feat(Core): add encryption & use it by default

Uses AES-256-GCM and z85 for content encoding. FreeBSD is not supported yet, so it doesn't use Encryption.

Author: BrycensRanch

.github/Progress.md

@@ -10,7 +10,7 @@
 - [x] Package PaddleOCR for Linux properly.
 - [ ] Add charts for statistics like uploading, avg image size, most used image extension, and error rate for uploading
 - [ ] Ensure SnapX is the default screenshot program when installed on a new Windows installation.
-- [ ] Package for popular technologies (Flatpak, RPM (Fedora/OpenSUSE), Snap, Homebrew)
+- [x] Package for popular technologies (Flatpak, RPM (Fedora/OpenSUSE), Snap, Homebrew)
 - [ ] Expose the entire Core in UI (Avalonia) (Missing direct upload function & drag and drop)
 - [x] Add telemetry & Aptabase is a work in progress, PR pending https://github.com/aptabase/aptabase-maui/pull/12
 - [ ] Create MSI installer with [WixSharp](https://github.com/oleg-shilo/wixsharp)
@@ -31,7 +31,7 @@
 - [ ] Add database viewer as an built in SQLite database viewer that is able to complete operations like mass path replacement ie `C:\Users/Brycen` -> `/home/brycen`
 - [ ] Make CLI UNIX friendly while keeping ShareX's CLI valid. The CLI should be able to print its usage and autocomplete.
 - [ ] Add first tool, the FFMPEG 100MB video transcoder
-- [ ] Port `go-keyring` to C# (Needed for not saving auth creds in plaintext, big no no )
+- [x] Port `go-keyring` to C# (Needed for not saving auth creds in plaintext, big no no )
 - [ ] Search for missing files button in main window and locate missing file to allow users to fix broken entries.
 - [x] Bring in XCap library in .NET and other cross-platform screen capture libraries. (This will make the port take much longer)
 - [x] Remove SnapX as a fork of ShareX that can be merged into upstream. *Completed at 233 commits ahead of upstream*
@@ -41,7 +41,7 @@
 - [ ] Add Custom Uploader List to SnapX via a build-time HTTP Fetch, or if the file is there already, use that. Can be disabled by packagers as they need offline builds. Or they could fetch the list, or rather, JSON, as part of their build script that isn't done during packaging time. That list is then embedded into the binary, and then at runtime it is checked *again* for any new entries to said list. Thus, the functionality keeps working even in an environment where SnapX cannot access the internet.
 - [ ] ~~Add automatic region detection that suggests to users in Egypt, Russia, Ukraine, and possibly more to switch their default image uploader from Imgur to ImgBB. According to my tests, ImgBB doesn't have such region blocks for Ukraine & Egypt. Russia is untested because PIA doesn't have any servers there.~~ Imgur continually gets less reliable. I am investigating making ImgBB the default uploader for now until a more suitable alternative is found.
 - [ ] Add instructions to generate API keys for those interested
-- [ ] Add editor functionality (Crop, Annotate, etc) using [SkiaSharp](https://github.com/mono/SkiaSharp)
+- [ ] Add editor functionality (Crop, Annotate, etc) using ImageSharp
 
 ## Studying ShareX's behavior on Windows 11 24H2
 

SnapX.Avalonia/Converters/HeaderSecurityBlurConverter.cs

@@ -1,64 +1,20 @@
+using SnapX.Core.Upload.Custom;
+
 namespace SnapX.Avalonia.Converters;
 
 using System.Globalization;
 using global::Avalonia.Data.Converters;
 
 public class HeaderSecurityBlurConverter : IValueConverter
 {
-    private static readonly string[] SensitiveKeys =
-    {
-        "password",
-        "upload_password",
-        "upload-password",
-        "passwd",
-        "pass",
-        "pwd",
-        "api",
-        "apikey",
-        "api-key",
-        "api_key",
-        "x-api-key",
-        "api key",
-        "key",
-        "keyid",
-        "key-id",
-        "email",
-        "user",
-        "k", // puush.me uses 'k' as their API key header
-        "p", // short for password
-        "username",
-        "user-name",
-        "user name",
-        "credential",
-        "creds",
-        "cred",
-        "token",
-        "secret",
-        "auth",
-        "authorization",
-        "x-authorization",
-        "x-auth-token",
-        "access-token",
-        "access token",
-        "bearer",
-        "session",
-        "jwt",
-        "cookie",
-        "priv",
-        "sid",
-        "uuid",
-        "guid",
-        "salt",
-        "nonce",
-    };
 
     public object? Convert(object? value, Type targetType, object? parameter, CultureInfo culture)
     {
         string? key = value as string;
         if (string.IsNullOrWhiteSpace(key))
             return 0.0;
 
-        bool isSensitive = SensitiveKeys.Any(s =>
+        bool isSensitive = CustomUploaderItem.SensitiveKeys.Any(s =>
             key.Equals(s, StringComparison.OrdinalIgnoreCase)
         );
 

SnapX.Avalonia/Views/Settings/Views/FileUploaders/FTPSettingsView.axaml.cs

@@ -303,74 +303,74 @@ private async void TestFTPAccountClick(object? Sender, RoutedEventArgs E)
         await Task.Run(() =>
         {
 
-        try
-        {
-            switch (account.Protocol)
+            try
             {
-                case FTPProtocol.FTP or FTPProtocol.FTPS:
-                    {
-                        using var ftp = new FTP(account);
-                        if (ftp.Connect())
+                switch (account.Protocol)
+                {
+                    case FTPProtocol.FTP or FTPProtocol.FTPS:
                         {
-                            if (!ftp.DirectoryExists(remotePath))
+                            using var ftp = new FTP(account);
+                            if (ftp.Connect())
                             {
-                                directories = ftp.CreateMultiDirectory(remotePath);
-                            }
+                                if (!ftp.DirectoryExists(remotePath))
+                                {
+                                    directories = ftp.CreateMultiDirectory(remotePath);
+                                }
 
-                            if (ftp.IsConnected)
-                            {
-                                if (directories.Count > 0)
+                                if (ftp.IsConnected)
                                 {
-                                    msg = "Account connected, created folders" + "\r\n" + string.Join("\r\n", directories);
+                                    if (directories.Count > 0)
+                                    {
+                                        msg = "Account connected, created folders" + "\r\n" + string.Join("\r\n", directories);
+                                    }
+                                    else
+                                    {
+                                        msg = "Account connected";
+                                    }
                                 }
                                 else
                                 {
-                                    msg = "Account connected";
+                                    msg = "Account not connected";
                                 }
                             }
-                            else
-                            {
-                                msg = "Account not connected";
-                            }
-                        }
 
-                        break;
-                    }
-                case FTPProtocol.SFTP:
-                    {
-                        using var sftp = new SFTP(account);
-                        if (sftp.Connect())
+                            break;
+                        }
+                    case FTPProtocol.SFTP:
                         {
-                            if (!sftp.DirectoryExists(remotePath))
+                            using var sftp = new SFTP(account);
+                            if (sftp.Connect())
                             {
-                                directories = sftp.CreateMultiDirectory(remotePath);
-                            }
+                                if (!sftp.DirectoryExists(remotePath))
+                                {
+                                    directories = sftp.CreateMultiDirectory(remotePath);
+                                }
 
-                            if (sftp.IsConnected)
-                            {
-                                if (directories.Count > 0)
+                                if (sftp.IsConnected)
                                 {
-                                    msg = "Account connected, created folders" + "\r\n" + string.Join("\r\n", directories);
+                                    if (directories.Count > 0)
+                                    {
+                                        msg = "Account connected, created folders" + "\r\n" + string.Join("\r\n", directories);
+                                    }
+                                    else
+                                    {
+                                        msg = "Account connected";
+                                    }
                                 }
                                 else
                                 {
-                                    msg = "Account connected";
+                                    msg = "Account not connected";
                                 }
                             }
-                            else
-                            {
-                                msg =  "Account not connected";
-                            }
-                        }
 
-                        break;
-                    }
+                            break;
+                        }
+                }
+            }
+            catch (Exception e)
+            {
+                msg = e.Message;
             }
-        }
-        catch (Exception e)
-        {
-            msg = e.Message;
-        }
         });
 
         var dialog = new ContentDialog

SnapX.Core/MasterkeyManager.cs

@@ -0,0 +1,50 @@
+using System.Security.Cryptography;
+using GnomeStack.Standard;
+using SimpleBase;
+
+namespace SnapX.Core;
+
+public static class MasterKeyManager
+{
+    private const string ServiceName = SnapXL.AppName;
+    private const string AccountName = "MasterEncryptionKey";
+    private const int KeySize = 32; // 256-bit
+
+    public static byte[] GetOrGenerateKey()
+    {
+        var z85Key = OsSecretVault.GetSecret(ServiceName, AccountName);
+
+        if (string.IsNullOrEmpty(z85Key)) return GenerateAndStoreKey();
+        try
+        {
+            var key = Base85.Z85.Decode(z85Key);
+            if (key.Length == KeySize)
+            {
+                // DebugHelper.WriteLine($"[Vault] Key successfully recovered via Z85. Hash: {BitConverter.ToString(key[..4])}...");
+                return key;
+            }
+        }
+        catch (Exception ex)
+        {
+            DebugHelper.WriteLine($"[Vault] Secret was not valid Z85: {ex.Message}");
+        }
+
+        return GenerateAndStoreKey();
+    }
+
+    private static byte[] GenerateAndStoreKey()
+    {
+        var newKey = new byte[KeySize];
+        using (var rng = RandomNumberGenerator.Create())
+        {
+            rng.GetBytes(newKey);
+        }
+        var z85Key = Base85.Z85.Encode(newKey);
+
+        OsSecretVault.SetSecret(ServiceName, AccountName, z85Key);
+
+        return newKey;
+    }
+
+    public static void ResetKey() => OsSecretVault.DeleteSecret(ServiceName, AccountName);
+}

SnapX.Core/SettingManager.cs

@@ -7,6 +7,7 @@
 using System.Reflection;
 using System.Text.Json;
 using System.Text.Json.Serialization;
+using System.Text.Json.Serialization.Metadata;
 using Dapper;
 #if WINDOWS
 using Esatto.Win32.Registry;
@@ -216,7 +217,7 @@ public static void LoadUploadersConfig(bool fallbackSupport = true)
         }
         UploadersConfig.CreateBackup = true;
         UploadersConfig.CreateWeeklyBackup = true;
-        UploadersConfig.SupportDPAPIEncryption = true;
+        UploadersConfig.UseEncryption = true;
         BuiltConfig.Bind(UploadersConfig, Options => Options.BindNonPublicProperties = true);
         UploadersConfigBackwardCompatibilityTasks();
     }
@@ -390,8 +391,9 @@ private static T MigrateJsonConfig<T>(string path)
             new JsonSerializerOptions
             {
                 PropertyNameCaseInsensitive = true,
-                TypeInfoResolver = SettingsContext.Default,
+                TypeInfoResolver = SettingsContext.Default.WithAddedModifier(typeInfo => JsonEncryptionResolver.CreateModifier(typeInfo, SecurePropertyStore.Instance)),
                 DefaultIgnoreCondition = JsonIgnoreCondition.Never,
+                AllowTrailingCommas = true,
                 Converters =
                 {
                     new JsonRectangleConverter(),

SnapX.Core/SnapX.Core.csproj

@@ -98,7 +98,9 @@
     while these are only useful for Linux,
     hiding them behind a compiler conditional makes debugging more difficult. -->
     <PackageReference Include="Tmds.DBus.Protocol" Version="0.90.3" />
-<!--    <PackageReference Include="WaylandSharper" Version="0.1.3">-->
+    <PackageReference Include="GnomeStack.Secrets.OperatingSystem" Version="0.1.6" />
+    <PackageReference Include="SimpleBase" Version="5.6.0" />
+    <!--    <PackageReference Include="WaylandSharper" Version="0.1.3">-->
 <!--      <IncludeAssets>build; contentfiles; analyzers; buildtransitive</IncludeAssets>-->
 <!--      <PrivateAssets>all</PrivateAssets>-->
 <!--    </PackageReference>-->

SnapX.Core/Upload/Custom/CustomUploaderItem.cs

@@ -14,6 +14,7 @@
 using SnapX.Core.Utils.Extensions;
 using SnapX.Core.Utils.Miscellaneous;
 using SnapX.Core.Utils.Parsers;
+using YamlDotNet.Serialization;
 
 namespace SnapX.Core.Upload.Custom;
 
@@ -136,6 +137,55 @@ public bool ShouldSerializeData() =>
 
     [DefaultValue("")]
     public string? ErrorMessage { get; set; }
+    [Browsable(false)]
+    [YamlIgnore]
+    [JsonIgnore]
+    public static readonly string[] SensitiveKeys =
+    {
+        "password",
+        "upload_password",
+        "upload-password",
+        "passwd",
+        "pass",
+        "pwd",
+        "api",
+        "apikey",
+        "api-key",
+        "api_key",
+        "x-api-key",
+        "api key",
+        "key",
+        "keyid",
+        "key-id",
+        "email",
+        "user",
+        "k", // puush.me uses 'k' as their API key header
+        "p", // short for password
+        "username",
+        "user-name",
+        "user name",
+        "credential",
+        "creds",
+        "cred",
+        "token",
+        "secret",
+        "auth",
+        "authorization",
+        "x-authorization",
+        "x-auth-token",
+        "access-token",
+        "access token",
+        "bearer",
+        "session",
+        "jwt",
+        "cookie",
+        "priv",
+        "sid",
+        "uuid",
+        "guid",
+        "salt",
+        "nonce",
+    };
 
     public CustomUploaderItem()
     {

SnapX.Core/Upload/File/AmazonS3Settings.cs

@@ -2,12 +2,15 @@
 // SPDX-License-Identifier: GPL-3.0-or-later
 
 
+using SnapX.Core.Utils;
 
 namespace SnapX.Core.Upload.File;
 
 public class AmazonS3Settings
 {
     public string? AccessKeyID { get; set; }
+    [JsonEncrypt]
+    [YamlEncrypt]
     public string SecretAccessKey { get; set; }
     public string? Endpoint { get; set; }
     public string Region { get; set; }