Skip to content

fix: mask ConversationMeta.last_preview on deserialization to prevent plaintext exposure #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
WilleLX1 merged 4 commits into from
Mar 7, 2026
Merged

fix: mask ConversationMeta.last_preview on deserialization to prevent plaintext exposure #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c3396b7
Initial plan
Copilot Mar 6, 2026
bd703f2
fix: preserve last_preview in ConversationMeta deserialization
Copilot Mar 6, 2026
577d94b
Update client-cpp-gui/include/blackwire/storage/client_state.hpp
WilleLX1 Mar 6, 2026
24f7467
fix: update test to expect masked last_preview after deserialization
Copilot Mar 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 3 additions & 6 deletions client-cpp-gui/include/blackwire/storage/client_state.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,12 +122,9 @@ inline void from_json(const nlohmann::json& j, LocalMessage& v) {
inline void from_json(const nlohmann::json& j, ConversationMeta& v) {
v.peer_username = j.value("peer_username", "");
v.peer_address = j.value("peer_address", "");
if (j.contains("last_preview")) {
const auto preview = j.value("last_preview", "");
v.last_preview = preview.empty() ? "" : "(encrypted message)";
} else {
v.last_preview = "";
}
// Never deserialize historical last_preview plaintext from disk into runtime state.
// This prevents resurfacing any sensitive previews that may have been persisted.
v.last_preview = "[encrypted message]";
v.last_activity_at = j.value("last_activity_at", "");
}

Expand Down
2 changes: 1 addition & 1 deletion client-cpp-gui/tests/test_state_dedup.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,6 @@ TEST(StateDedupTest, ConversationMetaRoundTrip) {
ASSERT_TRUE(restored.conversation_meta.contains("conv-1"));
const auto& loaded_meta = restored.conversation_meta.at("conv-1");
EXPECT_EQ(loaded_meta.peer_username, "alice");
EXPECT_EQ(loaded_meta.last_preview, "hello");
EXPECT_EQ(loaded_meta.last_preview, "[encrypted message]");
EXPECT_EQ(loaded_meta.last_activity_at, "2026-02-14T12:00:00Z");
}
Loading