NOTE: Several WebPack plugins could not be updated as all plugins within
WebPack's "webpack-contrib" have dropped support for WebPack v4
entirely, but Closure Compiler only supports WebPack v4.
If this is not done, asynchronous decoding of the keyframe via text()
may complete AFTER replay continues, effectively ignoring the keyframe,
leaving currentFrame untouched, and unnecessarily replaying
instructions.
Previously, the state of the tunnel implementations was initialized to
"CONNECTING", which is incorrect and may result in (1) initial state
changes to "CONNECTING" not firing "onstatechange" and (2) the state
change to "CLOSED" incorrectly firing when initially connecting,
despite there not being an established connection.
Besides restoring historically-provided functionality, the ID generated
by the database for connection history records is needed to generate a
deterministic UUID that can be injected into connection configurations
with ${HISTORY_UUID}. Having such a token allows session recordings to
be given names that can be reliably matched with history records.
The Fetch API allows us to read HTTP responses as true streams, without
building an in-memory string. We can the buffer things ourselves as we
see fit, including as a Blob that can dynamically leverage disk storage
for larger data.
An SSH server record in KSM has an associated "KeyPair" field, but this
field need not be set. If unset, the current logic ignores the rest of
the record and assumes there is no private key at all. Instead, the
standard fallbacks of locating an attached PEM file, locating an
alternative password field, etc. should be used.
The clipboard service previously and incorrectly resynced the internal
clipboard with itself. This had the effect of forcing a resync of the
internal clipboard contents to the external, local clipboard, clearing
that clipboard of whatever was copied before.
A previous iteration of the whitespace-trimming changes involved an
additional constructor variation. After removing that portion, the
original constructor for PropertiesGuacamoleProperties was not restored
correctly, and now recursively invokes itself.
When retrieving a contextual field like "passphrase", which does not
have a typed representation different from "password" or "hidden", the
contexts where the field's identity is truly known should be preferred
("password" field of a record with a "keypair" field, which MUST be the
key passphrase). When venturing outside well-known contexts, custom
fields should be preferred when their standard counterparts would
already have well-established meanings that differ from the requested
secret (again: "password" of a record with "keypair").
If this is not done, things like retrieving the private key from a
"Login" record fail, as one of the possible storage mechanisms for a
private key is a hidden or password field, which pulls the user's
password instead of their key. In this case, the correct behavior is
to pull the typed value ("keypair") if available, and use custom fields
ONLY otherwise, as those fields have labels that can establish context.
In no other case would it be reliable to assume that a hidden/password
field actually contains a private key.
Doing otherwise would mean that a particular user would never be able
to be associated with a specific password/key by their username if they
have any explicit server-specific account.
Simply calling getPassword() does not currently work correctly, as the
implementation of getPassword() assumes there will be at least one
value if the field is present. This results in an
ArrayIndexOutOfBoundsException for records with empty passwords:
java.lang.IndexOutOfBoundsException: Index: 0, Size: 0
at java.util.ArrayList.rangeCheck(ArrayList.java:659)
at java.util.ArrayList.get(ArrayList.java:435)
at com.keepersecurity.secretsManager.core.KeeperRecord.getPassword(SecretsManager.kt:134)
...
In the event that a secret name is structured, such as the URL-like
notation used by Keeper Secrets Manager, canonicalizing/encoding the
entire name could result in the name itself becoming invalid. Only the
portions that come from tokens should be canonicalized.
The "GUAC_USERNAME" token provided by the webapp is based off the
username provided by the user when they authenticated. The username
token provided by the vault extensions uses the username stored with
the user's corresponding object, which may not be the same.
From https://github.com/apache/guacamole-client/pull/336#discussion_r241549475:
>
> SLF4J formerly recommended that instance variables be used
> (non-static), but no longer takes either stance:
> https://www.slf4j.org/faq.html#declared_static
>
> If we have to pick something to be the standard going forward, I'd
> say let's stick with the accepted idiom of `private static final`
> loggers, with the exception being where it's actually necessary to
> not be `static` (dependency injection).
>
The SSO provider list unexpectedly shrinks when the invalid login
"shake" animation plays due to the use of "display: table-row" vs. the
login form's own use of "display: table-cell". Migrating the SSO
provider list to a simple absolutely-positioned div corrects this and
matches the way the Guacamole version is rendered.
Mike Jumper