[Pebble] Storage not isolated between apps - untrusted apps can read/write shared key-value storage

[jplexer]

Build environment: macOS
Moddable SDK version: 7.2.1
Target device: Pebble

Description
Key-value storage is not isolated between apps. An untrusted installed app can read and write storage belonging to another app by using the same path and key. This should be disallowed for untrusted (installed) apps, and only permitted for trusted system built-in apps.

Steps to Reproduce

1. Install any app that writes a value to key-value storage (e.g. path=test, key=count)
2. Install a second, separate app that reads from the same path and key
3. The second app successfully reads the value written by the first app

Expected behavior
Each app's storage should be sandboxed and inaccessible to other apps. An untrusted app should not be able to read or write another app's key-value storage entries.

Images
https://github.com/user-attachments/assets/53cf4d1f-e2d5-4f20-b3a6-c471ff508f54

Other information
The current implementation does not enforce storage isolation. Trusted system built-in apps sharing storage may be intentional in the future, but untrusted installed apps should never have cross-app storage access.

[phoddie]

Note that this report specifically refers to key-value storage. File storage is isolated through the use of app_file_name_make().

[phoddie]

@jplexer – thanks for writing this up.

localStorage, which is implemented by key-value storage, is sandboxed by using the path local-${AppInfo.uuid}. We can do something similar for key-value storage when the script provides a the path. Doing ${path}-${AppInfo.uuid} collides with localStorage when path is "local". To avoid that, I suggest ${AppInfo.uuid}-${path}.

Let me know what you think. The change is straightforward from there.

[phoddie]

I've implemented the behavior above.

In testing it, I realized that apps can still bypass the sandbox by importing embedded:storage/key-value directly. I modified the Compartment's loadHooks to prevent that by throwing an error (telling you to use device.keyValue.open()). I've also updated hellokeyvalue on Pebble Examples to use device.keyValue.open().