linux/chrome: find Safe Storage in default keyring (not only login) - #116
Open
MabezDev wants to merge 1 commit into
Open
linux/chrome: find Safe Storage in default keyring (not only login)#116MabezDev wants to merge 1 commit into
MabezDev wants to merge 1 commit into
Conversation
go-keyring's GetLoginCollection hard-codes the "login" collection when that path exists. On common gnome-keyring setups (including non-KDE desktops like Hyprland) Chrome stores "Chrome Safe Storage" in the default keyring (aliases/default → Default_5fkeyring) while a separate login collection still exists and has no Chrome secret. Search via Service.SearchItems (all collections, same as secret-tool), then fall back to default alias, login, and remaining collections. Join primary and fallback keyring errors so a failed Secret Service lookup is not masked by a subsequent empty KWallet miss. Also only yield Chromium cookie DB paths that exist (Network/Cookies or legacy Cookies) so missing layouts do not pollute read errors.
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
On Linux with gnome-keyring, Chrome often stores Chrome Safe Storage in the default keyring (
/org/freedesktop/secrets/aliases/default→ e.g.Default_5fkeyring), while a separatelogincollection still exists and does not hold the Chrome secret.getSecretServicePasswordpreviously used go-keyring'sGetLoginCollection(), which hard-codes thelogincollection whenever that path exists. Search then returned zero items, kooky fell through to KWallet, and callers saw only:even though
secret-tool lookup xdg:schema chrome_libsecret_os_crypt_password_v2works.Fix
Service.SearchItems(all collections, same assecret-tool), then fall back to per-collection search in order: default alias → login → remaining collections.Network/Cookiespreferred, else legacyCookies) so missing layouts do not spam open errors.Linux
v11cookie crypto was already AES-CBC with the dbVersion ≥ 24 32-byte prefix strip; no change needed there once the keyring password is found (password is used as raw bytes, not base64-decoded).Verified on
gnome-keyring-daemon, Chrome 149, cookie DB at~/.config/google-chrome/Default/Cookies(meta version 24,v11ciphertext)user_sessionfor github.com decrypts successfully via kookyTest plan
go test ./internal/chrome/ ./internal/chrome/find/user_sessionreturns a non-empty value withoutGH_SESSION_TOKENKDE_SESSION_VERSIONis set