hrehfeld/python-keepassxc-browser

Access the KeepassXC Browser API from python. Pypi: https://pypi.org/project/keepassxc-browser/

keepassxc_browser

A Python package to interface with KeePassXC over the KeePassXC Browser API. See example.py for example usage.

python-keepassxc-browser's Issues

Minor example modification leads to nonce assertion error

Instead of failing hard in L20, I would like to wait for the database to be opened and then proceed. Therefore instead of L20-L25 I introduced

    if not c.is_database_open(connection_id):
        c.wait_for_unlock()

However, one of the subsequent calls c.associate or c.get_login (I omit the set_login part) fails with

assert response_nonce == expected_nonce
AssertionError

indicating that something in the nonce calculation went south. When I execute the script over and over again, sometimes the script even succeeds (but not very often).

Since I am not firm with the protocol I am asking for help to fix this as I have no clue where to start looking.

Best regards

locking database causes a assertion error

When locking a database, the function check_nonces is triggered in protocol.py. Because no nonce is returned when locking a database, the framework throws an assertion error.

To recreate, use the framework to lock a database.

Create test suite

Please add API documentation

One of the important things for packages which should be used by others :-)

Get notified when database is unlocked

Please add a way to wait for (or to get notified when) the database is unlocked. I could do this with busy polling, but I think there could be a more elegant solution.

[BUG] Not possible to update an existing entry

When you pass the optional parameter entry_id to Connection.set_login, in order to update an already existing database entry, it will instead create a new one. It seems that this param does in fact not have any influence on the database entry, as the correct property is called uuid. By renaming entry_id into uuid in the mentioned function, updating an existing entry works as expected.

https://github.com/hrehfeld/python-keepassxc-browser/blob/master/keepassxc_browser/protocol.py#L254-L266

Make socket path configurable

Apparently, Keepass has changed the default socket path to org.keepassxc.KeePassXC.BrowserServer since the latest release. This wouldn't be a problem if the socket path was configurable, which it isn't.

Using Winsock Class in a 0BSD licensed project

Hallo @hrehfeld,

thanks for this project.
I'd like to use this code https://github.com/hrehfeld/python-keepassxc-browser/blob/master/keepassxc_browser/connection_win.py in this modified form

class WinSock:
    """ A basic socket wrapper for Windows named pipes """

    def __init__(self, desired_access, creation_disposition, share_mode=0,
                 security_attributes=None, flags_and_attributes=0, input_nullok=None):
        self.desired_access = desired_access
        self.creation_disposition = creation_disposition
        self.share_mode = share_mode
        self.security_attributes = security_attributes
        self.flags_and_attributes = flags_and_attributes
        self.input_nullok = input_nullok
        self.handle = None

    def connect(self, address):
        try:
            self.handle = win32file.CreateFile(
                r'\\.\pipe\%s' % address,
                self.desired_access,
                self.share_mode,
                self.security_attributes,
                self.creation_disposition,
                self.flags_and_attributes,
                self.input_nullok
            )
        except Exception as e:
            raise Exception(
                "Could not connect to pipe {addr}".format(addr=address), e
            )

    def close(self):
        if self.handle:
            self.handle.close()

    def sendall(self, message):
        win32file.WriteFile(self.handle, message)

    def recv(self, buff_size):
        response_code, data = win32file.ReadFile(self.handle, buff_size)
        return data

and publish it together with the rest of the project under Zero Clause BSD License (0BSD) https://opensource.org/licenses/0BSD

Would be very nice if you can give me your OK for that little piece of code. Of course I can mention you in the comments in any form you like. Just tell me what I should add to give appropriate credits to you.

Not up to date on pypi

There are few hotfixes including socket name, and release that contains them never happened on pypi.

Setting entry title

Is it possible to set entry title?
Seems like it is the 'id' field of set-login

{
"action": "set-login",
"url": "",
"submitUrl": "",
"id": "testclient",
"nonce": "tZvLrBzkQ9GxXq9PvKJj4iAnfPT0VZ3Q",
"login": "user1",
"password": "passwd1",
"group": "",
"groupUuid": "",
"uuid": ""
}

`get_database_hash` throws error

>>> c.get_database_hash(id)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.7/site-packages/keepassxc_browser/protocol.py", line 198, in get_database_hash
    resp_message = self.send_encrypted_command(identity, command)
  File "/usr/lib/python3.7/site-packages/keepassxc_browser/protocol.py", line 172, in send_encrypted_command
    resp = self.send_command(identity, command, nonce, next_nonce)
  File "/usr/lib/python3.7/site-packages/keepassxc_browser/protocol.py", line 166, in send_command
    raise ProtocolError(resp['error'])
keepassxc_browser.protocol.ProtocolError: Cannot decrypt message

The database is open and I have a valid identification.

Originally posted in #5 (comment)

Black formatting on github fails.

On my machine:

$ black -S --check keepassxc_browser setup.py example.py
All done! ✨ 🍰 ✨
7 files would be left unchanged.

with black, 22.1.0

Not able to retrieve get-logins

Currently script works with saving logins, but not retrieving them.
Not sure if it's anyhow related to encryption message mechanic. Essentially, it gives back "No logins found"
I pass matching URL. I tried to include submitURL too, but it still says no logins found.

Platform: Darwin
Python 3.7.5
Installed github version using setup.py

Python module and commandline client

Hi,

this is more or less what I'm looking for. Why not name this project python-keepassxc and provide a python module and a command line client.

I would like to use that protocol to query passwords on the command line, e.g. to get the password for my backup job. So I have more or less in the end

keepassxc-query --url 'sftp:mars:/backup'

and then I'm asked in keepassxc if the command line client is allowed to retrieve the password.

Test if database is open

I use a variation of the test.py script to retrieve some passwords. But when the database is closed, it simply throws a generic keepassxc_browser.protocol.ProtocolError: Database not opened somewhere in the code.

I'd like to have the ability to cleanly check if the database is open before starting to retrieve passwords (ideally without requiring identification).