issue #1347 Detect wrong armor checksum

FlowCrypt/src/androidTest/java/com/flowcrypt/email/ui/activity/BackupKeysFragmentSingleKeyPassphraseInRamTest.kt

@@ -21,6 +21,7 @@ import com.flowcrypt.email.R
 import com.flowcrypt.email.TestConstants
 import com.flowcrypt.email.database.entity.KeyEntity
 import com.flowcrypt.email.junit.annotations.DependsOnMailServer
+import com.flowcrypt.email.junit.annotations.NotReadyForCI
 import com.flowcrypt.email.matchers.CustomMatchers.Companion.withRecyclerViewItemCount
 import com.flowcrypt.email.rules.AddPrivateKeyToDatabaseRule
 import com.flowcrypt.email.rules.ClearAppSettingsRule
@@ -58,6 +59,7 @@ class BackupKeysFragmentSingleKeyPassphraseInRamTest : BaseBackupKeysFragmentTes
 
  @Test
  @DependsOnMailServer
+ @NotReadyForCI
  fun testNeedPassphraseEmailOptionSingleFingerprint() {
  onView(withId(R.id.btBackup))
  .check(matches(isDisplayed()))

FlowCrypt/src/main/java/com/flowcrypt/email/security/pgp/PgpMsg.kt

@@ -31,7 +31,6 @@ import com.flowcrypt.email.extensions.org.bouncycastle.openpgp.armor
 import com.flowcrypt.email.extensions.org.bouncycastle.openpgp.toPgpKeyDetails
 import com.flowcrypt.email.extensions.org.owasp.html.allowAttributesOnElementsExt
 import com.flowcrypt.email.security.pgp.PgpArmor.ARMOR_HEADER_DICT
-import org.bouncycastle.bcpg.ArmoredInputStream
 import org.bouncycastle.bcpg.PacketTags
 import org.bouncycastle.openpgp.PGPDataValidationException
 import org.bouncycastle.openpgp.PGPException
@@ -54,6 +53,7 @@ import org.pgpainless.key.info.KeyRingInfo
 import org.pgpainless.key.protection.UnprotectedKeysProtector
 import org.pgpainless.util.Passphrase
 import java.io.ByteArrayOutputStream
+import java.io.IOException
 import java.io.InputStream
 import java.nio.charset.StandardCharsets
 import java.util.Locale
@@ -202,9 +202,8 @@ object PgpMsg {
  )
  }
 
+ val input = data.inputStream()
  val chunk = data.copyOfRange(0, data.size.coerceAtMost(50)).toString(StandardCharsets.US_ASCII)
- var input = data.inputStream() as InputStream
-
  if (chunk.contains(ARMOR_HEADER_DICT[MsgBlock.Type.SIGNED_MSG]!!.begin)) {
  val msg: PgpArmor.CleartextSignedMessage
  try {
@@ -227,9 +226,6 @@ object PgpMsg {
  return DecryptionResult.withCleartext(msg.content, msg.signature)
  }
 
- val isArmored = chunk.contains(ARMOR_HEADER_DICT[MsgBlock.Type.ENCRYPTED_MSG]!!.begin)
- if (isArmored) input = ArmoredInputStream(input)
-
  val keyList: List<PGPSecretKeyRing>
  try {
  keyList = keys.map {
@@ -252,20 +248,26 @@ object PgpMsg {
  )
  }
 
+ val exception: Exception?
  try {
  val consumerOptions = ConsumerOptions()
  .addDecryptionKeys(PGPSecretKeyRingCollection(keyList), UnprotectedKeysProtector())
  pgpPublicKeyRingCollection?.let { consumerOptions.addVerificationCerts(it) }
-
  val decryptionStream = PGPainless.decryptAndOrVerify()
  .onInputStream(input)
  .withOptions(consumerOptions)
-
  val output = ByteArrayOutputStream()
- decryptionStream.use { it.copyTo(output) }
-
- val streamResult = decryptionStream.result
- return DecryptionResult.withDecrypted(output, streamResult.fileName)
+ try {
+ decryptionStream.use { it.copyTo(output) }
+ } catch (ex: IOException) {
+ val message = ex.message
+ if (message != null && message.contains("crc check not found")) {
+ decryptionStream.close()
+ } else {
+ throw ex
+ }
+ }
+ return DecryptionResult.withDecrypted(output, decryptionStream.result.fileName)
  } catch (ex: MessageNotIntegrityProtectedException) {
  return DecryptionResult.withError(
  type = PgpDecrypt.DecryptionErrorType.NO_MDC,
@@ -294,10 +296,28 @@ object PgpMsg {
  message = "There is no suitable decryption key"
  )
  }
+ // other PGP error, fallback to default error return in the bottom
+ exception = ex
+ } catch (ex: Exception) {
+ if (
+ ex is IOException &&
+ ex.message?.contains("crc check failed in armored message") == true
+ ) {
+ return DecryptionResult.withError(
+ type = PgpDecrypt.DecryptionErrorType.FORMAT,
+ message = "Armor CRC check failed"
+ )
+ } else {
+ exception = ex
+ }
+ }
+ var message = "Decryption failed"
+ if (exception != null) {
+ message = "$message: ${exception.javaClass.canonicalName}: ${exception.message}"
  }
  return DecryptionResult.withError(
  type = PgpDecrypt.DecryptionErrorType.OTHER,
- message = "Decryption failed"
+ message = message
  )
  }
 

FlowCrypt/src/test/java/com/flowcrypt/email/security/pgp/PgpMsgTest.kt

@@ -37,7 +37,7 @@ class PgpMsgTest {
  val quoted: Boolean? = null,
  val charset: String = "UTF-8"
  ) {
- val armored: String = loadResourceAsString("messages/$key.txt")
+ val armored: String by lazy { loadResourceAsString("messages/$key.txt") }
  }
 
  companion object {
@@ -112,7 +112,12 @@ class PgpMsgTest {
  TestUtil.decodeString("=E3=82=BE=E3=81=97=E9=80=B8=E7=8F=BE=E9=A3=B2", "UTF-8")
  ),
  charset = "ISO-2022-JP",
- )
+ ),
+
+ MessageInfo(
+ key = "decrypt - issue 1347 - wrong checksum",
+ content = listOf("")
+ ),
  )
 
  private fun findMessage(key: String): MessageInfo {
@@ -172,15 +177,15 @@ class PgpMsgTest {
  assertTrue("Bad MDC not detected", r.error!!.type == PgpDecrypt.DecryptionErrorType.BAD_MDC)
  }
 
- // TODO: Should there be any error?
- // https://github.com/FlowCrypt/flowcrypt-android/issues/1214
  @Test
  fun decryptionTest3() {
  val r = processMessage(
  "decrypt - [everdesk] message encrypted for sub but claims encryptedFor-primary,sub"
  )
  assertTrue("Message not returned", r.content != null)
  assertTrue("Error returned", r.error == null)
+ // TODO: Should there be any error?
+ // https://github.com/FlowCrypt/flowcrypt-android/issues/1214
  }
 
  @Test
@@ -194,6 +199,14 @@ class PgpMsgTest {
  assertTrue("Error returned", r.error == null)
  }
 
+ @Test
+ // @Ignore("BC ArmoredInputStream issue")
+ fun wrongArmorChecksumTest() {
+ val r = processMessage("decrypt - issue 1347 - wrong checksum")
+ assertTrue("Error not returned", r.error != null)
+ assertEquals(PgpDecrypt.DecryptionErrorType.FORMAT, r.error!!.type)
+ }
+
  @Test
  fun wrongPassphraseTest() {
  val messageInfo = findMessage("decrypt - without a subject")

FlowCrypt/src/test/resources/PgpMsgTest/messages/decrypt - issue 1347 - wrong checksum.txt

@@ -0,0 +1,50 @@
+-----BEGIN PGP MESSAGE-----
+Version: FlowCrypt 5.0.4 Gmail Encryption flowcrypt.com
+Comment: Seamlessly send, receive and search encrypted email
+
+wcFMA+ADv/5v4RgKAQ/+K2rrAqhjMe9FLCfklI9Y30Woktg0Q/xe71EVw6WO
+tVD/VK+xv4CHzi+HojtE0U2F+vqoPSO0q5TN9giKPMTiK25PnCzfd7Q+zXiF
+j+5RSHTVJxC62qLHhtKsAQtC4asub8cQIFXbZz3Ns4+7jKtSWPcRqhKTurWv
+XVH0YAFJDsFYo26r2V9c+Ie0uoQPx8graEGpKO9GtoQjXMKK32oApuBSSlmS
+Q+nxyxMx1V+gxP4qgGBCxqkBFRYB/Ve6ygNHL1KxxCVTEw9pgnxJscn89Iio
+dO6qZ9EgIV0PVQN0Yw033MTgAhCHunlE/qXvDxib4tdihoNsLN0q5kdOeiMW
++ntm3kphjMpQ6TMCUGtdS7UmvnadZ+dh5s785M8S9oY64mQd6QuYA2iy1IQv
+q3zpW4/ba2gqL36qCCw/OaruXpQ4NeBr3hMaJQjWgeSuMsQnNGYUn5Nn1+9X
+wtlithO8eLi3M1dg19dpDky8CacWfGgHD7SNsZ2zqFqyd1qtdFcit5ynQUHS
+IiJKeUknGv1dQAnPPJ1FdXyyqC/VDBZG6CNdnxjonmQDRh1YlqNwSnmrR/Sy
+X7n+nGra+/0EHJW6ohaSdep2jAwJDelq/DI1lqiN16ZXJ2/WH6pItA9tmkLU
+61QUz6qwPAnd0t6iy/YkOi2/s1+dwC0DwOcZoUPF8bTBwUwDS1ov/OYtlQEB
+D/46rCPRZrX34ipseTkZxtw3YPhbNkNHo95Mzh9lpeaaZIqtUg2yiFUnhwLi
+tYwyBCkXCb92l1GXXxGSmvSLDSKfQfIpZ0rV5j50MYKIpjSeJZyH/3qP+JXv
+Z47GsTp0z5/oNau5XQwuhLhUtRoZd1WS9ahSJ1akiKeYJroLbTg10fjL25yp
+iaoV16SqKA1H/JOuj6lT5z1nuez35JjeSpUc7ksdot60ZovMfWC+OGRnkYKb
+7KxFd7uaxL6uOBOFyvRxYeohKd73aVkiKpcWd4orI18FhlftFNAwIdsmfzNc
+mzTHZaUl89iYxEKR6ae6AKws1wzLq0noarsf2eKBVbTSfmK3S3xFqduKINnc
+e5Yb3F5adSj1dUjm1BZ4aqzsgKyBb+J8keG9ESsnFOyxOIUXDM1nIo1IOgzC
+M928Jb9GVa+uhdXRrb5cLjTihTusJN0I8oJrwKkwIpCJVgPMdDLkeubrMBQ4
+fbpl4V76sOU2Nx+6nG2FnFBFBFohOL+0nTK5/6Ns9ateN7K9VP++QcoeqfPk
+IUO3+lCZW+trTSvvFId3ziUVsPTeuAS+7nxSMfWZ/K9Ci6QV/Xnx3F/qSmuS
+AUm4zPQ1EjZf1N/5K+vhcCTN4MMx406VlqtedkXL2KPwZ6jDS/ww8RfcmPnD
+s94ct0WCZZtNlnQq+5h0ybwTJNLC2QFyrhhPqztVY95n9La2Mw5WITCWzg/d
+IBUceW/OwHYtePyaSQkCnegDw/2mN2/GC8d0OlwULcTYG6uVenGv2UOUbCr3
+Pfy/Eb/VqUEZK00PdvVQV7FWYAshuTFPTqidph04CgQvBpi3SDEEo8SkEIFS
+/iEeRQaWjFEXKUI3FwKXPJQWvFpbrXBOAjnxXXbAFYOLxdydmq1GVl9Mm3GU
+Clc9g6t9vaYDBPx2gN562/CM/nT8Vq45VHe79XkrrcHDwLn7yeHJScNFsib+
+VvwTPoUftlhC/ai21D403TsJpm7ZmPcDjagoIcXrS/lN03z79RBmSKFtYiXW
+4obkKSGow61vMBh2/XLVYKJKpYKm/GnVlJxA0zQVl558x8I/nAMaxSzwx+ZY
+waVU/s5PLZ7Ghg3MOguiRTlflKUQyL0A7NR46OjFgUnHAZRxr4KO3GoxVPy4
+XLeS4+Wl68s7QlV6WF1IKCHWEUMEeRRea2/OvvlS/oLs2MNNWDemlJ4SiXHf
+xINU38Txo84A00NALbKppsSyy9Gwj//rO/FcerupkfeuOm9nHFwIQeeC5bWD
+mmRlC90r2jY8gM/v3Jjy9h8PbXWxh9MUpc7/kAcTwdGlMxiVjE29p065qTRr
+Oi6sJ7pWuYTfWldZqTVmaBjlv0zuXQ8Eo8o/USvoTs+oihYIMcqReqdeqr/N
+e+sDtYKRg/LKp/JJ5nAQzVMP67DxkgwLNxx0ijBLysaQmvRlsiYWayxZB1Xd
+BxA2bjZRvsmww+hgSKNlcsiubJGBqfqvgmlebZuJHHSC1L6mdMYgcihKmYAj
+p+HFLyqgyeRVMdjRHcrEdxNPG4fJmlk1bYiVQQ4XAd72w+AHS/seZ5HzbAK0
+omuHYUD5PTEqZ1K9JObSsh3XMUkJK+z3BnrOxnTOOyG2r+4FxizH6rfz/Pgg
+sPxqxE9ELUlgQe8plcPFge6aN9tUoSe+vMtDaEAqKw9JwofBF7jlxTqMMvQC
+gWbn9x3W5o4VrnpjYGtPl8sh1QREu0A+0PUJAKL4A3GSMYRouGewLSMNJlOg
+/0pPF6qB+Fi4GJ7ju5C07tfr9z9UqRj09kDXJuoJd95NdSiCz6ndugn6gs8B
+Qf/XPxZVefeMLiB6p8pG0iZ/jcJjyYJLtTg6kA+1/ffmJPfH/76ZA9dgEJLj
+/W2u0Lp4NY8cwqcXuGKgl72TVJ34Iawl35Y0yr47k/7Y1vEQ5Q3bT7HP5A==
+=FdCC
+-----END PGP MESSAGE-----