Fix account data not persisting on web#296
Conversation
✅ Deploy Preview for swissbitcoinpayapp ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for app-swiss-bitcoin-pay-ch ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| return localStorage.setItem(key, arrayBufferToBase64(combined.buffer)); | ||
| } else { | ||
| return localStorage.setItem(key, value); |
Check failure
Code scanning / CodeQL
Clear text storage of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
The best way to fix this problem is to ensure that all sensitive information—including data.hmacSecret—is only ever stored in an encrypted form. This means that when calling AsyncStorage.setItem for sensitive values, an appropriate encryptionKey must be supplied. In the present case, useAccountConfig.ts is calling AsyncStorage.setItem(keyStoreHmac, data.hmacSecret) without an encryption key. The correct fix is to ensure a secure encryption key is determined and passed to this call. The encryption key should be unique per user/session and derived from a secure source (such as the user's password, a device-bound key, or a secure credential store).
Files to change:
- src/hooks/useAccountConfig.ts: When storing
hmacSecret, pass a valid encryption key as the fourth argument toAsyncStorage.setItem. - If no suitable encryption key is available in scope, one must be sourced or derived securely (e.g., from another value in
data, from user input, or from app context). If a suitable key is already present (e.g.,data.apiKeyor another secure value), use that.
What is needed:
- Update the call to
AsyncStorage.setItemfor the HMAC secret to provide an encryption key. - If no encryption key is available, introduce a mechanism to derive or retrieve it securely for this purpose.
- No changes are required to AsyncStorage itself, as it already supports encryption.
| @@ -54,7 +54,8 @@ | ||
| typeof data.hmacSecret === "string" && | ||
| (data.isCheckoutSecure || data.isAtm) | ||
| ) { | ||
| await AsyncStorage.setItem(keyStoreHmac, data.hmacSecret); | ||
| // Use the API key as the encryption key for hmacSecret storage | ||
| await AsyncStorage.setItem(keyStoreHmac, data.hmacSecret, undefined, data.apiKey); | ||
| } | ||
|
|
||
| setAccountConfig(_accountConfig); |
SwissBitcoinPay
changed the title
SwissBitcoinPay
changed the title
3 participants
No description provided.