From b680336ba464eafe63daafd95002f09e798c09d9 Mon Sep 17 00:00:00 2001 From: Peter Harpending Date: Wed, 26 Jul 2023 17:20:12 -0600 Subject: [PATCH] all this time i thought that it was the browser that was mentally disabled it turned out the mental disability was inside me all along MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ====================== NACL mental disability ====================== NACL is mentally disabled and can't be loaded as an ES6 module. That is, it can't be "imported" using ```js import * as nacl from './path/to/nacl.js'; ``` Instead you have to include it in a page. So we have a page called `background.html`. I naively tried this ```html ``` That of course didn't work because we live in hell. I initially thought the problem was an invalid hash. No. Notes as I figure it out: Trying to figure out why TweetNaCl isn't loading ok so the problem is not an invalid hash, it's something specific to nacl to have an inline script, its hash must be specified in manifest.json example (integrity key is not necessary, it is there purely for comment purposes) beginning of line V | newline is there for hash purposes this works if and only if 'sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw=' is included in the manifest.json example (top level key): "content_security_policy" : "script-src 'self' 'sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw='; object-src 'self'", Absent that explicit allow, I get this error from Firefox: Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”). Refs: 1. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy 2. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_Security_Policy#inline_javascript If I include the same script as a file, this works irrespective of if I specify it as allowable in the manifest nacl is just refusing to load Loading failed for the I think it works if I do it in the popup window instead. Let's try oh no no oh my god i am so stupid the problem was that i typed the url wrong the package is "tweetnacl" not "nacl", and i also need /dist/ too that works all this time i thought that it was the browser that was mentally disabled it turned out the mental disability was inside me all along alright well I discovered a potential future pitfall at least --- jrx/background.html | 81 +++++++++++++++++++++++++++-- jrx/bg-test-inline.js | 1 + jrx/manifest.json | 27 +++++----- jrx/popup.html | 3 -- jrx/src/background.ts | 7 ++- jrx/src/content.ts | 7 ++- jrx/src/popup.ts | 2 + mental_disability_notes.md | 98 +++++++++++++++++++++++++++++++++++ utils/b64sha256/b64sha256.erl | 49 ++++++++++++++++++ utils/b64sha256/b64sha384.erl | 49 ++++++++++++++++++ 10 files changed, 302 insertions(+), 22 deletions(-) create mode 100644 jrx/bg-test-inline.js create mode 100644 mental_disability_notes.md create mode 100755 utils/b64sha256/b64sha256.erl create mode 100755 utils/b64sha256/b64sha384.erl diff --git a/jrx/background.html b/jrx/background.html index 975deac..679645f 100644 --- a/jrx/background.html +++ b/jrx/background.html @@ -5,8 +5,83 @@ - - - + + + + + + diff --git a/jrx/bg-test-inline.js b/jrx/bg-test-inline.js new file mode 100644 index 0000000..5ffe6c8 --- /dev/null +++ b/jrx/bg-test-inline.js @@ -0,0 +1 @@ +console.log('bg-test-inline.js line 1!'); diff --git a/jrx/manifest.json b/jrx/manifest.json index 8f52f0b..3dac558 100644 --- a/jrx/manifest.json +++ b/jrx/manifest.json @@ -1,13 +1,14 @@ -{"manifest_version" : 2, - "name" : "Jack Russell", - "version" : "0.1.0", - "description" : "Browser wallet extension for Aeternity", - "icons" : {"48" : "art/jrx-icon-48.png", - "96" : "art/jrx-icon-96.png"}, - "content_scripts" : [{"matches" : ["*://*/*"], - "js" : ["dist/content.js"]}], - "browser_action" : {"default_icon" : "art/jrx-icon-32.png", - "default_title" : "Jæck Russell", - "default_popup" : "popup.html"}, - "background" : {"page" : "background.html"}, - "permissions" : ["storage"]} +{"manifest_version" : 2, + "name" : "Jack Russell", + "version" : "0.1.0", + "description" : "Browser wallet extension for Aeternity", + "icons" : {"48" : "art/jrx-icon-48.png", + "96" : "art/jrx-icon-96.png"}, + "content_scripts" : [{"matches" : ["*://*/*"], + "js" : ["dist/content.js"]}], + "browser_action" : {"default_icon" : "art/jrx-icon-32.png", + "default_title" : "Jæck Russell", + "default_popup" : "popup.html"}, + "background" : {"page" : "background.html"}, + "content_security_policy" : "script-src 'self'; object-src 'self'", + "permissions" : ["storage"]} diff --git a/jrx/popup.html b/jrx/popup.html index ca0f9e0..07dccb1 100644 --- a/jrx/popup.html +++ b/jrx/popup.html @@ -43,9 +43,6 @@ - - - diff --git a/jrx/src/background.ts b/jrx/src/background.ts index 81ee05c..aa6877a 100644 --- a/jrx/src/background.ts +++ b/jrx/src/background.ts @@ -103,11 +103,16 @@ jr_bg_main () : Promise { - console.log('hi'); + console.log('jr_bg_main line 106 hello'); // handle messages from content script browser.runtime.onMessage.addListener(bg_a2w_handler); + // TODO: ok so next step is to have startup hook + // try to fetch keys from storage + // if no key, generate one + let keypair = nacl.sign.keyPair(); + console.log('jr_bg_main 112 keypair', keypair); } diff --git a/jrx/src/content.ts b/jrx/src/content.ts index fdf497b..d52d1b4 100644 --- a/jrx/src/content.ts +++ b/jrx/src/content.ts @@ -23,7 +23,7 @@ let detect_msg = {type : "to_aepp", type : "extension"}}}; /** - * Spam detect message + * Spam the "connection.announcePresence" (awcp terminology: "detect") message */ async function spam_detect @@ -68,13 +68,16 @@ a2w_handler } // branch + // all messages are visible to us + // if the message is for the wallet + // send it to the wallet + // otherwise ignore it if ("to_waellet" === msg.data.type) { console.error('JR: WAEEEEEEE'); browser.runtime.sendMessage(msg.data).then( onSuccessCase, onErrorCase ); - //console.error('BOOBS', response); //window.postMessage(response); } // otherwise ignore diff --git a/jrx/src/popup.ts b/jrx/src/popup.ts index 9643e85..da3085b 100644 --- a/jrx/src/popup.ts +++ b/jrx/src/popup.ts @@ -12,5 +12,7 @@ main () : Promise { + let scratch = document.getElementById('scratch')!; + scratch.innerText += 'line 17 hello\n'; } diff --git a/mental_disability_notes.md b/mental_disability_notes.md new file mode 100644 index 0000000..12add81 --- /dev/null +++ b/mental_disability_notes.md @@ -0,0 +1,98 @@ +# NACL mental disability + +NACL is mentally disabled and can't be loaded as an ES6 module. That is, it can't be +"imported" using + +```js +import * as nacl from './path/to/nacl.js'; +``` + +Instead you have to include it in a page. So we have a page called +`background.html`. + +I naively tried this + +```html + +``` + +That of course didn't work because we live in hell. + +I initially thought the problem was an invalid hash. No. Notes as I figure it +out: + + + Trying to figure out why TweetNaCl isn't loading + + ok so the problem is not an invalid hash, it's something specific + to nacl + + to have an inline script, its hash must be specified in + manifest.json + + example (integrity key is not necessary, it is there purely for + comment purposes) + + beginning of line + V + | + + newline is there for hash purposes + + this works if and only if + 'sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw=' is included + in the manifest.json + + example (top level key): + + "content_security_policy" : "script-src 'self' 'sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw='; object-src 'self'", + + Absent that explicit allow, I get this error from Firefox: + + Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”). + + Refs: + 1. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy + 2. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_Security_Policy#inline_javascript + + If I include the same script as a file, + + + + this works irrespective of if I specify it as allowable in the manifest + + nacl is just refusing to load + + Loading failed for the + +I think it works if I do it in the popup window instead. Let's try + +oh no + +no + +oh my god + +i am so stupid + +the problem was that i typed the url wrong + +all this time i thought that it was the browser that was mentally disabled + +it turned out the mental disability was inside me all along + +alright well I discovered a potential future pitfall at least diff --git a/utils/b64sha256/b64sha256.erl b/utils/b64sha256/b64sha256.erl new file mode 100755 index 0000000..8d5aaee --- /dev/null +++ b/utils/b64sha256/b64sha256.erl @@ -0,0 +1,49 @@ +#!/usr/bin/env escript + +%% This is a script to print out the base64 representation of a sha256 hash of +%% input bytes. This exists because browser extensions are stupid. In order to +%% load a script into a page context it needs the sha256 hash encoded in base64 +%% of the script. This script exists to just print that easily + +-mode(compile). + +%% either read from file or read stdin +main(["-e", FileName]) -> + {ok, Bytes} = file:read_file(FileName), + main_bytes(ext, Bytes); +main([FileName]) -> + {ok, Bytes} = file:read_file(FileName), + main_bytes(normal, Bytes); +main(["-e"]) -> + main_bytes(ext, read_stdin()); +main([]) -> + main_bytes(normal, read_stdin()). + + +%% take sha256 of bytes and print in base64 +%% print in manifest extension format +main_bytes(ext, Bytes) -> + Printing = main_bytes(Bytes), + io:format("'sha256-~ts'", [Printing]); +main_bytes(normal, Bytes) -> + Printing = main_bytes(Bytes), + io:format("~ts~n", [Printing]). + +main_bytes(Bytes) -> + Sha256 = crypto:hash(sha256, Bytes), + base64:encode(Sha256). + + +read_stdin() -> + read_stdin(<<>>). + +read_stdin(Acc) -> + ThisChar = io:get_chars(standard_io, "", 1), + case ThisChar of + eof -> + unicode:characters_to_binary(Acc); + {error, Reason} -> + error(Reason); + Char -> + read_stdin([Acc, Char]) + end. diff --git a/utils/b64sha256/b64sha384.erl b/utils/b64sha256/b64sha384.erl new file mode 100755 index 0000000..c0604a1 --- /dev/null +++ b/utils/b64sha256/b64sha384.erl @@ -0,0 +1,49 @@ +#!/usr/bin/env escript + +%% This is a script to print out the base64 representation of a sha384 hash of +%% input bytes. This exists because browser extensions are stupid. In order to +%% load a script into a page context it needs the sha384 hash encoded in base64 +%% of the script. This script exists to just print that easily + +-mode(compile). + +%% either read from file or read stdin +main(["-e", FileName]) -> + {ok, Bytes} = file:read_file(FileName), + main_bytes(ext, Bytes); +main([FileName]) -> + {ok, Bytes} = file:read_file(FileName), + main_bytes(normal, Bytes); +main(["-e"]) -> + main_bytes(ext, read_stdin()); +main([]) -> + main_bytes(normal, read_stdin()). + + +%% take sha384 of bytes and print in base64 +%% print in manifest extension format +main_bytes(ext, Bytes) -> + Printing = main_bytes(Bytes), + io:format("'sha384-~ts'", [Printing]); +main_bytes(normal, Bytes) -> + Printing = main_bytes(Bytes), + io:format("~ts~n", [Printing]). + +main_bytes(Bytes) -> + Sha384 = crypto:hash(sha384, Bytes), + base64:encode(Sha384). + + +read_stdin() -> + read_stdin(<<>>). + +read_stdin(Acc) -> + ThisChar = io:get_chars(standard_io, "", 1), + case ThisChar of + eof -> + unicode:characters_to_binary(Acc); + {error, Reason} -> + error(Reason); + Char -> + read_stdin([Acc, Char]) + end.