Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Execution context warning #36

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Execution context warning #36

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
dd245b2
Brower context warning
TeddyBear06 Feb 8, 2023
376941e
Update creator/index.html
TeddyBear06 Feb 8, 2023
920613e
Update creator/secret-template.html
TeddyBear06 Feb 8, 2023
a7f9ad4
Remove external link
TeddyBear06 Feb 8, 2023
68f9195
Remove external link
TeddyBear06 Feb 8, 2023
09dc4ae
Improve context testing and message readability
TeddyBear06 Feb 9, 2023
98cdfae
Code review
TeddyBear06 Feb 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions creator/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,12 @@
margin: 5px;
}

.danger {
background-color: lightcoral;
border: 2px dotted red;
padding: 12px 20px;
}

button {
font-size: large;
padding: 12px 20px;
Expand All @@ -38,6 +44,13 @@
const iterations = 1000000 // key derivation (with PBKDF2)
const keySize = 32 // bytes (derived with PBKDF2, used by AES)

// Display a warning if the context is not considered as "secure" by the browser
async function checkSecureContext() {
if (! window.isSecureContext) {
document.getElementById("danger_text").hidden = false
}
}

const inputElementIds = {
"message": "text_input_div",
"image": "image_input_div",
Expand All @@ -47,6 +60,8 @@
let selectedInputType = ""

async function init() {
// Try to detect insecure contexts as soon as possible
await checkSecureContext()
await refreshSalt()
await refreshIV()
setMessage("Select secret type: message, image, or file")
Expand Down Expand Up @@ -303,6 +318,11 @@ <h1><a href="https://mprimi.github.io/portable-secret/">Portable Secret</a>: Sec
But don't take my word for it. Check out the <a href="https://github.com/mprimi/portable-secret/tree/main/creator" target="_blank">source code</a>!
</p>

<div id="danger_text" class="danger" hidden>
The current browser context is not considered as "secure" and portable-secret won't work properly.<br>
Use one of <code>HTTPS</code>, <code>localhost</code> or <code>file://</code> context (please read <a href="#">this link</a> for more informations).
TeddyBear06 marked this conversation as resolved.
Show resolved Hide resolved
</div>

<!-- Inputs -->

<div>
Expand Down
19 changes: 19 additions & 0 deletions creator/secret-template.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,12 @@
font-family: monospace;
}

.danger {
background-color: lightcoral;
border: 2px dotted red;
padding: 12px 20px;
}

.decrypted {
background-color: palegreen;
border: 2px dotted forestgreen;
Expand Down Expand Up @@ -67,8 +73,16 @@
}
</style>
<script>
// Display a warning if the context is not considered as "secure" by the browser
async function checkSecureContext() {
if (! window.isSecureContext) {
document.getElementById("danger_text").hidden = false
}
}
// Display the encryption inputs on the page (invoked during body onload)
async function loadValues() {
// Try to detect insecure contexts as soon as possible
await checkSecureContext()
document.getElementById("secret_type").innerHTML = secretType
document.getElementById("salt").setAttribute("value", saltHex)
document.getElementById("iv").setAttribute("value", ivHex)
Expand Down Expand Up @@ -223,6 +237,11 @@ <h3>Created with <a href="https://mprimi.github.io/portable-secret/">Portable Se
The secret can be decrypted without an internet connection, this file has no dependencies and no data leaves the browser window.
</p>

<div id="danger_text" class="danger" hidden>
The current browser context is not considered as "secure" and portable-secret won't work properly.<br>
Use one of <code>HTTPS</code>, <code>localhost</code> or <code>file://</code> context (please read <a href="#">this link</a> for more informations).
TeddyBear06 marked this conversation as resolved.
Show resolved Hide resolved
</div>

<div>
<h4>Password hint:</h4>
<pre class="hint">{{PASSWORD_HINT}}</pre>
Expand Down