Fix out-of-bounds writing to browser messages

[varjolintu]

Adds safeguards when encrypting or decrypting messages for browser integration / native messaging.

Socket/pipes are transferring base64 encoded messages that are always larger than the actual message. The socket buffer must remain with 1MB (TODO).

Both encrypt and decrypt now checks if the message, public key and nonce lenghts are valid. For encryption, the size of the buffer must be size+16 (this is what crypto_box_easy() requires). For decryption, the base64 decoded buffer holds that extra 16 bytes, and the buffer for decrypted data is added with that amount.

Note that this change does not handle possible fragmented messages.

Testing strategy

Automatic tests added for situations where key and nonce lengths are not valid. Modified the encrypt/decrypt functions to take the max length as a parameter, so proper tests can be constructed. Tested the limits by reducing the max length of the message.

Type of change

• ✅ Bug fix (non-breaking change that fixes an issue)

[codecov]

Codecov Report

❌ Patch coverage is 94.36620% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 63.18%. Comparing base (84658ad) to head (148440b).

Files with missing lines	Patch %	Lines
src/browser/BrowserHost.cpp	0.00%	2 Missing ⚠️
src/proxy/NativeMessagingProxy.cpp	0.00%	2 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #13679      +/-   ##
===========================================
+ Coverage    63.14%   63.18%   +0.04%     
===========================================
  Files          388      388              
  Lines        41119    41157      +38     
===========================================
+ Hits         25963    26005      +42     
+ Misses       15156    15152       -4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

🔵 Needs a closer look

The changes affect cryptographic buffer sizing and messaging boundaries, warranting final human review.

Suppressed comments (2)

src/browser/BrowserMessageBuilder.cpp:33

• This hardcodes the 16-byte MAC overhead even though the sodium API exposes crypto_box_MACBYTES (and the previous implementation used it). Keeping a separate literal can make the allocation and output length diverge from crypto_box_easy() if the implementation constant changes; derive this constant from crypto_box_MACBYTES instead.

#define EXTRA_BYTES 16 // For crypto_box_easy()

tests/TestBrowser.cpp:140

• Succesful is misspelled in this newly added test comment; please use Successful.

    // Succesful decryption

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Lite