wallet-http: validate timeouts and make default explicit.

Author: nodech

lib/wallet/http.js

@@ -414,9 +414,11 @@ class HTTP extends Server {
     this.post('/wallet/:id/unlock', async (req, res) => {
       const valid = Validator.fromRequest(req);
       const passphrase = valid.str('passphrase');
-      const timeout = valid.u32('timeout');
+      const timeout = valid.u32('timeout', 60);
 
       enforce(passphrase, 'Passphrase is required.');
+      // setTimeout maximum is 24.85 days, we round to 24 days.
+      enforce(timeout <= 2073600, 'Timeout must be less than 24 days.');
 
       await req.wallet.unlock(passphrase, timeout);
 

lib/wallet/masterkey.js

@@ -135,8 +135,8 @@ class MasterKey extends bio.Struct {
   /**
    * Decrypt the key and set a timeout to destroy decrypted data.
    * @param {Buffer|String} passphrase - Zero this yourself.
-   * @param {Number} [timeout=60000] timeout in ms.
-   * @returns {Promise} - Returns {@link HDPrivateKey}.
+   * @param {Number} [timeout=60] timeout in seconds.
+   * @returns {Promise<HDPrivateKey>}
    */
 
   async unlock(passphrase, timeout) {
@@ -152,8 +152,8 @@ class MasterKey extends bio.Struct {
    * Decrypt the key without a lock.
    * @private
    * @param {Buffer|String} passphrase - Zero this yourself.
-   * @param {Number} [timeout=60000] timeout in ms.
-   * @returns {Promise} - Returns {@link HDPrivateKey}.
+   * @param {Number} [timeout=60] timeout in seconds.
+   * @returns {Promise<HDPrivateKey>}
    */
 
   async _unlock(passphrase, timeout) {
@@ -219,7 +219,7 @@ class MasterKey extends bio.Struct {
   /**
    * Derive an aes key based on params.
    * @param {String|Buffer} passwd
-   * @returns {Promise}
+   * @returns {Promise<Buffer>}
    */
 
   async derive(passwd) {
@@ -324,7 +324,7 @@ class MasterKey extends bio.Struct {
    * Decrypt the key permanently.
    * @param {Buffer|String} passphrase - Zero this yourself.
    * @param {Boolean} [clean=false]
-   * @returns {Promise}
+   * @returns {Promise<Buffer|null>}
    */
 
   async decrypt(passphrase, clean) {
@@ -341,7 +341,7 @@ class MasterKey extends bio.Struct {
    * @private
    * @param {Buffer|String} passphrase - Zero this yourself.
    * @param {Boolean} [clean=false]
-   * @returns {Promise}
+   * @returns {Promise<Buffer|null>}
    */
 
   async _decrypt(passphrase, clean) {
@@ -373,7 +373,7 @@ class MasterKey extends bio.Struct {
    * Encrypt the key permanently.
    * @param {Buffer|String} passphrase - Zero this yourself.
    * @param {Boolean} [clean=false]
-   * @returns {Promise}
+   * @returns {Promise<Buffer|null>}
    */
 
   async encrypt(passphrase, clean) {
@@ -390,7 +390,7 @@ class MasterKey extends bio.Struct {
    * @private
    * @param {Buffer|String} passphrase - Zero this yourself.
    * @param {Boolean} [clean=false]
-   * @returns {Promise}
+   * @returns {Promise<Buffer|null>}
    */
 
   async _encrypt(passphrase, clean) {

test/wallet-http-test.js

@@ -14,6 +14,7 @@ const secp256k1 = require('bcrypto/lib/secp256k1');
 const network = Network.get('regtest');
 const assert = require('bsert');
 const {BufferSet} = require('buffer-map');
+const util = require('../lib/utils/util');
 const common = require('./util/common');
 const Outpoint = require('../lib/primitives/outpoint');
 const consensus = require('../lib/protocol/consensus');
@@ -96,6 +97,92 @@ describe('Wallet HTTP', function() {
     });
   });
 
+  describe('Unlock wallet', function() {
+    const WNAME = 'lockedWallet';
+    const PASSPHRASE = 'test1234';
+    let walletClient, wallet;
+
+    before(async () => {
+      await beforeAll();
+
+      await wclient.createWallet(WNAME, {
+        passphrase: PASSPHRASE
+      });
+
+      walletClient = wclient.wallet(WNAME);
+      wallet = await nodeCtx.wdb.get(WNAME);
+
+      await wallet.lock();
+    });
+
+    after(afterAll);
+
+    afterEach(async () => {
+      await walletClient.lock();
+    });
+
+    it('unlock wallet', async () => {
+      assert.strictEqual(wallet.master.encrypted, true);
+      await walletClient.unlock(PASSPHRASE, 1);
+      const until = util.now() + 1;
+
+      assert(wallet.master.until <= until);
+      assert(wallet.master.key);
+
+      await sleep(1000);
+      assert(!wallet.master.key);
+    });
+
+    it('should fail to unlock with wrong passphrase', async () => {
+      let err;
+      try {
+        await walletClient.unlock('wrong', 100);
+      } catch (e) {
+        err = e;
+      }
+
+      assert(err);
+      assert.strictEqual(err.message, 'Could not decrypt.');
+    });
+
+    it('should unlock for an hour', async () => {
+      // Unlock for an hour
+      await walletClient.unlock(PASSPHRASE, 3600);
+      const until = util.now() + 3600;
+
+      assert(wallet.master.until <= until);
+      assert(wallet.master.key);
+    });
+
+    it('should unlock for max duration', async () => {
+      const MAX = 2073600;
+      await walletClient.unlock(PASSPHRASE, MAX);
+    });
+
+    it('should fail unlock for invalid durations', async () => {
+      const MAX = 2073600;
+      const invalid = [
+        ['text', 'timeout must be a int.'],
+        [-1, 'timeout must be a uint.'],
+        [-100, 'timeout must be a uint.'],
+        [MAX + 1, 'Timeout must be less than 24 days.']
+      ];
+
+      for (const [duration, message] of invalid) {
+        let err;
+
+        try {
+          await walletClient.unlock(PASSPHRASE, duration);
+        } catch (e) {
+          err = e;
+        }
+
+        assert(err, `Expected error for duration: ${duration}`);
+        assert.strictEqual(err.message, message);
+      }
+    });
+  });
+
   describe('Lookahead', function() {
     before(beforeAll);
     after(afterAll);