pext / pext_module_pass

Allows Pext to do password management through pass

Pext

Contents

• Introduction
• How it works
• Installation
• Usage
• Hotkeys
• Community
• License

Introduction

Pext stands for Python-based extendable tool. It is built using Python 3 and Qt5 QML and has its behaviour decided by modules. Pext provides a simple window with a search bar, allowing modules to define what data is shown and how it is manipulated.

For example, say you want to use Pext as a password manager. You load in the pass module, and it will show you a list of your passwords which you can filter with the search bar. When you select a password in the list, it will copy the password to your clipboard and Pext will hide itself, waiting for you to ask for it again.

Depending on the module you choose, what entries are shown and what happens when you select an entry changes. So choose the module appropriate for what you want to do, and Pext makes it easy.

Several modules are available for effortless install right within Pext.

How it works

Pext is designed to quickly pop up and get out of your way as soon as you're done with something. It is recommended to bind Pext to some global hotkey, or possibly run multiple instances of it with different profiles under multiple hotkeys. Example Pext workflows look as follows:

Simply put:

• Open (Pext)
• Search (for something)
• Select (with Enter)
• Hide (automatically)

Installation

Check the install instructions at Read the Docs.

Usage

To actually use Pext, you will first have to install one or more modules. Check out the Pext organisation on GitHub or use Module -> Install module -> From online module list in the application for a list of modules.

After installating at least one module, you can load it from the Module -> Load module menu. After that, experiment! Each module is different.

For command line options, use --help.

Hotkeys

Entry management

• Escape: Go one level up
• Shift+Escape: Go up to top level and trigger minimize
• Tab: Tab-complete the current input
• Enter / Left mouse button: Select entry or run command
• Shift+Enter: Select entry or run command but explicitly disable minimizing
• Ctrl+Enter: Run command with arguments
• Ctrl+. / Right mouse button on any item: Open context menu
• Ctrl+J / Down arrow: Go one entry down
• Ctrl+H / Up arrow: Go one entry up
• Ctrl+F / Page down: Go one page down
• Ctrl+B / Page up: Go one page up

Tab management

• Ctrl+T: Open new tab
• Ctrl+W: Close current tab
• Ctrl+Tab: Switch to next tab
• Ctrl+Shift+Tab: Switch to previous tab
• Alt+<number>: Switch to tab <number>
• F5: Reload tab, including code changes to the module

Session management

• Ctrl+Q: Quit

Community

If you need support or just want to chat with our community, we have the following options:

• Matrix: #pext:matrix.org (webchat)
• Telegram: @PextTool

Both channels are linked to each other, so there is no need to worry about missing out.

License

Pext is licensed under the GNU GPLv3+, with exception of artwork and documentation, which are licensed under the Creative Commons Attribution Share-Alike 4.0 license.

Under artwork and documentation fall:

• All files in the following directories:
  • assets/
  • docs/
  • pext/images/
  • .github/
• All Markdown files in the root directory.

When attributing the logo (which was donated by vaeringjar), it should be attributed as Lilly the leoger by White Paper Fox. Alternatively, it may be referred to as the Pext logo. Please link to Pext with https://github.com/Pext/Pext or https://pext.io/ and to White Paper Fox with http://www.whitepaperfox.com/ where possible.

pext_module_pass's Issues

GitLab OTP key breaks password decryption

Copying GitLab's key as-in without removing spaces:

Exception in thread Thread-34:
Traceback (most recent call last):
  File "/usr/local/Cellar/python/3.7.6_1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/threading.py", line 926, in _bootstrap_inner
    self.run()
  File "/usr/local/Cellar/python/3.7.6_1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/threading.py", line 870, in run
    self._target(*self._args, **self._kwargs)
  File "/Users/sylviavanos/.config/pext/modules/pext_module_pass/__init__.py", line 499, in _display_results
    otp_code = otp.now()
  File "/usr/local/lib/python3.7/site-packages/pyotp/totp.py", line 44, in now
    return self.generate_otp(self.timecode(datetime.datetime.now()))
  File "/usr/local/lib/python3.7/site-packages/pyotp/otp.py", line 45, in generate_otp
    hasher = hmac.new(self.byte_secret(), self.int_to_bytestring(input), self.digest)
  File "/usr/local/lib/python3.7/site-packages/pyotp/otp.py", line 62, in byte_secret
    return base64.b32decode(self.secret, casefold=True)
  File "/usr/local/Cellar/python/3.7.6_1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/base64.py", line 231, in b32decode
    raise binascii.Error('Non-base32 digit found') from None
binascii.Error: Non-base32 digit found

Also, when scanning the screen, the code doesn't seem to get added at all?!

CVE-2017-18342 High Severity Vulnerability detected by WhiteSource

CVE-2017-18342 - High Severity Vulnerability

Vulnerable Library - PyYAML-3.13.tar.gz

YAML parser and emitter for Python

path: /tmp/git/pext_module_pass/requirements.txt

Library home page: https://files.pythonhosted.org/packages/9e/a3/1d13970c3f36777c583f136c136f804d70f500168edc1edea6daa7200769/PyYAML-3.13.tar.gz

Dependency Hierarchy:

• watchdog-0.9.0.tar.gz (Root Library)
  • ❌ PyYAML-3.13.tar.gz (Vulnerable Library)

Vulnerability Details

In PyYAML before 4.1, the yaml.load() API could execute arbitrary code. In other words, yaml.safe_load is not used.

Publish Date: 2018-06-27

URL: CVE-2017-18342

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: yaml/pyyaml@ccc40f3

Release Date: 2018-06-30

Fix Resolution: Replace or update the following files: cyaml.py, test_recursive.py, dumper.py, test_constructor.py, __init__.py, cyaml.py, loader.py, dumper.py, test_constructor.py, __init__.py, loader.py, test_recursive.py

---

Step up your Open Source Security Game with WhiteSource here

Editing an entry through the context menu twice in a row causes exception

Traceback (most recent call last):
  File "pext/__main__.py", line 442, in <lambda>
    lambda userinput: tab['vm'].module.process_response(userinput))
  File "/home/sylvia/.config/pext/modules/pext_module_pass/__init__.py", line 255, in process_response                                                                     
    self._run_command([self.proc['command']] + response.split(" "))
KeyError: 'command'

Can't empty other fields

Edit other fields -> Emptying input -> Save -> Dialog reopens with old input

This probably happens in several places. Empty string could occasionally be valid input. Need to check this properly in all the process_response code.

Windows support

The pass module currently depends on the pass shell script, which isn't portable to Windows. It should be rewritten to directly do GPG operations. As a bonus, this should remove any dependencies that need to be manually installed on Linux and macOS too.

could not find .gpg-id file when entering a wrong SSH key password

Module version gd9814a4
Pext v0.30-20-g0856c9d on linux

Traceback (most recent call last):
  File "pext/__main__.py", line 1794, in run
    threading.Thread.run(self)
  File "/usr/lib64/python3.7/threading.py", line 870, in run
    self._target(*self._args, **self._kwargs)
  File "/home/sylvia/.config/pext/modules/pext_module_pass/__init__.py", line 63, in init
    self.password_store = pypass.PasswordStore(self.data_location)
  File "/home/sylvia/.local/lib/python3.7/site-packages/pypass/passwordstore.py", line 64, in __init__
    raise Exception("could not find .gpg-id file")
Exception: could not find .gpg-id file

Like, whaaaat?

Cannot load pass module (locale error)

Trying to load the pass module. On clicking "OK", nothing in the pext window changes and this message is printed into the terminal:

WARN: Module pass uses old process_response signature and will not be able to receive an identifier if requested
WARN: Module pass caused exception 'Module' object has no attribute 'observer' on unload
Traceback (most recent call last):
  File "/usr/lib64/python3.5/site-packages/pext/__main__.py", line 1087, in unload_module
    window.tab_bindings[tab_id]['module'].stop()
  File "/home/me/.config/pext/modules/pext_module_pass/__init__.py", line 253, in stop
    self.observer.stop()
AttributeError: 'Module' object has no attribute 'observer'
file:///usr/lib64/python3.5/site-packages/pext/qml/ModuleData.qml:27: TypeError: Cannot read property of null
Traceback (most recent call last):
  File "/usr/lib64/python3.5/site-packages/pext/__main__.py", line 1377, in run
    threading.Thread.run(self)
  File "/usr/lib64/python3.5/threading.py", line 862, in run
    self._target(*self._args, **self._kwargs)
  File "/home/me/.config/pext/modules/pext_module_pass/__init__.py", line 39, in init
    lang = gettext.translation('pext_module_pass', localedir=os.path.join(os.path.dirname(os.path.abspath(__file__)), 'locale'), languages=[settings['_locale']])
  File "/usr/lib64/python3.5/gettext.py", line 510, in translation
    mofiles = find(domain, localedir, languages, all=True)
  File "/usr/lib64/python3.5/gettext.py", line 482, in find
    for nelang in _expand_lang(lang):
  File "/usr/lib64/python3.5/gettext.py", line 206, in _expand_lang
    loc = locale.normalize(loc)
  File "/usr/lib64/python3.5/locale.py", line 392, in normalize
    code = localename.lower()
AttributeError: 'NoneType' object has no attribute 'lower'

Tested with LC_ALL=en_GB.utf8 and LC_ALL=nl_NL.utf8, both have the same results.

Running on Gentoo with PYTHON_SINGLE_TARGET="python3_5" PYTHON_TARGETS="python2_7 python3_5 python3_6":

dev-python/dulwich-0.18.5::gentoo
dev-python/pip-9.0.1-r1::gentoo
dev-python/PyQt5-5.7.1::gentoo
dev-qt/qtquickcontrols-5.7.1:5/5.7::gentoo
app-admin/pass-1.7.1::gentoo

File Notify Event causes internal files to be listed

The file notification watch for the ~/.password-store folder is triggered for the .git files, so until the module is reloaded / passwords are listed, files like .git/index and the like show up at the top

Autoscanned OTP QR code doesn't get added

Happened on macOS. It was scanned and detected. But the password file itself didn't seem to contain the new OTP QR code.

Dependabot couldn't authenticate with https://pypi.python.org/simple/

Dependabot couldn't authenticate with https://pypi.python.org/simple/.

You can provide authentication details in your Dependabot dashboard by clicking into the account menu (in the top right) and selecting 'Config variables'.

View the update logs.

ModuleNotFoundError: No module named 'PIL'

Describe the bug
Loading the module fails with a missing dependency.

Using locale: en_US (system locale)
Localization loaded: True
Object pext_module_launcher has no metadata_en_US.json file
Object pext_module_emoji has no metadata_en_US.json file
Object pext_theme_lunar has no metadata_en_US.json file
Object pext_module_emoji has no metadata_en_US.json file
WARN: Module Emoji uses old process_response signature and will not be able to receive an identifier if requested
Enumerating objects: 290, done.
Counting objects: 100% (290/290), done.
Compressing objects: 100% (165/165), done.
Total 2236 (delta 141), reused 204 (delta 82), pack-reused 1946
Running command git clone -q https://github.com/TheLastProject/pyotp /tmp/pip-install-0z2owq6w/pyotp
Running command git checkout -q 5d7bf9d10e3bdef8c93917c1f4f5ffcf799a671e
Object pext_module_launcher has no metadata_en_US.json file
Object pext_module_emoji has no metadata_en_US.json file
Object pext_module_pass has no metadata_en_US.json file
Object pext_module_pass has no metadata_en_US.json file
Password Store
No module named 'PIL'
Traceback (most recent call last):
File "/tmp/.mount_Pext-0fs3Xf9/usr/conda/lib/python3.6/site-packages/pext/**main**.py", line 1250, in load
module_import = **import**(module['metadata']['id'].replace('.', '_'), fromlist=['Module'])
File "/home/kouk/.config/pext/modules/pext_module_pass/**init**.py", line 38, in <module>
import pyscreenshot
File "/home/kouk/.config/pext/module_dependencies/pext_module_pass/pyscreenshot/**init**.py", line 4, in <module>
from pyscreenshot.childproc import childprocess_backend_version, childprocess_grab
File "/home/kouk/.config/pext/module_dependencies/pext_module_pass/pyscreenshot/childproc.py", line 4, in <module>
from pyscreenshot.imcodec import codec
File "/home/kouk/.config/pext/module_dependencies/pext_module_pass/pyscreenshot/imcodec.py", line 3, in <module>
from PIL import Image
ModuleNotFoundError: No module named 'PIL'

Desktop (please complete the following information):

• OS: Ubuntu 19.10
• Pext version 0.29-3-gb510f6f (AppImage with setuptools patch)

Additional context
As reported by @kouk, thank you!