Store SQLCipher decryption key in separate file

First, we write the key a whole lot less. We write it on creation, then
never again.

Second, it's in a file we control very closely. Instead of blindly
regenerating the key if the target file generates an error on read,
we block startup unless the error is 'ENOENT' - the file isn't there
at all.

This still allows for the key.txt file to be deleted or corrupted
somehow, but it should be a lot less common than the high-traffic
config.json used for window location and media permissions.
This commit is contained in:
Scott Nonnenberg 2018-08-16 10:07:38 -07:00
parent 006700f9a2
commit 496ebf2a47
3 changed files with 93 additions and 39 deletions

View file

@ -1,5 +1,6 @@
const electron = require('electron');
const sql = require('./sql');
const { remove } = require('./key_management');
const { ipcMain } = electron;
@ -12,16 +13,12 @@ let initialized = false;
const SQL_CHANNEL_KEY = 'sql-channel';
const ERASE_SQL_KEY = 'erase-sql-key';
function initialize({ userConfig }) {
function initialize() {
if (initialized) {
throw new Error('sqlChannels: already initialized!');
}
initialized = true;
if (!userConfig) {
throw new Error('initialize: userConfig is required!');
}
ipcMain.on(SQL_CHANNEL_KEY, async (event, jobId, callName, ...args) => {
try {
const fn = sql[callName];
@ -44,7 +41,7 @@ function initialize({ userConfig }) {
ipcMain.on(ERASE_SQL_KEY, async event => {
try {
userConfig.set('key', null);
remove();
event.sender.send(`${ERASE_SQL_KEY}-done`);
} catch (error) {
const errorForDisplay = error && error.stack ? error.stack : error;