Changeset 49

Timestamp:

07/27/06 02:35:10 (2 years ago)

Author:

jm3

Message:

decryption + verification working!

Files:

• 10kz/scripts/crypto-ui-injector.user.js (modified) (7 diffs)
• 10kz/shell/perl.jm3 (modified) (4 diffs)

10kz/scripts/crypto-ui-injector.user.js

@@ -17 +17 @@
-function get_error_bad_pass_for_signing() { return "clearsign failed: bad passphrase"; /* FIXME: localize-ready this */ }
-function get_encrypted_message_note() {     return "This is an encrypted message (wooo, scary!). To read it, enter your passphrase: "; }
- The signature was/was not valid FIXME: 
+
-function get_adverlink() {                  return "\n\nWondering what this mysterious gibberish is? Learn more here: \nhttp://codeswami.com/secure-mail-that-doesnt-suck/\n\n"; }
-
@@ -43 +43 @@
-}
-
+
+/* called when signing or encrypting -- anything that needs  your pgp creds */
-function build_gpg_qs( arg_mode ) {
+        if( arg_mode == "verify" )
+                return "";
-        var strSubmit = "";
-        var k = document.getElementById( "gpg_key_id" );
@@ -197 +201 @@
-function encrypt_message() {
-        return process_message( "encrypt", "" );
+}
+
+function decrypt_or_verify( arg_mode, content ) {
+        var myfield = document.createElement( "div" );
+        myfield.setAttribute( "mode", "verify" );
+
+        rename_this_shit( myfield, content );
-}
-
@@ -333 +344 @@
-}
-
-handle_passphase_entry( myfield, e
+rename_this_shit( myfield
-        var mode = myfield.getAttribute( "mode" ) ? myfield.getAttribute( "mode" ) : "decrypt";
-
-
+let 
-        var mode_verb = (mode == "sign") ? "signing" : "decryption";
-        var mode_pasttense_verb = (mode == "sign") ? "signed" : "decrypted";
-
+        /* FIXME: refactor the AJAX call out of this func: */
+        var post_data = "mode=" + mode + "&passphrase=" + escape( myfield.value);
+
+        // HACK: FF javascript not correctly url-encoding pluses in textareas, so we do it ourselves...
+        var ct = myfield.getAttribute('ct');
+        ct = (ct && ct != "undefined") ? ct : content; /* HACK: this can come in two different ways */
+        ct = ct.replace(/\+/g, "__PLUS__");
+        
+        // make sure to strip anything preceding the --- HEADER stuff or GPG gets confused
+        if( ct.indexOf( '</script>' ) != -1 ) {
+                var regex=/^.*<div style="direction: ltr;">/m;
+                ct = ct.replace(regex,"");
+        }  
+        post_data += "&plaintext=" + escape( ct );
+        
+        // close the GM_xhr over this for later
+        var mb = myfield.getAttribute('mb');
+
+        // CONFUSING: wonky breakout to avoid duplicating above handle-enter code
+        if( mode == "sign" ) {
+                process_message( mode, myfield.value );
+                return;
+        } // implied else
+                
+        GM_xmlhttpRequest({
+                        method: 'POST',
+                        url: get_crypto_url() + "/perl.jm3",
+                        headers: {
+                                'User-agent': 'Mozilla/4.0 (compatible) Greasemonkey',
+                                'Accept': 'application/atom+xml,application/xml,text/xml',
+                                'Content-Type': 'application/x-www-form-urlencoded',
+                        },
+                        onload: function(responseDetails) {
+                                log( responseDetails.responseText );
+                                /* FIXME: parse the response back for obvious errors like bad passphrase and signal them to user */
+                                /* FIXME: const this: */
+                                var bad_passphrase = "failed: bad passphrase";
+                                if( responseDetails.responseText.indexOf( bad_passphrase ) != -1)
+                                        return bail( "The passphrase you typed didn't work.\nPlease make sure it's correct.");
+
+                        // reformat the mesg:
+                        var regex=/\n/g;
+                        var t = responseDetails.responseText.replace(regex,"<br>");
+
+                        var injection_point = document.getElementById( "mb" );
+                        if( !injection_point )
+                                injection_point = document.getElementById( "mb_0" );
+                        if( !injection_point ) {
+                                var body = document.getElementById('ta_compose');
+                                body = !body ? document.getElementById('ta_0') : body; /* for drafts... */
+                                if( ! body ) {
+                                        bail( "can't find suitable injection point for " + mode_pasttense_verb + " message: " + responseDetails.responseText);
+                                        return;
+                                }
+                                body.value = responseDetails.responseText;
+                        }
+                        
+                        if( injection_point )
+                                injection_point.innerHTML = "<div style='direction:ltr;'>" + t + "</div>";
+                        else
+                                return log( "can't find injection point: 'id: mb'" );
+                        
+                },
+                data: post_data
+        });
+}
+
+function handle_passphase_entry( myfield, e, content ) {
-        var keycode;
-        if (window.event)
@@ -352 +431 @@
-        if (keycode == 13) {
-                if( myfield.value.length > 0 ) {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
-                        e.preventDefault();
-                        return false;
@@ -521 +535 @@
-                } else if( ct.indexOf( "-----BEGIN PGP SIGNED MESSAGE-----") != -1) {
-                
-inject verify UI
+unlike decryption which is user-initiated for security (to protect against shoulder-surfing), verification happens ASAP
-
-                        mb.parentNode.insertBefore(f, mb);
@@ -527 +541 @@
-
-                        log( "message body " + i + " contains signed PGP content");
-
-
+
-                } 
-                i++;

10kz/shell/perl.jm3

@@ -8 +8 @@
-use IO::File;
-
-0
+1
-if( $debug ) {
-        open LOG, ">/tmp/10kz.log" or print "\n\nCouldn't open logfile for writing: $!\n";
@@ -20 +20 @@
-my $KEY_HOME = "/Users/jmanoogi/.gnupg";
-
-#print header;
-#if( $debug == 1 ) { print header('text/XMl'); } else {
-print header('text/plain');
-#}
-        
-if (param()) {
@@ -36 +33 @@
-        $key_id =~      s/([\&;\`'\\\|"*?~<>^\(\)\[\]\{\}\$\n\r])/\\$1/g;
-        $passphrase =~  s/([\&;\`'\\\|"*?~<>^\(\)\[\]\{\}\$\n\r])/\\$1/g;
+
-        # don't shell-encode the plaintext (it will be stored in a file)
-        $recipients = parse_recips( $recipients );
-        $recipients =~  s/([\&;\`'\\\|"*?~<>^\(\)\[\]\{\}\$\n\r])/\\$1/g;
-        $plaintext  =~ s/__PLUS__/+/g;
+        my $pt = "/tmp/plaintext";
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        open PLAINTEXT, ">$pt" or print "\n\nCouldn't open '$pt' to write: $!\n";
-        print PLAINTEXT $plaintext;
-        close PLAINTEXT; 
-
-        my $default_ops = "--no-tty "
-                . " --no-permission-warning --load-extension idea --homedir $KEY_HOME";
-        my $recips = "$recipients -r $key_id --default-key $key_id ";
-
-        my $sign_cmd    = "echo '$passphrase' | $bin/gpg $default_ops --command-fd 0 --passphrase-fd 0 --armor --clearsign $pt";
-        my $decrypt_cmd = "echo '$passphrase' | $bin/gpg $default_ops --command-fd 0 --passphrase-fd 0 --ignore-crc-error --output $pt.asc --decrypt $pt";
-        my $cmd =                              "$bin/gpg $default_ops $recips --armor --encrypt $pt";
-
-        if( $mode eq "sign"    ) { $cmd = $sign_cmd; }
-        if( $mode eq "decrypt" ) { $cmd = $decrypt_cmd; }
-        if( $debug == 1 ) { print LOG "\$cmd: $cmd\n"; }
-        if( $debug == 1 ) { print LOG "\$plaintext: $plaintext\n"; }
-
-        # FIXME: need to tee off stderr here so we can capture and optionally grovel through GPG's egregiously bad error messages
@@ -82 +88 @@
-        }
-        
-
+&& $mode ne "verify" 
-                $data = `cat $pt.asc`;
-                print "<?xml version='1.0'?>\n<data>$data</data>";
+        } elsif( $mode eq "verify" ) {
+                print "<?xml version='1.0'?>\n<data>$err\n\n$plaintext</data>";
-        } else {
-                print "<?xml version='1.0'?>\n<data><error>mode: $mode\n Source: $plaintext\n$err\nCommand:\n$cmd</error></data>";
-        }
-
+        # cache these for post-hoc analysis
-        if( $debug == 1 ) {
-
-
+
+
+
+
+
+
-        }
-        unlink $pt;
-        unlink "$pt.asc";
-
-
+
+
+
-
-} else {