Zaki/Password-Manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

UI improvements: fix keyboard shortcuts, search highlighting, strength meter on register, colored folders, shortcut help

Browse Source 
- Rewrite keyboard shortcuts using e.code and early preventDefault() to reliably override browser defaults
- Add ? key and toolbar button for shortcuts help modal
- Add password strength meter to register form
- Add search highlighting in all view modes (grid/list/compact/table)
- Add hash-based color coding for folder chips
- Add highlightText utility with regex escaping
This commit is contained in:
Zaki
2026-05-08 23:35:59 +01:00
parent c8c7b69ae0
commit c6504f70d1
4 changed files with 84 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security-issues.md
+8
View File
@@ -0,0 +1,8 @@
# Remaining Security Issues
1. **No rate limiting on `/reauth`** — brute-force possible via export dialog
2. **No Content Security Policy (CSP)** header — XSS could leak crypto key from sessionStorage
3. **Crypto key in sessionStorage (extractable)** — necessary for refresh persistence, but XSS can steal it. HttpOnly cookie + service worker is more secure but complex
4. **No session rotation** — same token until logout; if leaked, valid for 24h
5. **No 2FA** — opted out of TOTP implementation
6. **Password generator modulo bias** — `c.charAt(arr[i] % c.length)` has slight bias when c.length does not divide 2^32; not practically exploitable