derivepassphrase.git

@@ -7,7 +7,7 @@

 from __future__ import annotations

 import enum

-from typing import NamedTuple, TypeGuard

+from typing import Literal, NamedTuple, TypeGuard

 from typing_extensions import (

     Any,

@@ -34,11 +34,18 @@ class VaultConfigGlobalSettings(TypedDict, total=False):

             master passphrase. Optional.

         phrase:

             The master passphrase. Optional.

+        unicode_normalization_form:

+            The preferred Unicode normalization form; we warn the user

+            if textual passphrases do not match their normalized forms.

+            Optional, and a `derivepassphrase` extension.

     """

     key: NotRequired[str]

     phrase: NotRequired[str]

+    unicode_normalization_form: NotRequired[

+        Literal['NFC', 'NFD', 'NFKC', 'NFKD']

+    ]

 class VaultConfigServicesSettings(VaultConfigGlobalSettings, total=False):

@@ -123,7 +130,7 @@ def is_vault_config(obj: Any) -> TypeGuard[VaultConfig]:

         o_global = obj['global']

         if not isinstance(o_global, dict):

             return False

-        for key in ('key', 'phrase'):

+        for key in ('key', 'phrase', 'unicode_normalization_form'):

             if key in o_global and not isinstance(o_global[key], str):

                 return False

         if 'key' in o_global and 'phrase' in o_global:

@@ -14,8 +14,10 @@ import inspect

 import json

 import os

 import socket

+import unicodedata

 from typing import (

     TYPE_CHECKING,

+    Literal,

     NoReturn,

     TextIO,

     cast,

@@ -358,6 +360,34 @@ def _prompt_for_passphrase() -> str:

     )

+def _check_for_misleading_passphrase(

+    key: tuple[str, ...],

+    value: dict[str, Any],

+    *,

+    form: Literal['NFC', 'NFD', 'NFKC', 'NFKD'] = 'NFC',

+) -> None:

+    def is_json_identifier(x: str) -> bool:

+        return not x.startswith(tuple('0123456789')) and not any(

+            c.lower() not in set('0123456789abcdefghijklmnopqrstuvwxyz_')

+            for c in x

+        )

+

+    if 'phrase' in value:

+        phrase = value['phrase']

+        if not unicodedata.is_normalized(form, phrase):

+            key_path = '.'.join(

+                x if is_json_identifier(x) else repr(x) for x in key

+            )

+            click.echo(

+                (

+                    f'{PROG_NAME}: Warning: the {key_path} passphrase '

+                    f'is not {form}-normalized. Make sure to double-check '

+                    f'this is really the passphrase you want.'

+                ),

+                err=True,

+            )

+

+

 class OptionGroupOption(click.Option):

     """A [`click.Option`][] with an associated group name and group epilog.

@@ -978,6 +1008,24 @@ def derivepassphrase(

         except OSError as e:

             err(f'Cannot load config: {e.strerror}: {e.filename!r}')

         if _types.is_vault_config(maybe_config):

+            form = cast(

+                Literal['NFC', 'NFD', 'NFKC', 'NFKD'],

+                maybe_config.get('global', {}).get(

+                    'unicode_normalization_form', 'NFC'

+                ),

+            )

+            assert form in {'NFC', 'NFD', 'NFKC', 'NFKD'}

+            _check_for_misleading_passphrase(

+                ('global',),

+                cast(dict[str, Any], maybe_config.get('global', {})),

+                form=form,

+            )

+            for key, value in maybe_config['services'].items():

+                _check_for_misleading_passphrase(

+                    ('services', key),

+                    cast(dict[str, Any], value),

+                    form=form,

+                )

             put_config(maybe_config)

         else:

             err(f'Cannot load config: {_INVALID_VAULT_CONFIG}')

@@ -1064,6 +1112,10 @@ def derivepassphrase(

                 for m in view.maps:

                     m.pop('phrase', '')

             elif use_phrase:

+                _check_for_misleading_passphrase(

+                    ('services', service) if service else ('global',),

+                    {'phrase': phrase},

+                )

                 view['phrase'] = phrase

                 for m in view.maps:

                     m.pop('key', '')

@@ -1099,6 +1151,18 @@ def derivepassphrase(

                     base64.standard_b64decode(key)

                 )

+            if use_phrase:

+                form = cast(

+                    Literal['NFC', 'NFD', 'NFKC', 'NFKD'],

+                    configuration.get('global', {}).get(

+                        'unicode_normalization_form', 'NFC'

+                    ),

+                )

+                assert form in {'NFC', 'NFD', 'NFKC', 'NFKD'}

+                _check_for_misleading_passphrase(

+                    ('interactive',), {'phrase': phrase}, form=form

+                )

+

             # If either --key or --phrase are given, use that setting.

             # Otherwise, if both key and phrase are set in the config,

             # one must be global (ignore it) and one must be

@@ -10,7 +10,6 @@ import base64

 import collections

 import hashlib

 import math

-import unicodedata

 from collections.abc import Callable

 from typing import TypeAlias

@@ -21,13 +20,6 @@ from derivepassphrase import sequin, ssh_agent

 __author__ = 'Marco Ricci <m@the13thletter.info>'

-class AmbiguousByteRepresentationError(ValueError):

-    """The object has an ambiguous byte representation."""

-

-    def __init__(self) -> None:

-        super().__init__('text string has ambiguous byte representation')

-

-

 _CHARSETS = collections.OrderedDict([

     ('lower', b'abcdefghijklmnopqrstuvwxyz'),

     ('upper', b'ABCDEFGHIJKLMNOPQRSTUVWXYZ'),

@@ -97,8 +89,7 @@ class Vault:

         Args:

             phrase:

                 The master passphrase from which to derive the service

-                passphrases.  If a text string, then the byte

-                representation must be unique.

+                passphrases.

             length:

                 Desired passphrase length.

             repeat:

@@ -122,11 +113,6 @@ class Vault:

                 Same as `lower`, but for all other hitherto unlisted

                 ASCII printable characters (except backquote).

-        Raises:

-            AmbiguousByteRepresentationError:

-                The phrase is a text string with differing NFC- and

-                NFD-normalized UTF-8 byte representations.

-

         """

         self._phrase = self._get_binary_string(phrase)

         self._length = length

@@ -230,9 +216,8 @@ class Vault:

     def _get_binary_string(s: bytes | bytearray | str, /) -> bytes:

         """Convert the input string to a read-only, binary string.

-        If it is a text string, then test for an unambiguous UTF-8

-        representation, otherwise abort.  (That is, check whether the

-        NFC and NFD forms of the string coincide.)

+        If it is a text string, return the string's UTF-8

+        representation.

         Args:

             s: The string to (check and) convert.

@@ -240,16 +225,8 @@ class Vault:

         Returns:

             A read-only, binary copy of the string.

-        Raises:

-            AmbiguousByteRepresentationError:

-                The text string has differing NFC- and NFD-normalized

-                UTF-8 byte representations.

-

         """

         if isinstance(s, str):

-            norm = unicodedata.normalize

-            if norm('NFC', s) != norm('NFD', s):

-                raise AmbiguousByteRepresentationError

             return s.encode('UTF-8')

         return bytes(s)

@@ -272,9 +249,6 @@ class Vault:

                 A master passphrase, or sometimes an SSH signature.

                 Used as the key for PBKDF2, the underlying cryptographic

                 primitive.

-

-                If a text string, then the byte representation must be

-                unique.

             service:

                 A vault service name.  Will be suffixed with

                 `Vault._UUID`, and then used as the salt value for

@@ -285,11 +259,6 @@ class Vault:

         Returns:

             A pseudorandom byte string of length `length`.

-        Raises:

-            AmbiguousByteRepresentationError:

-                The phrase is a text string with differing NFC- and

-                NFD-normalized UTF-8 byte representations.

-

         Note:

             Shorter values returned from this method (with the same key

             and message) are prefixes of longer values returned from

@@ -343,17 +312,9 @@ class Vault:

                 If given, override the passphrase given during

                 construction.

-                If a text string, then the byte representation must be

-                unique.

-

         Returns:

             The service passphrase.

-        Raises:

-            AmbiguousByteRepresentationError:

-                The phrase is a text string with differing NFC- and

-                NFD-normalized UTF-8 byte representations.

-

         Examples:

             >>> phrase = b'She cells C shells bye the sea shoars'

             >>> # Using default options in constructor.

@@ -205,27 +205,19 @@ class TestVault:

         assert v.generate(service) == expected

     @pytest.mark.parametrize(

-        ['s', 'raises'],

+        's',

         [

-            ('ñ', True),

-            ('Düsseldorf', True),

-            ('liberté, egalité, fraternité', True),

-            ('ASCII', False),

-            (b'D\xc3\xbcsseldorf', False),

-            (bytearray([2, 3, 5, 7, 11, 13]), False),

+            'ñ',

+            'Düsseldorf',

+            'liberté, egalité, fraternité',

+            'ASCII',

+            b'D\xc3\xbcsseldorf',

+            bytearray([2, 3, 5, 7, 11, 13]),

         ],

     )

-    def test_224_binary_strings(

-        self, s: str | bytes | bytearray, raises: bool

-    ) -> None:

+    def test_224_binary_strings(self, s: str | bytes | bytearray) -> None:

         binstr = Vault._get_binary_string

-        AmbiguousByteRepresentationError = (  # noqa: N806

-            derivepassphrase.vault.AmbiguousByteRepresentationError

-        )

-        if raises:

-            with pytest.raises(AmbiguousByteRepresentationError):

-                binstr(s)

-        elif isinstance(s, str):

+        if isinstance(s, str):

             assert binstr(s) == s.encode('UTF-8')

             assert binstr(binstr(s)) == s.encode('UTF-8')

         else:

@@ -1237,6 +1237,101 @@ contents go here

                 b'Cannot store config' in result.stderr_bytes

             ), 'program unexpectedly failed?!'

+    @pytest.mark.parametrize(

+        ['command_line', 'input', 'error_message'],

+        [

+            pytest.param(

+                ['--import', '-'],

+                json.dumps({

+                    'global': {'phrase': 'Du\u0308sseldorf'},

+                    'services': {},

+                }),

+                'the global passphrase is not NFC-normalized',

+                id='global-NFC',

+            ),

+            pytest.param(

+                ['--import', '-'],

+                json.dumps({

+                    'services': {

+                        DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS.copy(),

+                        'weird entry name': {'phrase': 'Du\u0308sseldorf'},

+                    }

+                }),

+                (

+                    "the services.'weird entry name' passphrase "

+                    'is not NFC-normalized'

+                ),

+                id='service-weird-name-NFC',

+            ),

+            pytest.param(

+                ['--config', '-p', DUMMY_SERVICE],

+                'Du\u0308sseldorf',

+                (

+                    f'the services.{DUMMY_SERVICE} passphrase '

+                    f'is not NFC-normalized'

+                ),

+                id='config-NFC',

+            ),

+            pytest.param(

+                ['-p', DUMMY_SERVICE],

+                'Du\u0308sseldorf',

+                'the interactive passphrase is not NFC-normalized',

+                id='direct-input-NFC',

+            ),

+            pytest.param(

+                ['--import', '-'],

+                json.dumps({

+                    'global': {

+                        'unicode_normalization_form': 'NFD',

+                        'phrase': 'D\u00fcsseldorf',

+                    },

+                    'services': {},

+                }),

+                'the global passphrase is not NFD-normalized',

+                id='global-NFD',

+            ),

+            pytest.param(

+                ['--import', '-'],

+                json.dumps({

+                    'global': {

+                        'unicode_normalization_form': 'NFD',

+                    },

+                    'services': {

+                        DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS.copy(),

+                        'weird entry name': {'phrase': 'D\u00fcsseldorf'},

+                    }

+                }),

+                (

+                    "the services.'weird entry name' passphrase "

+                    'is not NFD-normalized'

+                ),

+                id='service-weird-name-NFD',

+            ),

+        ],

+    )

+    def test_300_unicode_normalization_form_warning(

+        self,

+        monkeypatch: Any,

+        command_line: list[str],

+        input: str | None,

+        error_message: str,

+    ) -> None:

+        runner = click.testing.CliRunner(mix_stderr=False)

+        with tests.isolated_config(

+            monkeypatch=monkeypatch,

+            runner=runner,

+            config={'services': {DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS.copy()}},

+        ):

+            result = runner.invoke(

+                cli.derivepassphrase,

+                command_line,

+                catch_exceptions=False,

+                input=input,

+            )

+            assert (result.exception, result.exit_code) == (None, 0)

+            assert result.stderr_bytes is not None

+            assert error_message in result.stderr

+

 class TestCLIUtils:

     def test_100_save_bad_config(self, monkeypatch: Any) -> None:

@@ -0,0 +1 @@

+Warn the user when entering (directly, or via configuration editing/importing) a passphrase that is not in the configured Unicode normalization form. (But don't otherwise reject any textual master passphrases.)