Merge pull request #12 from blooo-io/fix/audit-fix

fix: audit fix

Author: Z4karia

.gitignore

@@ -37,3 +37,4 @@ doc/html
 doc/latex
 
 tests/snapshots-tmp
+tests/bitcoin

Makefile

@@ -39,7 +39,7 @@ include $(BOLOS_SDK)/Makefile.defines
 CURVE_APP_LOAD_PARAMS = secp256k1
 
 # Application allowed derivation paths.
-PATH_APP_LOAD_PARAMS = ""
+PATH_APP_LOAD_PARAMS = "44'/0'" "44'/1'" "84'/0'" "84'/1'" "86'/0'" "86'/1'"
 
 # Allowed SLIP21 paths
 PATH_SLIP21_APP_LOAD_PARAMS = "LEDGER-Wallet policy"
@@ -76,7 +76,6 @@ endif
 #     Application custom permissions   #
 ########################################
 HAVE_APPLICATION_FLAG_DERIVE_MASTER = 1
-HAVE_APPLICATION_FLAG_GLOBAL_PIN = 1
 HAVE_APPLICATION_FLAG_BOLOS_SETTINGS = 1
 HAVE_APPLICATION_FLAG_LIBRARY = 1
 

src/boilerplate/dispatcher.h

@@ -30,6 +30,15 @@ static inline void SEND_SW(struct dispatcher_context_s *dc, uint16_t sw) {
     dc->send_response();
 }
 
+#define SAFE_SEND_SW(dc, sw)                            \
+    do {                                                \
+        if (dc != NULL) {                               \
+            SEND_SW(dc, sw);                            \
+        } else {                                        \
+            PRINTF("Error: Null dispatcher context\n"); \
+        }                                               \
+    } while (0)
+
 static inline void SET_RESPONSE(struct dispatcher_context_s *dc,
                                 void *rdata,
                                 size_t rdata_len,

src/handler/withdraw.c

@@ -172,16 +172,6 @@ bool ui_validate_withdraw_data_and_confirm(dispatcher_context_t *context,
     return io_ui_process(context, SET_UX_DIRTY);
 }
 
-// bool ui_display_message_confirm(dispatcher_context_t *context) {
-// #ifdef HAVE_AUTOAPPROVE_FOR_PERF_TESTS
-//     return true;
-// #endif
-
-//     (void) context;
-//     ui_sign_message_confirm_flow();
-
-//     return io_ui_process(context, SET_UX_DIRTY);
-// }
 #ifdef HAVE_BAGL
 bool ui_display_register_wallet(dispatcher_context_t *context,
                                 const policy_map_wallet_header_t *wallet_header,

src/ui/display.c

@@ -47,7 +47,7 @@
 import time
 import urllib.parse
 
-HTTP_TIMEOUT = 30
+HTTP_TIMEOUT = 60
 USER_AGENT = "AuthServiceProxy/0.1"
 
 log = logging.getLogger("BitcoinRPC")

test_utils/authproxy.py

@@ -200,7 +200,7 @@ def test_register_wallet_unsupported_policy(navigator: Navigator, firmware: Firm
     assert DeviceException.exc.get(e.value.status) == NotSupportedError
     assert len(e.value.data) == 0
 
-
+@pytest.mark.timeout(0) # disable timeout
 def test_register_miniscript_long_policy(navigator: Navigator, firmware: Firmware, client:
                                          RaggerClient, test_name: str, speculos_globals):
     # This test makes sure that policies longer than 256 bytes work as expected on all devices
@@ -397,7 +397,7 @@ def test_register_wallet_tr_with_nums_keypath(navigator: Navigator, firmware: Fi
         instructions=register_wallet_instruction_approve(firmware),
         test_name=test_name)
 
-
+@pytest.mark.timeout(0) # disable timeout
 def test_register_wallet_tr_script_sortedmulti(navigator: Navigator, firmware: Firmware, client:
                                                RaggerClient, test_name: str, speculos_globals):
     run_register_test(navigator, client, speculos_globals, WalletPolicy(

tests/snapshots/flex/test_get_extended_pubkey_non_standard_0_0/00000.png

@@ -284,7 +284,6 @@ def test_sighash_single_3_ins_2_out(navigator: Navigator, firmware: Firmware, cl
     assert DeviceException.exc.get(e.value.status) == NotSupportedError
     assert len(e.value.data) == 0
 
-
 def test_sighash_all_anyone_sign(navigator: Navigator, firmware: Firmware, client: RaggerClient, test_name: str):
     psbt = open_psbt_from_file(f"{tests_root}/psbt/sighash/sighash-all-anyone-can-pay-sign.psbt")