DragonX/ObsidianDragon
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

fix(chat): harden reply-target + scrub legacy secret (B2/B4)

Browse Source 
B4: the legacy chat-identity fallback copied the z_exportkey spending key out of
the RPC response and let the temporary json destruct un-zeroed. Mirror the
mnemonic path — take our copy, then sodium_memzero the json's own buffer.

B2: the memo header's peer z-address / cid ride OUTSIDE the secretstream AEAD, so
trusting the newest message's header let a later message redirect our replies or
splice threads. Pin the reply target (and displayed peer) to the EARLIEST
(establishing) message instead of the latest, at both the send and display sites.
Because ChatStore returned filtered INSERTION order (a scan harvests txids in
set/hash order — not chronological), "earliest" wasn't reliable; ChatStore::
conversation now returns messages sorted by (timestamp, txid, payload_position),
which also fixes out-of-order thread rendering and the last-message preview.

A complete fix binds z+cid into the AEAD additional-data, but that's a coordinated
HushChat/SDXLite wire-format change; this pin hardens the reply target without it.
Adversarially verified; the store-ordering gap it surfaced is fixed here.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
DanS
2026-07-16 16:07:12 -05:00
parent 100ed01469
commit 7f46d9e2d5
3 changed files with 31 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/app_network.cpp
View File

@@ -2772,7 +2772,14 @@ void App::maybeProvisionChatIdentity()
unavailable = true;
} else {
try {
secret = rpc_->call("z_exportkey", {fallbackZaddr}).get<std::string>();
// Mirror the mnemonic path: take our copy, then scrub the json's own copy of the
// spending key so it isn't left in freed heap (B4). z_exportkey returns a bare string.
auto keyResp = rpc_->call("z_exportkey", {fallbackZaddr});
if (keyResp.is_string()) {
auto& key = keyResp.get_ref<std::string&>();
secret = key;
if (!key.empty()) sodium_memzero(&key[0], key.size());
}
} catch (const rpc::RpcError&) {
unavailable = true; // no spending key either (view-only?) — give up
} catch (const std::exception&) {
@@ -2921,12 +2928,17 @@ void App::sendChatMessage(const std::string& conversationId, const std::string&
if (!chat::hushChatFeatureEnabledAtBuild() || !chat_service_.hasIdentity()) return;
if (text.empty() || conversationId.empty()) return;
// The peer's z-address + public key come from a message we already have in this conversation.
// The peer's z-address + public key come from a message we already have in this conversation. Pin to
// the EARLIEST (establishing) values, not the latest: the memo header's `z`/`cid` ride outside the
// AEAD, so trusting the newest would let a later message redirect our replies to an attacker-chosen
// address / splice threads (B2). A full fix binds z+cid into the secretstream additional-data, but
// that's a coordinated HushChat/SDXLite wire-format change; pinning hardens the reply target without it.
std::string peerZaddr;
std::string peerPubKey;
for (const auto& m : chat_service_.store().conversation(conversationId)) {
if (!m.peer_zaddr.empty()) peerZaddr = m.peer_zaddr;
if (!m.peer_public_key_hex.empty()) peerPubKey = m.peer_public_key_hex;
if (peerZaddr.empty() && !m.peer_zaddr.empty()) peerZaddr = m.peer_zaddr;
if (peerPubKey.empty() && !m.peer_public_key_hex.empty()) peerPubKey = m.peer_public_key_hex;
if (!peerZaddr.empty() && !peerPubKey.empty()) break;
}
if (peerPubKey.empty()) {
ui::Notifications::instance().info(TR("chat_toast_waiting_reply"));