get(appId));

        ipcRenderer.send('nativeMessagingReply', {appId: appId, message: encrypted});
    }

    private async secureCommunication(remotePublicKey: ArrayBuffer, appId: string) {
        const secret = await this.cryptoFunctionService.randomBytes(64);
        this.sharedSecrets.set(appId, new SymmetricCryptoKey(secret));

        const encryptedSecret = await this.cryptoFunctionService.rsaEncrypt(secret, remotePublicKey, EncryptionAlgorithm);
        ipcRenderer.send('nativeMessagingReply', {appId: appId, command: 'setupEncryption', sharedSecret: Utils.fromBufferToB64(encryptedSecret)});
    }
}