From 653cca7419afbd7aabf5e830fe6f19a7a1e16619 Mon Sep 17 00:00:00 2001
From: varjolintu <sami.vanttinen@protonmail.com>
Date: Thu, 13 Oct 2022 20:23:38 +0300
Subject: [PATCH] First draft

---
 keepassxc-browser/background/event.js         |  4 +-
 keepassxc-browser/background/keepass.js       | 38 ++++++++++++++++++-
 .../content/keepassxc-browser.js              |  7 +++-
 keepassxc-browser/content/webauthn.js         | 23 ++++++++---
 4 files changed, 62 insertions(+), 10 deletions(-)

diff --git a/keepassxc-browser/background/event.js b/keepassxc-browser/background/event.js
index fff06a3..ea77ec0 100755
--- a/keepassxc-browser/background/event.js
+++ b/keepassxc-browser/background/event.js
@@ -247,5 +247,7 @@ kpxcEvent.messageHandlers = {
     'username_field_detected': kpxcEvent.onUsernameFieldDetected,
     'save_settings': kpxcEvent.onSaveSettings,
     'update_available_keepassxc': kpxcEvent.onUpdateAvailableKeePassXC,
-    'update_context_menu': page.updateContextMenu
+    'update_context_menu': page.updateContextMenu,
+    'webauthn-get': keepass.webauthnGet,
+    'webauthn-register': keepass.webauthnRegister
 };
diff --git a/keepassxc-browser/background/keepass.js b/keepassxc-browser/background/keepass.js
index 72541ed..1fbe5e4 100755
--- a/keepassxc-browser/background/keepass.js
+++ b/keepassxc-browser/background/keepass.js
@@ -33,7 +33,9 @@ const kpActions = {
     GET_DATABASE_GROUPS: 'get-database-groups',
     CREATE_NEW_GROUP: 'create-new-group',
     GET_TOTP: 'get-totp',
-    REQUEST_AUTOTYPE: 'request-autotype'
+    REQUEST_AUTOTYPE: 'request-autotype',
+    WEBAUTHN_REGISTER: 'webauthn-register',
+    WEBAUTHN_GET: 'webauthn-get'
 };
 
 browser.storage.local.get({ 'latestKeePassXC': { 'version': '', 'lastChecked': null }, 'keyRing': {} }).then((item) => {
@@ -622,6 +624,40 @@ keepass.requestAutotype = async function(tab, args = []) {
     }
 };
 
+keepass.webauthnRegister = async function(tab, publicKey) {
+    try {
+        const taResponse = await keepass.testAssociation(tab, [ false ]);
+        if (!taResponse || !keepass.isConnected) {
+            browserAction.showDefault(tab);
+            return [];
+        }
+
+        const kpAction = kpActions.WEBAUTHN_REGISTER;
+        const nonce = keepassClient.getNonce();
+
+        const messageData = {
+            action: kpAction,
+            publicKey: JSON.parse(JSON.stringify(publicKey))
+        };
+
+        const response = await keepassClient.sendMessage(kpAction, tab, messageData, nonce);
+        if (response) {
+
+            return [];
+        }
+
+        browserAction.showDefault(tab);
+        return [];
+    } catch (err) {
+        logError(`webauthnRegister failed: ${err}`);
+        return [];
+    }
+};
+
+keepass.webauthnGet = async function(tab) {
+    return [];
+};
+
 //--------------------------------------------------------------------------
 // Keyring
 //--------------------------------------------------------------------------
diff --git a/keepassxc-browser/content/keepassxc-browser.js b/keepassxc-browser/content/keepassxc-browser.js
index d093261..f21e535 100755
--- a/keepassxc-browser/content/keepassxc-browser.js
+++ b/keepassxc-browser/content/keepassxc-browser.js
@@ -852,9 +852,12 @@ document.documentElement.appendChild(webauthn);
 window.addEventListener('message', (ev) => {
     if (ev.data.action === 'webauthn-create') {
         console.log('Request from: ', ev.origin);
+        console.log(ev.data.publicKey);
 
-        // Send a test response after a delay
-        setInterval(() => {
+        sendMessage('webauthn-register', ev.data.publicKey);
+
+        // Send a test response after a delay. webauthn.js should wait for this.
+        setTimeout(() => {
             window.postMessage({ action: 'webauthn-create-response' }, window.location.origin);
         }, 2000);
     }
diff --git a/keepassxc-browser/content/webauthn.js b/keepassxc-browser/content/webauthn.js
index ea68b8a..ffda0ec 100644
--- a/keepassxc-browser/content/webauthn.js
+++ b/keepassxc-browser/content/webauthn.js
@@ -1,15 +1,26 @@
 'use strict';
 
 (async () => {
-
-
     const webauthnCredentials = {
         async create(options) {
-           console.log('Overridden create');
+            console.log('Overridden create');
 
-           //await browser.runtime.sendMessage({ action: 'request_autotype', args: [ window.location.hostname ] });
-           window.postMessage({ action: 'webauthn-create' }, window.location.origin);
-           await waitForCreateResponse();
+            const publicKey = {};
+            publicKey.attestation = options.publicKey.attestation;
+            publicKey.authenticatorSelection = options.publicKey.authenticatorSelection;
+            publicKey.challenge = new Uint8Array(options.publicKey.challenge).toString();
+            publicKey.pubKeyCredParams = options.publicKey.pubKeyCredParams;
+            publicKey.rp = options.publicKey.rp;
+            publicKey.timeout = options.publicKey.timeout;
+            publicKey.user = options.publicKey.user;
+            publicKey.user.id = options.publicKey.user.id.toString();
+
+            /*const credential = await navigator.credentials.create({
+                publicKey: publicKey
+            });*/
+
+            window.postMessage({ action: 'webauthn-create', publicKey: publicKey }, window.location.origin);
+            //await waitForCreateResponse();
         },
         async get(options) {
             console.log('Overridden get');