Repository navigation
Harden token storage, login WebView, and update trust boundaries - #31
Merged
Merged
Conversation
Store the Discord token as an AES-256-GCM blob under an Android Keystore key, migrate the legacy plaintext preference, and delete the key whenever the credential is cleared so an escaped blob cannot be reopened. Read the token on demand instead of caching plaintext. Redact authorization headers, cookies, token-shaped strings, signed URLs, and credential fields from logs and crash reports. Clear WebView storage and the sealed token before a sign-out wipe, and stop boot-start failures from logging raw exception text. Add instrumentation coverage for migration, isolated test storage, key deletion, corrupted blobs, and legacy cleanup.
Load and navigate only canonical https://discord.com origins, and extract the token only from /app. Read storage through a same-origin iframe because Discord removes the storage API from the top window, then remove the iframe in the same turn. Tear the login WebView down in an order that cannot leave a live document behind: stop loading, replace it with about:blank, wait for the commit, clear storage, and only then flush cookies. Fail closed and destroy the view if the blank page never commits. Validate pasted token shape before the handshake, reject failed handshakes instead of crashing, and keep the manual-token and repaint fallbacks for WebViews that cannot render the login page. Add JVM coverage for origin matching, token shape, and cleanup ordering/timeout.
Accept only Discord gateway hosts for resume endpoints and re-append the gateway protocol query, since the endpoint arrives over the gateway itself. Read the token through a provider so the engine does not retain a plaintext copy, clear the credential on terminal auth rejection or an unreadable blob, and drop it on an unauthorized API response. Require update releases from the project's GitHub feed, validate the asset URL at parse and download time, cap the transfer size, verify the published SHA-256 digest, and check the archive package id and signing certificate against the installed app before invoking the installer. Disable cleartext traffic, drop the privileged media permission, and stop exporting the boot receiver. Add JVM tests for gateway endpoints and update URL/digest policy, plus instrumentation fixtures for foreign, multi-signer, and unsigned update APKs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens the Discord token lifecycle and the trust boundaries that can expose or misuse it. This is a security-hardening change, not a vulnerability disclosure.
1. Seal the token with Android Keystore and redact credentials
Authorization,Cookie,Set-Cookie, token-shaped strings, signed URL parameters, and credential fields from logs and crash reports.2. Constrain the Discord login WebView to its trust boundary
/approute.localStorageto the top window), rejects malformed tokens, and fails closed on capture timeout.3. Validate gateway resume URLs and update artifacts
wssscheme, adds the protocol query, rejects user info/ports/queries/fragments, and resolves the token through a provider so it is not captured in a closure.sha256:digest, and size cap before download.MEDIA_CONTENT_CONTROLprivileged permission.Testing
Per commit:
./gradlew :app:testDebugUnitTest :app:assembleDebug :app:assembleDebugAndroidTestFinal branch:
./gradlew :app:lintDebug— passed../gradlew :app:assembleRelease— passed../gradlew :app:connectedDebugAndroidTest— Gradle's task hung on this device's package-installer confirmation UI. The same debug and test APKs were installed manually and run directly witham instrument; all 13 instrumentation tests passed (TokenStorageTest,UpdateIdentityTest).UpdatePolicyaccepts the current upstreamv1.5.4release asset and its published SHA-256 digest.Scope
UpdatePolicycontinues to usespacealtctrl/DiscordRPreleases; this branch does not point updates at a fork.