subutai-io / browser-plugins Goto Github PK

Subutai browser plugins for e2e encryption.

JavaScript 98.13% HTML 0.63% CSS 1.20% Shell 0.03%

browser-plugins's Introduction

Subutai E2E Plugin

Effortlessly secure the doors to your Subutai Cloud

Security is utterly important in Subutai and this plugin helps keep you and your cloud secure. We use encryption, digital signatures, and keys all over the place. Even simple things you do involve complicated security operations behind the scenes. One of most important principles is to make sure your keys for performing these tasks are never transferred or taken off your computer to get into the wrong hands. To help enforce this, we have to make sure everything transferred is encrypted, or signed end-to-end. We also don't want to slow and weigh you down with complicated things you would have to do manually without this plugin. The complexity could lead to a mistake if you had to do some things manually and that would greatly reduce security.

The Subutai E2E plugin works on your computer with your browser to manage the keys to your cloud environments. It works with Subutai and the Hub to perform complicated tasks seamlessly for you. These keys are never exposed, or transferred, always staying right where they were created and protected by a passcode. In the future, the plugin will interoperate with USB hardware security modules to not even store keys on your computer and allow them to move around with you and your USB device.

Development

Install Node.js and NPM

Add Node.js PPA

 sudo apt-get install python-software-properties
 curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -

Install Node.js

 sudo apt-get install nodejs
 sudo apt-get install nodejs-legacy
 sudo apt-get install npm

Make sure you have successfully installed node.js and npm on your system

 node --version
 npm --version

Install Grunt using NPM
```
 sudo npm install -g grunt
```
After successful installation make sure grunt has been installed successful and check version.
```
 grunt --version
```
Install Bower using NPM
```
 sudo npm install -g bower
```
Let's check the installed version of bower on your system using following command.
```
 bower --version
```

Run:

bash setup.sh

browser-plugins's People

Contributors

Watchers

Forkers

talaszh crioto asansanwal

browser-plugins's Issues

Console debug in prod

The Chrome plugin has an annoying habit of writing debug information in the console of every web page.

E2E plugin does not see SS

Installed from windows installer;
login to SS;
Installed plugin from chrome web store.

When we accidentally input some password

When we accidentally input some password and turn off button "Protect your key with password" appears alert(watch video). Button should clear all inputed information.

Install extension from chrome store results in duplicate extensions (when a previous one was in place)

I have installed the chrome extension a couple months ago. Yesterday, while trying to access a recently created environment, I found a link almost hidden in its container view:

From that, it seems the e2e plugin is on version 4.0.0 already. So I decided to upgrade it. I'm not sure I remember, but I think it has been installed back then from a file then offered on the getting-started page. Yesterday I haven't found it in the same spot. The release page offers zip files with no explanation on how to install. Then I tried the chrome store, found it and installed. Instead of updating the e2e plugin, I ended up with two plugins installed:

EZ-Desktop with E2E plugin

Implement trigger, which is listening for Subutai Console and Hub ez-desktop buttons and triggers Subutai Tray

Enable swarm join status feedback for EZ-SSH

https://confluence.critical-factor.com/x/OIHBAQ

Buttons looks not nice enough on key deletion )

Was going to delete lost key from Subutai E2E Plugin, faced problem that buttons have strange style and formatting:

Add auth id signing for kurjun authentication

Add message signing for kurjun authentication with key that is created with plugin
automatically detect login screen and sign message with plugin

[Generate] Can't chose another options in advancedl.

For replay this situation you need:

Test case

Go to E2E plugin page.
Click on button "Generate".
Click on checkbox "Advanced"

Result: Observe "Advanced" menu. If try to change options can observe that we have only one variation of settings.
It will be better if we hide "Advanced" checkbox.

Pass keys between browsers

Browser plugin need to allow people to use the hub to pass their keys between browsers.

Allow using browser plugin for other domains than 'hub.subut.ai' too

Seems browser E2E plugin is hard-coded to be used only with hub.subut.ai domain. If you open Hub by IP address, EZSSH button in container list of environment is not active.

Migrate subut.ai related configurations to subutai.io

No error is shown when user tries to sign message with expired key

I have PGP key, which is expired. In popup dialog for signing message, I select this expired key, and signing doesn't occur. Just nothing happens. Reason is that key is expired. I think browser plugin must show some error or warning in such cases.

[Export] After export of PGP, pop-up window doesn't close.

For replay this bug you need:

Test case

Go to E2E plugin page.
Click on button "export".
Click on button "export" in pop-up window.

Result: Export pop-up window doesn't close.

The problems mozilla is having with the plugin design must be rectified immediately

These have been reported before. You should have the emails to determine what these changes are. This is critical because it blocks deployment in their store.

Typo in enter password form

When browser plugin requests user to enter password of key, in title of input field there is a type:
"mAssage" should be "message".

'Wrong password' text is always visible

'Wrong password' text is always visible, even on initial open window

my browser plugin version is v.2.0.9

display problems

on debian firefox

E2E plugin doesn't say that password is incorrect, if you enter wrong password

If I protected my PGP key via password, and then try to authorize from bazaar side, but input incorrect password-nothing happens, just password window disappearing and authorization doesn't happen( which correct)
As a user I want to see error message that my password is incorrect.

[E2E plugin install] Can't download plugin on chrome.

For replay this bug you need:

Test case

Go to chrome browser.
Go to URL https://chrome.google.com/webstore/detail/subutai-social-e2e-plugin/kpmiofpmlciacjblommkcinncmneeoaa?utm_source=chrome-ntp-icon
Click on button Install.
Observe pop-up window.
Click button "Add extension"

Result: Observe pop-up window "Download interrupted"

Add option to sign arbitrary text

Plugin must enable users to sign arbitrary text with a chosen key

Remove X icon when autosigning for element that has specific class

When we have plugin autosign data inside an html element, it shows X icon.
For visible data elements it is ok, but for those that are invisible (say have a specific class name) we should not shot the icon.

[UI] Not closing Set Public Key dialog after pressing x or cancel button on Osx(IMac) Chrome browser

[Export] Need to add button like "export as..."

For replay this enhancement you need:

Test case

Go to E2E plugin page.
Click on button "export".

Result: Observe pop-up window "Export keys". Need to add button "export as..." to chose directory to save file.

CDN authorization doesn't work on FF (PROD)

Case: registered new user, went to FF addons, added subutai e2e. Then generated pgp key for user, uploaded it to profile in bazaar. Then went to environment creation page, got cdn auth window. Result - auth window stuck for more than 10 minutes already.

OS - windows, browser - FF, user - https://bazaar.subutai.io/users/2148

Password prompt view is not showing keyId

when plugin request from user his password for key, keyId is not shown.

Show message if user not found on CDN authorization

Show message if user not found on CDN authorization. Currently, it will freeze trying to sign key, which does not exist in e2e plugin

SSH via Tray directly to any container in any environment from web application

Although the starting point could be the SSH capability but any functionality of the Tray can be triggered by the browser plugin via directives embedded into web applications like the SS console or the Hub. The idea is a web UI component can expose some hidden tag that triggers the browser plugin to enable a button. Once pressed this would trigger the Tray application via local socket or some other mechanism to SSH into the container.

The question the requires some research is what's the best mechanism to use. The Tray application could provide even a command interface via CLI or via socket so the browser plugin can invoke commands on it like for example to SSH into a container in an environment.

Solve deploy warnings of Firefox

0 errors, 36 warnings, 1 notice

Unsafe assignment to outerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/dep/purify.js line 340 column 13
Unsafe call to insertAdjacentHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/dep/purify.js line 429 column 21
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/dep/purify.js line 439 column 13
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert2.min.js line 1 column 4594
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert2.min.js line 1 column 4898
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert2.min.js line 1 column 5012
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert2.min.js line 1 column 6200
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert2.min.js line 1 column 6235
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert2.min.js line 1 column 11221
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert.min.js line 1 column 3407
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert.min.js line 1 column 9898
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert.min.js line 1 column 13216
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert.min.js line 1 column 13290
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert.min.js line 1 column 15299
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert.min.js line 1 column 15367
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert2.js line 516 column 5
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert2.js line 553 column 5
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert2.js line 570 column 5
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert2.js line 576 column 7
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert2.js line 672 column 5
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/sweetalert2.js line 673 column 5
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/swal2.js line 575 column 5
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/swal2.js line 612 column 5
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/swal2.js line 629 column 5
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/swal2.js line 635 column 7
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/swal2.js line 733 column 5
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/swal2.js line 734 column 5
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/dep/qrcodejs/qrcode.js line 254 column 4
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

lib/common/closure-library/closure/goog/string.js line 604 column 7
eval can be harmful.
Warning: Evaluation of strings as code can lead to security vulnerabilities and performance issues, even in the most innocuous of circumstances. Please avoid using eval and the Function constructor when at all possible.'

require.js line 2071 column 16
eval can be harmful.
Warning: Evaluation of strings as code can lead to security vulnerabilities and performance issues, even in the most innocuous of circumstances. Please avoid using eval and the Function constructor when at all possible.'

common/dep/jquery.min.js line 2 column 2397
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/dep/jquery.min.js line 3 column 13453
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/dep/jquery.min.js line 3 column 15724
eval can be harmful.
Warning: Evaluation of strings as code can lead to security vulnerabilities and performance issues, even in the most innocuous of circumstances. Please avoid using eval and the Function constructor when at all possible.'

common/scripts/libs/jquery-2.1.1.min.js line 2 column 2400
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/jquery-2.1.1.min.js line 3 column 13933
Unsafe assignment to innerHTML
Warning: Due to both security and performance concerns, this may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.

common/scripts/libs/jquery-2.1.1.min.js line 3 column 16160
Known JS library detected
Warning: JavaScript libraries are discouraged for simple add-ons, but are generally accepted.

common/dep/bootstrap/js/bootstrap.js

Solution: https://developer.mozilla.org/en-US/docs/Archive/B2G_OS/Security/Security_Automation

Invisible pop-up disabled plugin's page in Edge Browser

Manually (not from the Store) installed Subutai Edge plugin, when I opened plugin's Options page,
an invisible pop-up appeared and disabled plugin's functionality.

To see the pop-up window:

I opened browser Console (F12) in plugin's Options page
Refreshed the page, tried to resize, scroll down
Finally, in the bottom, a pop-up window appeared.
Just closed that window

The version of E2E does not show up.

The version of E2E does not show up. Also options button does not respond on Firefox. I am facing with this problem everyday. I have to remove and reinstall E2E plugin to authorize and work further.

Reload button doesn't react

When I push "Reload" button, nothing happens, maybe something reloads on the background, but I don't see it.
As a user I want to see some action after pushing this button.

[acceptance-testing] [safari] wrong filename on export keys

Export existing keys from E2E plugin generate "Unknown" filename

Key selector is not visible in Firefox

Sometimes (almost always) key selector is not visible even if key selector parent form is visible. This happens only in Firefox when I'm setting key in Hub user settings form. Ctrl+F5 doesn't help, but i noticed that if i close selector form by clicking 'x' icon (red circle on picture) and then reload page, then when i open settings form, key selector become visible.