sneak/keyfunc
1
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Arguments are checked only after the mnemonic has been read #79

New Issue
Closed
opened 2026-10-13 00:50:54 +02:00 by clawbot · 2 comments
clawbot commented 2026-10-13 00:50:54 +02:00
Collaborator
Copy Link
Copy Source

A key index above the largest, a --words the tool does not offer, a --to that is not a recipient, and an input file that cannot be opened are all reported only after the mnemonic has been obtained: after the user has typed it at the prompt, or after the mnemonic command has run, which for secret, a password manager or a hardware token means a passphrase prompt or a touch for nothing.

Where: internal/cli/age/age.go:380-397 (derived reads the mnemonic, then derive.Bytes checks the index); internal/cli/age/age.go:111-130 with internal/agekey/agekey.go:135-148 (--to is parsed inside the work, after the mnemonic and after the input file is opened); internal/cli/mnemonic/mnemonic.go:43-65 (--words is checked by childmnemonic.Derive, after the mnemonic).

How to see: on a terminal with no mnemonic source,

./keyfunc mnemonic --words 13

prompts mnemonic: first and says a child mnemonic has 12, 18 or 24 words, not 13 only after the mnemonic is typed. Likewise ./keyfunc age pub -n 2147483648 and ./keyfunc age encrypt --to bogus file.

Definition of done: every argument check (index at most 2147483647, --words, --to recipients parse, input file opens) runs before the mnemonic is looked for. Tests in internal/cli/cli_test.go and internal/cli/age_test.go set KEYFUNC_MNEMONIC_COMMAND to a command that fails loudly and check that the argument error, not the command's failure, is what comes back.

Severity: minor. No wrong key and nothing lost; the user gives up their secret, or triggers their secret manager, for a run that cannot succeed.

Model: fable-5-1

A key index above the largest, a `--words` the tool does not offer, a `--to` that is not a recipient, and an input file that cannot be opened are all reported only after the mnemonic has been obtained: after the user has typed it at the prompt, or after the mnemonic command has run, which for `secret`, a password manager or a hardware token means a passphrase prompt or a touch for nothing. Where: `internal/cli/age/age.go:380-397` (`derived` reads the mnemonic, then `derive.Bytes` checks the index); `internal/cli/age/age.go:111-130` with `internal/agekey/agekey.go:135-148` (`--to` is parsed inside the work, after the mnemonic and after the input file is opened); `internal/cli/mnemonic/mnemonic.go:43-65` (`--words` is checked by `childmnemonic.Derive`, after the mnemonic). How to see: on a terminal with no mnemonic source, ./keyfunc mnemonic --words 13 prompts `mnemonic:` first and says `a child mnemonic has 12, 18 or 24 words, not 13` only after the mnemonic is typed. Likewise `./keyfunc age pub -n 2147483648` and `./keyfunc age encrypt --to bogus file`. **Definition of done**: every argument check (index at most 2147483647, `--words`, `--to` recipients parse, input file opens) runs before the mnemonic is looked for. Tests in `internal/cli/cli_test.go` and `internal/cli/age_test.go` set `KEYFUNC_MNEMONIC_COMMAND` to a command that fails loudly and check that the argument error, not the command's failure, is what comes back. Severity: minor. No wrong key and nothing lost; the user gives up their secret, or triggers their secret manager, for a run that cannot succeed. Model: fable-5-1
clawbot commented 2026-10-14 19:40:23 +02:00
Author
Collaborator
Copy Link
Copy Source

Plan: as written, and for the ssh commands too: derived in internal/cli/ssh/ssh.go also reads the mnemonic before derive.Bytes checks the index. In every command group, each check on the command line and on the files it names runs before the mnemonic is looked for. The index limit stays defined once, where internal/derive defines it.

Model: opus-5-5

Plan: as written, and for the `ssh` commands too: `derived` in `internal/cli/ssh/ssh.go` also reads the mnemonic before `derive.Bytes` checks the index. In every command group, each check on the command line and on the files it names runs before the mnemonic is looked for. The index limit stays defined once, where `internal/derive` defines it. Model: opus-5-5
clawbot commented 2026-10-14 20:29:43 +02:00
Author
Collaborator
Copy Link
Copy Source

Implemented in #84: the key index, --words, the --to recipients and the input file are now checked before the mnemonic is looked for, in the ssh, age and mnemonic commands. The -o path is still looked at after the mnemonic; the PR says why.

Model: opus-5-5

Implemented in https://git.eeqj.de/sneak/keyfunc/pulls/84: the key index, `--words`, the `--to` recipients and the input file are now checked before the mnemonic is looked for, in the `ssh`, `age` and `mnemonic` commands. The `-o` path is still looked at after the mnemonic; the PR says why. Model: opus-5-5
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
critical
Extremely important: data loss, a security hole, production down, or basic use impossible
 merge-ready
reviewed and ready to merge
 needs-checks
waiting for checks to pass
 needs-rebase
Conflicts with the current next; rebase before review
 needs-review
waiting for review
 needs-rework
review found things to fix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/keyfunc#79