14

KeePass is great, I love it but after several years using it, sometimes I wish to install a plugin but I don't because I'm scared of what this plugin can really do without my consent.

The documentation about plugin development is really short. I downloaded and compiled the source code but I don't understand where is the API list of functions plugins have access to.

As said in the documentation, the PLGX format is a "not yet compiled" format

Instead of compiling your plugin to a DLL assembly, the plugin source code files can be packed into a PLGX file and KeePass will compile the plugin itself when loading it

So it should be possible to read these files. How to do this?

Let's take the example of Favicon downloader or even Password counter. These 2 plugins clearly show that they both have access to internet and my passwords. So how can I be sure they don't steal them? I mean they could just send all my information to a server and I'd never know it.

So if there is no way for me to read the PLGX files, the only way to ensure an optimum security is to develop my own plugins by myself?

7
  • 1
    The short answer to your last line is simply: yes. Code review is the only sure way to determine what code is designed to do.
    – schroeder
    May 24, 2017 at 6:19
  • We cannot answer "how trustful" because it's an opinion. We cannot answer how to read a proprietary file format, because that's not a security question.
    – schroeder
    May 24, 2017 at 6:20
  • Alright so the answer to my question is that I have to code my own plugins since these plugins' source code are not open-source. (or I analyse the KeePass source code to make my own PLGX decompiler which would be a very useful alternative...) May 24, 2017 at 7:22
  • 2
    It's a fact of software and why open source is so important in terms of security and privacy.
    – schroeder
    May 24, 2017 at 8:46
  • 2
    So thankfully KeePass is open source under GNU Licence so in about 2 hours I modified the code and compiled my own keepass.exe to extract plugins' source files in a folder. Checked the code and saw a Source Forge URL and then I realized that the code was publicly available. I just didn't see the code link that leads to the real source code instead of the PLGX file. I feel like a good developer but a dumb guy at the same time now... May 24, 2017 at 9:01

4 Answers 4

6

So in short, the only way to ensure an optimum security with the KeePass plugins is to review their codes by yourself.

The only problem is that some of them are open source, some others are not. Moreover in case of an open source plugin, you can't be sure the PLGX file you downloaded really correspond to the public available source code. Therefore either you generate the PLGX file by yourself or you review the code of the PLGX file directly.

I chose the second solution as it also allows to review the code of non-open source plugins.

I modified a tiny bit the code of KeePass 2.35 in order to achieve that. The project with installation instruction is available at https://github.com/jmevel/KeePassPluginsSourceCode

The code is quite simple and resides in the KeePass/Plugins/PlgxCsprojLoader.cs file only.

I won't provide you the keepass.exe file directly because it doesn't make sense, you have to compile it by yourself. Otherwise how would you know what this .exe file is really doing...?

Happy code review everybody!

5

A KeePass plugin can do pretty much anything that KeePass itself can, it is effectively just a .NET library. AFAIK, there is no sandboxing at all to a KeePass plugin. So unless you decompile and do a code review, you have to trust the plugin's author(s), the person that compiled the plugin, and that the plugin hasn't been tampered in transit. A plugin is pretty much capable of sending your entire password lists to the internet, or format your harddisk if you run KeePass as a user with privilege to do that.

Also, when you're reviewing a KeePass plugin's source, don't forget to also review the --plgx-build-pre: and --plgx-build-post: code. Any shell commands can be run during plugin compile/install with those options.

1
  • The OP created a version of KeePass that permits code review of plugins!
    – schroeder
    May 25, 2017 at 7:33
2

In Windows you could also create a firewall rule that prevents KEEPASS.EXE from doing outgoing communications.

It will prevent KEEPASS from checking for updates, but at least it prevents the small possibility of a rogue PLGX sending anything out once compiled into KEEPASS.

2

This was already been answered, but I've made a small Windows tool for unpacking KeePass PLGX files. No KeePass executable dependency is required. It can also integrate into Shell Context Menu and associate with PLGX files (files having .plgx extension). https://github.com/cristianst85/PlgxUnpacker.Tools

There is also a standalone library PlgxUnpacker.NET (available on NuGet). https://github.com/cristianst85/PlgxUnpacker.NET

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .