Buttercup-desktop: Passwords stored on disk in plain text

[wodin]

EDIT: This is with buttercup-desktop version 1.18.0.

While investigating issue #861 I found that Buttercup keeps an unencrypted copy of the archive in storage/state.json.

This was completely unexpected. Is this intended?

I have only a single archive which is accessed via WebDAV. I have not tested what happens with local archives or archives stored on Google Drive or Dropbox.

[sallar]

The contents of the archive should not be stored in state. If they are stored, then this is a big mistake from my part. Does it contain all the entries?

[FalloutXtreme]

I just looked on my side (Dropbox archive) and when I check this file (state.json), I have general informations stored in it but not my passwords in plain text.

[sallar]

As far as I remember implementing this, I store UI config, encrypted archive source info, and similar things in that file. But not the groups and entries, and those are only rehydrated on runtime. I’m going to check this again to be sure.

[wodin]

Since I wasn't explicit when I created this issue: My state.json does indeed contain unencrypted passwords. If I run it through python -mjson.tool it looks something like this:

{
    "archives": [
        {
            "colour": "#000000",
            "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
            "name": "Blah.bcup",
            "order": 0,
            "status": "locked",
            "type": "webdav"
        }
    ],
    "currentArchive": null,
    "entries": {
        "byId": {
            "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx": {
                "facade": {
                    "fields": [
                        {
                            "field": "property",
                            "formatting": false,
                            "multiline": false,
                            "property": "title",
                            "removeable": false,
                            "secret": false,
                            "title": "Title",
                            "value": "xxxxxxxxx"
                        },
                        {
                            "field": "property",
                            "formatting": false,
                            "multiline": false,
                            "property": "username",
                            "removeable": false,
                            "secret": false,
                            "title": "Username",
                            "value": "xxxxxxxxxxxxxxxxxxxx"
                        },
                        {
                            "field": "property",
                            "formatting": false,
                            "multiline": false,
                            "property": "password",
                            "removeable": false,
                            "secret": true,
                            "title": "Password",
                            "value": "xxxxxxxxxxxxxxxxxxxx"
                        },
[...]

[FalloutXtreme]

If it helps, mine looks like this (Dropbox archive) and doesn't have any unencrypted passwords in whether the archive has been unlocked or not (unlike wodin's file) :

{
    "archives": [
        {
            "colour": "#000000",
            "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
            "name": "xxxx.bcup",
            "order": 0,
            "status": "unlocked",
            "type": "dropbox"
        }
    ],
    "currentArchive": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "settings": {
        "archivesLoading": false,
        "columnSizes": {
            "entries": 230,
            "tree": 230
        },
        "condencedSidebar": true,
        "isBrowserAccessEnabled": false,
        "isTrayIconEnabled": true,
        "locale": "fr",
        "menubarAutoHide": false
    },
    "settingsByArchiveId": {
        "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx": {
            "ui": {
                "treeExpandedKeys": [
                    null,
                    "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
                    "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
                ]
            }
        }
    }
}

[wodin]

OK, I've just tested this in Buttercup 1.17.3 and it looks similar to @FalloutXtreme's file.

The file generated by Buttercup 1.18.0 has all the passwords and other details in it.

I am not sure if this is related to the issue described in #861, though.

[sallar]

@wodin @FalloutXtreme I can confirm this is an issue that has been introduced in 1.18. Unfortunately one of the modules that we use has been updated in (minor version) and introduced this change. I'll try to release a patch ASAP.

[sallar]

@wodin Also turns out this is related to #861. It's actually the same issue.

[sallar]

Buttercup 1.18.1 is released.
https://github.com/buttercup/buttercup-desktop/releases/tag/v1.18.1

[perry-mitchell]

Thanks everyone! Good catch here.

[FalloutXtreme]

Thanks @sallar for your reactivity !