Prevent Klipper from storing secrets in clipboard history #1969

TheZ3ro · 2018-05-16T13:17:37Z

Description

Fix #584
Porting of keepassx/keepassx#211 "Add hint for Klipper to not add passwords to history" by @roberthoffmann
Relevant Klipper issue/PR https://phabricator.kde.org/D12539

Motivation and context

Klipper adds every item to the clipboard history, unless an additional mime type 'x-kde-passwordManagerHint is set to secret.

How has this been tested?

I cannot test this since I don't have klipper installed.
Maybe @phoerious or @Germano0 can test this

Types of changes

✅ New feature (non-breaking change which adds functionality)

Checklist:

✅ I have read the CONTRIBUTING document. [REQUIRED]
✅ My code follows the code style of this project. [REQUIRED]
✅ All new and existing tests passed. [REQUIRED]
✅ I have compiled and verified my code with -DWITH_ASAN=ON. [REQUIRED]

phoerious · 2018-05-17T15:50:14Z

src/gui/Clipboard.h

@@ -31,7 +31,8 @@ class Clipboard : public QObject
    Q_OBJECT

 public:
-    void setText(const QString& text);
+    void setText(const QString& text, bool secret = false);


You also need to replace all usages of setText() with the call to the secret version.

Why? Non secret field will be visible. Only passwords will be omitted from the clipboard history.
I've already changed the copy-password to clipboard usages to use the secret version.
Other fields will call setText with secret set to false by default

I don't see any use of the new functions in this PR, except in setClipboardSecretTextAndMinimize() (which is also new).
Besides, I would prefer this flag to be set for everything. Usernames etc. are also cleared from the clipboard after the timeout, so they should also not be in the history.

setClipboardSecretTextAndMinimize() itself it's used when copying the password
(line 551 and 944 of DatabaseWidget.cpp)

I will change it since I agree that all field should be treated like secrets

If you have any dubts, you may want to ask Martin Flöser, the Klipper developer.
When the patch will be finished, please let me know, so I will test it

phoerious · 2018-06-08T11:41:46Z

Somehow this PR shrunk. What happened to the rest of the changes and to what I nagged about in my first review?

TheZ3ro · 2018-06-11T13:10:27Z

@phoerious look at the difference between the two commits.

In the old commit:

I defined a new setSecretText function in the Clipboard class with the secret MIMEtype (used by Klipper to delete entries from history)
I defined a new setClipboardSecretTextAndMinimize function in the DatabaseWidget class calling the setSecretText one
I used the setClipboardSecretTextAndMinimize function whenever the password was copied to clipboard

In the new commit:

I edited the already existing setText function in the Clipboard class to always expose the secret MIMEtype when copying any text to clipboard.
Klipper will catch this and delete the entries from his history but other clipboard manager will happily ignore and perform as standard

IMHO it seems pretty easy to understand from the code

phoerious · 2018-06-11T13:33:02Z

All I see in the Diff are +11 -3

TheZ3ro · 2018-06-11T22:37:11Z

Checkout the feature/klipper-password branch, do a git log to see the 2 commit i'm talking about:

commit a4f7923
Author: thez3ro
Date: Tue May 29 22:35:00 2018 +0200
all fields are protected

commit 9f244eb
Author: thez3ro
Date: Wed May 16 15:00:41 2018 +0200
prevent klipper from storing password in clipboard history

Then you can:

use git diff HEAD~2 HEAD~1 to display the second-last commit (labeled old in my previous comment)
use git diff HEAD~2 HEAD to display the final branch status +11 -3 (labeled new in my previous comment)
use git diff HEAD~1 HEAD to display only the last commit where I revert changes made in 1

On the next rebase, I will squash those 2 commit into 1 so the revert part will not be present in git history

Alternatively in the commit tab you can see the two specific commit

TheZ3ro · 2018-07-03T20:29:20Z

Can someone review this? @keepassxreboot/core-developers

droidmonkey

One comment, not major

droidmonkey · 2018-07-08T13:31:13Z

src/gui/Clipboard.cpp

-    clipboard->setText(text, QClipboard::Clipboard);
+    const QString secretStr = "secret";
+    QByteArray secretBa = secretStr.toUtf8();
+    mime->setText(text);


Can we move this line and line 53 above the #ifdef, they are the same regardless of OSX or not

phoerious · 2018-07-29T14:25:47Z

I know how to operate Git. ;-)
I'm a bit confused why GitHub is only showing a tiny part of the actual DIff when I click on "Files changed". I'm not quite sure what will happen when I click the merge button.

TheZ3ro · 2018-07-30T08:09:03Z

@phoerious What?

I've deleted the older branch, created a new one with the same name, added the new changes, did a rebase excluding the old commits and force-push.
This is a normal thing in a git environment and it has been done many times before on this repo, nothing strange.

It's useless to keep in a branch waiting for a merge old changes that are being reverted the next commit.
It only use extra repository space in the commit history and in git objects.

So, what are you talking about?

Checkout the branch with your git client, what you see is what gets merged.

shantanugoel · 2018-08-28T13:18:41Z

Is there any more work to be done on this PR before this can be merged? Looks like @droidmonkey approved the changes and the change requested by @phoerious is not applicable any more?

@TheZ3ro

Changes were made my @TheZ3ro

droidmonkey · 2018-08-28T14:27:10Z

It looks complete to me, I need to test it using klipper before I merge unless someone can get certainty that it works.

shantanugoel · 2018-08-29T14:51:48Z

Thanks @droidmonkey. I built the develop branch just now along with this pull request and tested on ArchLinux. I can confirm that klipper now ignores the password copied from keepassxc.

- New Database Wizard [#1952] - Advanced Search [#1797] - Automatic update checker [#2648] - KeeShare database synchronization [#2109, #1992, #2738, #2742, #2746, #2739] - Improve favicon fetching; transition to Duck-Duck-Go [#2795, #2011, #2439] - Remove KeePassHttp support [#1752] - CLI: output info to stderr for easier scripting [#2558] - CLI: Add --quiet option [#2507] - CLI: Add create command [#2540] - CLI: Add recursive listing of entries [#2345] - CLI: Fix stdin/stdout encoding on Windows [#2425] - SSH Agent: Support OpenSSH for Windows [#1994] - macOS: TouchID Quick Unlock [#1851] - macOS: Multiple improvements; include CLI in DMG [#2165, #2331, #2583] - Linux: Prevent Klipper from storing secrets in clipboard [#1969] - Linux: Use polling based file watching for NFS [#2171] - Linux: Enable use of browser plugin in Snap build [#2802] - TOTP QR Code Generator [#1167] - High-DPI Scaling for 4k screens [#2404] - Make keyboard shortcuts more consistent [#2431] - Warn user if deleting referenced entries [#1744] - Allow toolbar to be hidden and repositioned [#1819, #2357] - Increase max allowed database timeout to 12 hours [#2173] - Password generator uses existing password length by default [#2318] - Improve alert message box button labels [#2376] - Show message when a database merge makes no changes [#2551] - Browser Integration Enhancements [#1497, #2253, #1904, #2232, #1850, #2218, #2391, #2396, #2542, #2622, #2637, #2790] - Overall Code Improvements [#2316, #2284, #2351, #2402, #2410, #2419, #2422, #2443, #2491, #2506, #2610, #2667, #2709, #2731]

sts10 · 2019-03-21T00:23:35Z

Is there any chance that this fix doesn't work for Snap installations?

I ask because, unfortunately, running 2.4.0 installed as a Snap on Kubuntu 18.04, my passwords remain in my clipboard indefinitely (rather than 10 seconds, as expected).

I'm more than happy to file a fresh issue for this, but just wanted to check if (a) there was something I had to do in KDE preferences to allow KPXC to clear the clipboard or (b) this wasn't tested on a Snap install and that could be the issue.

Debug info

KeePassXC - Version 2.4.0
Revision: c51752d
Distribution: Snap

Libraries:

Qt 5.9.5
libgcrypt 1.8.1

Operating system: Ubuntu Core 18
CPU architecture: x86_64
Kernel: linux 4.18.0-16-generic

Enabled extensions:

Auto-Type
Browser Integration
SSH Agent
KeeShare (signed and unsigned sharing)
YubiKey

shantanugoel · 2019-03-22T06:59:27Z

@sts10 At least I tested it on a regular install only, not on snap. And it's working with the official 2.4.0 release as well. Are you sure you have the right version of klipper installed that has the counterpart patch to look at the metadata sent by keepassxc and ignore it? That patch (https://phabricator.kde.org/D12539) was merged only around May last year but you seem to be on Kubuntu 18.04, so there's a high chance that it's not present in your OS.

kozaq · 2019-04-14T21:17:20Z

Hi, tested KeePassXC 2.4.0 and 2.4.1 on Kubuntu 18.04.2 LTS with password set to be cleared from clipboard after 10 seconds. Sadly this does not work. What I see is the lack of Klipper - instead there is Plasma's own clipboard app.

OS:
NAME="Ubuntu"
VERSION="18.04.2 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.2 LTS"
VERSION_ID="18.04"

Kernel release:
4.15.0-47-generic

**Plasma version: **
5.12.7

Is there a chance that Plasma's clipboard will be supported?

droidmonkey · 2019-04-14T21:31:50Z

Open a new issue if you want to see that support.

roberthoffmann · 2019-04-15T21:00:14Z

From plasma-workspace 5.12.8 the "x-kde-passwordManagerHint" is supported, so in Ubuntu Cosmic (which has 5.13.5) it should work.

TheZ3ro added the new feature label May 16, 2018

TheZ3ro added this to the v2.4.0 milestone May 16, 2018

TheZ3ro requested a review from a team May 16, 2018 13:17

phoerious previously requested changes May 17, 2018

View reviewed changes

TheZ3ro force-pushed the feature/klipper-password branch from c38d533 to a4f7923 Compare May 29, 2018 20:56

droidmonkey approved these changes Jul 8, 2018

View reviewed changes

TheZ3ro added 2 commits August 29, 2018 11:05

prevent klipper from storing password in clipboard history

58acaa4

all fields are protected

2992e10

droidmonkey force-pushed the feature/klipper-password branch from a4f7923 to 2992e10 Compare August 29, 2018 15:06

droidmonkey merged commit 08a36b4 into develop Aug 29, 2018

droidmonkey deleted the feature/klipper-password branch August 29, 2018 15:13

douglasg14b mentioned this pull request Mar 8, 2019

Clipboard manager interaction #478

Closed

aardbol mentioned this pull request Dec 1, 2020

Password leak to clipboard manager in KDE Plasma Nitrokey/nitrokey-app#457

Open

yelworc mentioned this pull request Jan 29, 2022

KeepassXC clear clipboard Keruspe/GPaste#199

Open

JoseBritto mentioned this pull request Sep 6, 2022

Feature: Exclude apps and exclude password managers by default oae/gnome-shell-pano#41

Closed

zefr0x mentioned this pull request Oct 17, 2022

A method to specify that a sensitive entry should not go to the history xrelkd/clipcat#31

Closed

enbrnz mentioned this pull request Jun 28, 2023

[Feature Request] Support for x-kde-passwordManagerHint mime type gopasspw/gopass#2611

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Prevent Klipper from storing secrets in clipboard history #1969

Prevent Klipper from storing secrets in clipboard history #1969

TheZ3ro commented May 16, 2018 •

edited

Loading

phoerious May 17, 2018

TheZ3ro May 17, 2018

phoerious May 17, 2018

TheZ3ro May 17, 2018 •

edited

Loading

Germano0 May 22, 2018

phoerious commented Jun 8, 2018

TheZ3ro commented Jun 11, 2018

phoerious commented Jun 11, 2018

TheZ3ro commented Jun 11, 2018

TheZ3ro commented Jul 3, 2018

droidmonkey left a comment

droidmonkey Jul 8, 2018

phoerious commented Jul 29, 2018

TheZ3ro commented Jul 30, 2018

shantanugoel commented Aug 28, 2018

droidmonkey commented Aug 28, 2018

shantanugoel commented Aug 29, 2018

sts10 commented Mar 21, 2019 •

edited

Loading

shantanugoel commented Mar 22, 2019

kozaq commented Apr 14, 2019

droidmonkey commented Apr 14, 2019

roberthoffmann commented Apr 15, 2019

Prevent Klipper from storing secrets in clipboard history #1969

Prevent Klipper from storing secrets in clipboard history #1969

Conversation

TheZ3ro commented May 16, 2018 • edited Loading

Description

Motivation and context

How has this been tested?

Types of changes

Checklist:

phoerious May 17, 2018

Choose a reason for hiding this comment

TheZ3ro May 17, 2018

Choose a reason for hiding this comment

phoerious May 17, 2018

Choose a reason for hiding this comment

TheZ3ro May 17, 2018 • edited Loading

Choose a reason for hiding this comment

Germano0 May 22, 2018

Choose a reason for hiding this comment

phoerious commented Jun 8, 2018

TheZ3ro commented Jun 11, 2018

phoerious commented Jun 11, 2018

TheZ3ro commented Jun 11, 2018

TheZ3ro commented Jul 3, 2018

droidmonkey left a comment

Choose a reason for hiding this comment

droidmonkey Jul 8, 2018

Choose a reason for hiding this comment

phoerious commented Jul 29, 2018

TheZ3ro commented Jul 30, 2018

shantanugoel commented Aug 28, 2018

droidmonkey commented Aug 28, 2018

shantanugoel commented Aug 29, 2018

sts10 commented Mar 21, 2019 • edited Loading

Debug info

shantanugoel commented Mar 22, 2019

kozaq commented Apr 14, 2019

droidmonkey commented Apr 14, 2019

roberthoffmann commented Apr 15, 2019

TheZ3ro commented May 16, 2018 •

edited

Loading

TheZ3ro May 17, 2018 •

edited

Loading

sts10 commented Mar 21, 2019 •

edited

Loading