+ Lets you choose a password shorter than 12 characters + when you add a wallet. +
+diff --git a/src/popup/views/addWallet.js b/src/popup/views/addWallet.js index a339dae..b5629b5 100644 --- a/src/popup/views/addWallet.js +++ b/src/popup/views/addWallet.js @@ -132,7 +132,8 @@ function validatePassword() { showError("add-wallet-password-error", "Please choose a password."); return null; } - if (pw.length < 12) { + // "Allow weak passwords" in Settings lifts the 12-character minimum. + if (!state.allowWeakPasswords && pw.length < 12) { showError( "add-wallet-password-error", "Password must be at least 12 characters.", diff --git a/src/popup/views/settings.js b/src/popup/views/settings.js index 1162a64..40da526 100644 --- a/src/popup/views/settings.js +++ b/src/popup/views/settings.js @@ -499,6 +499,12 @@ function init(_ctx) { await saveState(); }); + $("settings-allow-weak-passwords").checked = state.allowWeakPasswords; + $("settings-allow-weak-passwords").addEventListener("change", async () => { + state.allowWeakPasswords = $("settings-allow-weak-passwords").checked; + await saveState(); + }); + $("btn-main-add-wallet").addEventListener("click", ctx.showAddWalletView); $("btn-settings-add-token").addEventListener( diff --git a/src/shared/persistedState.js b/src/shared/persistedState.js index f6ced9f..6550e9d 100644 --- a/src/shared/persistedState.js +++ b/src/shared/persistedState.js @@ -56,6 +56,9 @@ const DEFAULT_STATE = { // else. useBlockscout: false, checkRecipientsOnEtherscan: false, + // "Allow weak passwords" in Settings. While it is off, AddWallet refuses a + // password shorter than 12 characters. + allowWeakPasswords: false, fraudContracts: [], tokenHolderCache: {}, theme: "system", @@ -418,6 +421,9 @@ function normalizePersisted(saved) { // service. out.useBlockscout = saved.useBlockscout === true; out.checkRecipientsOnEtherscan = saved.checkRecipientsOnEtherscan === true; + // Anything but true is off: the setting lets AddWallet accept a short + // password. + out.allowWeakPasswords = saved.allowWeakPasswords === true; // A list of contract addresses, floored the same way: send.js builds its // fraud set as `(state.fraudContracts || []).map((a) => a.toLowerCase())` // and filterTransactions() maps the same list through normalizeAddress(), diff --git a/tests/allowWeakPasswords.test.js b/tests/allowWeakPasswords.test.js new file mode 100644 index 0000000..a298ab7 --- /dev/null +++ b/tests/allowWeakPasswords.test.js @@ -0,0 +1,87 @@ +// "Allow weak passwords" in Settings is off until the user ticks it. While it +// is off, AddWallet refuses a password shorter than 12 characters. While it is +// on, AddWallet accepts any password that is not empty +// (https://git.eeqj.de/sneak/AutistMask/issues/674). These boot the real popup, +// set the checkbox in Settings as the user does, and then add a wallet. + +jest.mock("../src/shared/vault", () => ({ + decryptWithPassword: jest.fn(), + encryptWithPassword: jest.fn(async () => ({ + salt: "salt", + nonce: "nonce", + ciphertext: "ciphertext", + })), +})); + +const { + bootPopup, + cleanupPopup, + unversionedValidProfile, +} = require("./support/popupBoot"); + +const CHECKBOX = "settings-allow-weak-passwords"; +const ERROR = "add-wallet-password-error"; + +afterEach(() => { + cleanupPopup(); +}); + +// Boots a popup that holds one wallet and opens Settings, where the checkbox +// starts unticked. Ticks it when `allow` is true. Then opens AddWallet and +// presses the die for a recovery phrase. +async function openAddWallet(allow) { + const page = await bootPopup(unversionedValidProfile()); + await page.click("btn-settings"); + const checkbox = page.node(CHECKBOX); + expect(checkbox.checked).toBe(false); + if (allow) { + checkbox.checked = true; + for (const fn of checkbox.listeners.change) await fn(); + expect(page.storage.read("autistmask").allowWeakPasswords).toBe(true); + } + await page.click("btn-main-add-wallet"); + await page.click("btn-generate-phrase"); + return page; +} + +// Types `password` into both password fields and presses Import. +async function importWith(page, password) { + page.node("add-wallet-password").value = password; + page.node("add-wallet-password-confirm").value = password; + await page.click("btn-add-wallet-confirm"); +} + +function storedWalletCount(page) { + return page.storage.read("autistmask").wallets.length; +} + +describe("Allow weak passwords", () => { + test("unticked: a password shorter than 12 characters is refused", async () => { + const page = await openAddWallet(false); + await importWith(page, "short"); + expect(page.text(ERROR)).toBe( + "Password must be at least 12 characters.", + ); + expect(storedWalletCount(page)).toBe(1); + expect(page.visibleViews()).toEqual(["add-wallet"]); + }); + + test("ticked: a password shorter than 12 characters is accepted", async () => { + const page = await openAddWallet(true); + await importWith(page, "short"); + expect(page.text(ERROR)).toBe(""); + expect(storedWalletCount(page)).toBe(2); + expect(page.visibleViews()).toEqual(["main"]); + }); + + test.each([false, true])( + "an empty password is refused (ticked: %s)", + async (allow) => { + const page = await openAddWallet(allow); + await importWith(page, ""); + expect(page.text(ERROR)).toBe("Please choose a password."); + expect(storedWalletCount(page)).toBe(1); + expect(page.visibleViews()).toEqual(["add-wallet"]); + }, + ); +}); diff --git a/tests/persistedFieldContract.test.js b/tests/persistedFieldContract.test.js index ec871df..d1e6c94 100644 --- a/tests/persistedFieldContract.test.js +++ b/tests/persistedFieldContract.test.js @@ -629,8 +629,15 @@ const CONTRACT = [ // the falsy answer is also the DEFAULT_STATE default. falsy: [0], })), - // Each lets a request reach another service, so anything but true is off. - ...["useBlockscout", "checkRecipientsOnEtherscan"].map((field) => ({ + // Anything but true is off for these three settings: + // - useBlockscout and checkRecipientsOnEtherscan let a request reach + // another service. + // - allowWeakPasswords lets AddWallet accept a short password. + ...[ + "useBlockscout", + "checkRecipientsOnEtherscan", + "allowWeakPasswords", + ].map((field) => ({ field, kind: KIND.SCALAR, hostile: [42, "notabool", { a: 1 }],