feat(E2EEncryption): File encryption support

.vscode/settings.json

@@ -20,6 +20,7 @@
 	"typescript.tsdk": "./node_modules/typescript/lib",
 	"cSpell.words": [
 		"autotranslate",
+		"ciphertext",
 		"Contextualbar",
 		"fname",
 		"Gazzodown",

apps/meteor/app/api/server/v1/rooms.ts

@@ -6,6 +6,7 @@ import { isGETRoomsNameExists, isRoomsImagesProps, isRoomsMuteUnmuteUserProps }
 import { Meteor } from 'meteor/meteor';
 
 import { isTruthy } from '../../../../lib/isTruthy';
+import { omit } from '../../../../lib/utils/omit';
 import * as dataExport from '../../../../server/lib/dataExport';
 import { eraseRoom } from '../../../../server/methods/eraseRoom';
 import { muteUserInRoom } from '../../../../server/methods/muteUserInRoom';
@@ -139,6 +140,7 @@ API.v1.addRoute(
 	},
 );
 
+// TODO: deprecate API
 API.v1.addRoute(
 	'rooms.upload/:rid',
 	{ authRequired: true },
@@ -194,6 +196,88 @@ API.v1.addRoute(
 	},
 );
 
+API.v1.addRoute(
+	'rooms.media/:rid',
+	{ authRequired: true },
+	{
+		async post() {
+			if (!(await canAccessRoomIdAsync(this.urlParams.rid, this.userId))) {
+				return API.v1.unauthorized();
+			}
+
+			const file = await getUploadFormData(
+				{
+					request: this.request,
+				},
+				{ field: 'file', sizeLimit: settings.get<number>('FileUpload_MaxFileSize') },
+			);
+
+			if (!file) {
+				throw new Meteor.Error('invalid-field');
+			}
+
+			let { fileBuffer } = file;
+
+			const details = {
+				name: file.filename,
+				size: fileBuffer.length,
+				type: file.mimetype,
+				rid: this.urlParams.rid,
+				userId: this.userId,
+			};
+
+			const stripExif = settings.get('Message_Attachments_Strip_Exif');
+			if (stripExif) {
+				// No need to check mime. Library will ignore any files without exif/xmp tags (like BMP, ico, PDF, etc)
+				fileBuffer = await Media.stripExifFromBuffer(fileBuffer);
+			}
+
+			const fileStore = FileUpload.getStore('Uploads');
+			const uploadedFile = await fileStore.insert(details, fileBuffer);
+
+			await Uploads.updateFileComplete(uploadedFile._id, this.userId, omit(uploadedFile, '_id'));
+
+			const fileUrl = FileUpload.getPath(`${uploadedFile._id}/${encodeURI(uploadedFile.name || '')}`);
+
+			return API.v1.success({
+				file: {
+					_id: uploadedFile._id,
+					url: fileUrl,
+				},
+			});
+		},
+	},
+);
+
+API.v1.addRoute(
+	'rooms.mediaConfirm/:rid/:fileId',
+	{ authRequired: true },
+	{
+		async post() {
+			if (!(await canAccessRoomIdAsync(this.urlParams.rid, this.userId))) {
+				return API.v1.unauthorized();
+			}
+
+			const file = await Uploads.findOneById(this.urlParams.fileId);
+
+			if (!file) {
+				throw new Meteor.Error('invalid-file');
+			}
+
+			file.description = this.bodyParams.description;
+			delete this.bodyParams.description;
+
+			await sendFileMessage(this.userId, { roomId: this.urlParams.rid, file, msgData: this.bodyParams });
+
+			const message = await Messages.getMessageByFileIdAndUsername(file._id, this.userId);
+
+			return API.v1.success({
+				message,
+			});
+		},
+	},
+);
+
 API.v1.addRoute(
 	'rooms.saveNotification',
 	{ authRequired: true },

apps/meteor/app/e2e/client/helper.js

@@ -53,6 +53,10 @@ export async function encryptAES(vector, key, data) {
 	return crypto.subtle.encrypt({ name: 'AES-CBC', iv: vector }, key, data);
 }
 
+export async function encryptAESCTR(vector, key, data) {
+	return crypto.subtle.encrypt({ name: 'AES-CTR', counter: vector, length: 64 }, key, data);
+}
+
 export async function decryptRSA(key, data) {
 	return crypto.subtle.decrypt({ name: 'RSA-OAEP' }, key, data);
 }
@@ -65,6 +69,10 @@ export async function generateAESKey() {
 	return crypto.subtle.generateKey({ name: 'AES-CBC', length: 128 }, true, ['encrypt', 'decrypt']);
 }
 
+export async function generateAESCTRKey() {
+	return crypto.subtle.generateKey({ name: 'AES-CTR', length: 256 }, true, ['encrypt', 'decrypt']);
+}
+
 export async function generateRSAKey() {
 	return crypto.subtle.generateKey(
 		{

apps/meteor/app/e2e/client/rocketchat.e2e.room.js

@@ -1,6 +1,5 @@
 import { Base64 } from '@rocket.chat/base64';
 import { Emitter } from '@rocket.chat/emitter';
-import { Random } from '@rocket.chat/random';
 import EJSON from 'ejson';
 
 import { RoomManager } from '../../../client/lib/RoomManager';
@@ -23,6 +22,8 @@ import {
 	importAESKey,
 	importRSAKey,
 	readFileAsArrayBuffer,
+	encryptAESCTR,
+	generateAESCTRKey,
 } from './helper';
 import { log, logError } from './logger';
 import { e2e } from './rocketchat.e2e';
@@ -333,69 +334,72 @@ export class E2ERoom extends Emitter {
 		}
 	}
 
+	async sha256Hash(text) {
+		const encoder = new TextEncoder();
+		const data = encoder.encode(text);
+		const hashArray = Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', data)));
+		return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
+	}
+
 	// Encrypts files before upload. I/O is in arraybuffers.
 	async encryptFile(file) {
-		if (!this.isSupportedRoomType(this.typeOfRoom)) {
-			return;
-		}
+		// if (!this.isSupportedRoomType(this.typeOfRoom)) {
+		// 	return;
+		// }
 
 		const fileArrayBuffer = await readFileAsArrayBuffer(file);
 
 		const vector = crypto.getRandomValues(new Uint8Array(16));
+		const key = await generateAESCTRKey();
 		let result;
 		try {
-			result = await encryptAES(vector, this.groupSessionKey, fileArrayBuffer);
+			result = await encryptAESCTR(vector, key, fileArrayBuffer);
 		} catch (error) {
+			console.log(error);
 			return this.error('Error encrypting group key: ', error);
 		}
 
-		const output = joinVectorAndEcryptedData(vector, result);
+		const exportedKey = await window.crypto.subtle.exportKey('jwk', key);
+
+		const fileName = await this.sha256Hash(file.name);
 
-		const encryptedFile = new File([toArrayBuffer(EJSON.stringify(output))], file.name);
+		const encryptedFile = new File([toArrayBuffer(result)], fileName);
 
-		return encryptedFile;
+		return {
+			file: encryptedFile,
+			key: exportedKey,
+			iv: Base64.encode(vector),
+			type: file.type,
+		};
 	}
 
 	// Decrypt uploaded encrypted files. I/O is in arraybuffers.
-	async decryptFile(message) {
-		if (message[0] !== '{') {
-			return;
-		}
-
-		const [vector, cipherText] = splitVectorAndEcryptedData(EJSON.parse(message));
+	async decryptFile(file, key, iv) {
+		const ivArray = Base64.decode(iv);
+		const cryptoKey = await window.crypto.subtle.importKey('jwk', key, { name: 'AES-CTR' }, true, ['encrypt', 'decrypt']);
 
-		try {
-			return await decryptAES(vector, this.groupSessionKey, cipherText);
-		} catch (error) {
-			this.error('Error decrypting file: ', error);
-
-			return false;
-		}
+		return window.crypto.subtle.decrypt({ name: 'AES-CTR', counter: ivArray, length: 64 }, cryptoKey, file);
 	}
 
 	// Encrypts messages
 	async encryptText(data) {
-		if (!(typeof data === 'function' || (typeof data === 'object' && !!data))) {
-			data = new TextEncoder('UTF-8').encode(EJSON.stringify({ text: data, ack: Random.id((Random.fraction() + 1) * 20) }));
-		}
-
-		if (!this.isSupportedRoomType(this.typeOfRoom)) {
-			return data;
-		}
-
 		const vector = crypto.getRandomValues(new Uint8Array(16));
-		let result;
+
 		try {
-			result = await encryptAES(vector, this.groupSessionKey, data);
+			const result = await encryptAES(vector, this.groupSessionKey, data);
+			return this.keyID + Base64.encode(joinVectorAndEcryptedData(vector, result));
 		} catch (error) {
-			return this.error('Error encrypting message: ', error);
+			this.error('Error encrypting message: ', error);
+			throw error;
 		}
-
-		return this.keyID + Base64.encode(joinVectorAndEcryptedData(vector, result));
 	}
 
 	// Helper function for encryption of messages
 	encrypt(message) {
+		if (!this.isSupportedRoomType(this.typeOfRoom)) {
+			return;
+		}
+
 		const ts = new Date();
 
 		const data = new TextEncoder('UTF-8').encode(
@@ -410,20 +414,6 @@ export class E2ERoom extends Emitter {
 		return this.encryptText(data);
 	}
 
-	encryptAttachmentDescription(description, _id) {
-		const ts = new Date();
-
-		const data = new TextEncoder('UTF-8').encode(
-			EJSON.stringify({
-				userId: this.userId,
-				text: description,
-				_id,
-				ts,
-			}),
-		);
-		return this.encryptText(data);
-	}
-
 	// Decrypt messages
 
 	async decryptMessage(message) {
@@ -445,10 +435,6 @@ export class E2ERoom extends Emitter {
 	}
 
 	async decrypt(message) {
-		if (!this.isSupportedRoomType(this.typeOfRoom)) {
-			return message;
-		}
-
 		const keyID = message.slice(0, 12);
 
 		if (keyID !== this.keyID) {

apps/meteor/app/e2e/client/rocketchat.e2e.ts

@@ -2,7 +2,7 @@ import QueryString from 'querystring';
 import URL from 'url';
 
 import type { IE2EEMessage, IMessage, IRoom, ISubscription } from '@rocket.chat/core-typings';
-import { isE2EEMessage, isFileAttachment } from '@rocket.chat/core-typings';
+import { isE2EEMessage } from '@rocket.chat/core-typings';
 import { Emitter } from '@rocket.chat/emitter';
 import EJSON from 'ejson';
 import { Meteor } from 'meteor/meteor';
@@ -422,60 +422,22 @@ class E2E extends Emitter {
 
 		const data = await e2eRoom.decrypt(message.msg);
 
+		if (message.content && message.content.algorithm === 'rc.v1.aes-sha2') {
+			const content = await e2eRoom.decrypt(message.content.ciphertext);
+			Object.assign(message, content);
+		}
+
 		const decryptedMessage: IE2EEMessage = {
 			...message,
+			e2e: 'done',
 			...(data && {
 				msg: data.text,
-				e2e: 'done',
 			}),
 		};
 
 		const decryptedMessageWithQuote = await this.parseQuoteAttachment(decryptedMessage);
 
-		const decryptedMessageWithAttachments = await this.decryptMessageAttachments(decryptedMessageWithQuote);
-
-		return decryptedMessageWithAttachments;
-	}
-
-	async decryptMessageAttachments(message: IMessage): Promise<IMessage> {
-		const { attachments } = message;
-
-		if (!attachments || !attachments.length) {
-			return message;
-		}
-
-		const e2eRoom = await this.getInstanceByRoomId(message.rid);
-
-		if (!e2eRoom) {
-			return message;
-		}
-
-		const decryptedAttachments = await Promise.all(
-			attachments.map(async (attachment) => {
-				if (!isFileAttachment(attachment)) {
-					return attachment;
-				}
-
-				if (!attachment.description) {
-					return attachment;
-				}
-
-				const data = await e2eRoom.decrypt(attachment.description);
-
-				if (!data) {
-					return attachment;
-				}
-
-				attachment.description = data.text;
-				return attachment;
-			}),
-		);
-
-		return {
-			...message,
-			attachments: decryptedAttachments,
-			e2e: 'done',
-		};
+		return decryptedMessageWithQuote;
 	}
 
 	async decryptPendingMessages(): Promise<void> {

apps/meteor/app/file-upload/server/methods/sendFileMessage.ts

@@ -187,7 +187,12 @@ export const sendFileMessage = async (
 			tmid: Match.Optional(String),
 			customFields: Match.Optional(String),
 			t: Match.Optional(String),
-			e2e: Match.Optional(String),
+			content: Match.Optional(
+				Match.ObjectIncluding({
+					algorithm: String,
+					ciphertext: String,
+				}),
+			),
 		}),
 	);