bitwarden/browser
1
0
Fork 0
mirror of https://github.com/bitwarden/browser synced 2025-12-16 08:13:42 +00:00
Code Issues Releases Wiki Activity

[PM-21586] Return null in decryptUserKeyWithMasterKey if decrypt fails (#14756)

Browse Source 
* Return null in decryptUserKeyWithMasterKey if decrypt fails

* Show error on invalid master password

* Add logs
This commit is contained in:
Bernd Schoolmann
2025-05-13 15:42:48 +02:00
committed by GitHub
parent b2c118d607
commit 00beef617c
3 changed files with 26 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libs/common/src/key-management/master-password/abstractions/master-password.service.abstraction.ts
View File

@@ -37,13 +37,13 @@ export abstract class MasterPasswordServiceAbstraction {
* @param userKey The user's encrypted symmetric key
* @throws If either the MasterKey or UserKey are not resolved, or if the UserKey encryption type
* is neither AesCbc256_B64 nor AesCbc256_HmacSha256_B64
* @returns The user key
* @returns The user key or null if the masterkey is wrong
*/
abstract decryptUserKeyWithMasterKey: (
masterKey: MasterKey,
userId: string,
userKey?: EncString,
) => Promise<UserKey>;
) => Promise<UserKey | null>;
}
export abstract class InternalMasterPasswordServiceAbstraction extends MasterPasswordServiceAbstraction {

20
libs/common/src/key-management/master-password/services/master-password.service.ts
View File

@@ -166,7 +166,7 @@ export class MasterPasswordService implements InternalMasterPasswordServiceAbstr
masterKey: MasterKey,
userId: UserId,
userKey?: EncString,
): Promise<UserKey> {
): Promise<UserKey | null> {
userKey ??= await this.getMasterKeyEncryptedUserKey(userId);
masterKey ??= await firstValueFrom(this.masterKey$(userId));
@@ -177,16 +177,26 @@ export class MasterPasswordService implements InternalMasterPasswordServiceAbstr
let decUserKey: SymmetricCryptoKey;
if (userKey.encryptionType === EncryptionType.AesCbc256_B64) {
decUserKey = await this.encryptService.unwrapSymmetricKey(userKey, masterKey);
try {
decUserKey = await this.encryptService.unwrapSymmetricKey(userKey, masterKey);
} catch {
this.logService.warning("Failed to decrypt user key with master key.");
return null;
}
} else if (userKey.encryptionType === EncryptionType.AesCbc256_HmacSha256_B64) {
const newKey = await this.keyGenerationService.stretchKey(masterKey);
decUserKey = await this.encryptService.unwrapSymmetricKey(userKey, newKey);
try {
const newKey = await this.keyGenerationService.stretchKey(masterKey);
decUserKey = await this.encryptService.unwrapSymmetricKey(userKey, newKey);
} catch {
this.logService.warning("Failed to decrypt user key with stretched master key.");
return null;
}
} else {
throw new Error("Unsupported encryption type.");
}
if (decUserKey == null) {
this.logService.warning("Failed to decrypt user key with master key.");
this.logService.warning("Failed to decrypt user key with master key, user key is null.");
return null;
}

9
libs/key-management-ui/src/lock/components/lock.component.ts
View File

@@ -556,6 +556,15 @@ export class LockComponent implements OnInit, OnDestroy {
masterPasswordVerificationResponse!.masterKey,
this.activeAccount.id,
);
if (userKey == null) {
this.toastService.showToast({
variant: "error",
title: this.i18nService.t("errorOccurred"),
message: this.i18nService.t("invalidMasterPassword"),
});
return;
}
await this.setUserKeyAndContinue(userKey, true);
}