Shopkeeper App (Windows) — Cybersecurity Audit

Date: January 31, 2026
Last Updated: February 2026
Scope: shopkeeper_app (Flutter — Windows primary, Linux secondary)
Auditor: Windows App Cybersecurity Expert Analysis
Platform focus: Windows desktop (print shop kiosk / point-of-sale)

---

Executive Summary

The shopkeeper app handles sensitive operations: authentication, print job processing, customer file downloads, and printer control. This audit identifies vulnerabilities specific to a Windows desktop deployment and their remediation status.

Overall risk: 🟢 LOW — All critical, high, and medium items implemented (February 2026). Session timeout, token fallback restriction, and file integrity verification are done.

---

1. Vulnerability Summary

#	Severity	Vulnerability	Status
1	🔴 Critical	No TLS certificate pinning	✅ Done
2	🔴 Critical	PowerShell script injection risk	✅ Done
3	🔴 Critical	No HTTP request timeout	✅ Done
4	🟠 High	Downloaded filename path traversal	✅ Done
5	🟠 High	Token fallback to plaintext SharedPreferences	✅ Done
6	🟠 High	Hardcoded API URL in binary	✅ Done
7	🟠 High	Verbose logging (paths, file details)	✅ Done
8	🟡 Medium	No session timeout	✅ Done
9	🟡 Medium	External process execution (SumatraPDF, LibreOffice)	⚠️ Acceptable
10	🟢 Low	No file integrity verification	✅ Done

---

2. Detailed Findings

2.1 🔴 No TLS Certificate Pinning — ✅ Implemented

Location: lib/services/api_service.dart — previously used package:http with no custom SecurityContext.

Risk: On untrusted networks (public Wi‑Fi, compromised router), an attacker can perform a man‑in‑the‑middle (MITM) attack.

Implementation (Feb 2026): lib/services/http_client_factory.dart creates HttpClient with SecurityContext using Let's Encrypt intermediate CA certificates (lib/config/letsencrypt_certs.dart). Pinning disabled in debug mode via AppConfig.certificatePinningEnabled. See Maintenance Guide for certificate rotation.

References: OWASP Mobile Top 10 (M3 – Insecure Communication).

---

2.2 🔴 PowerShell Script Injection — ✅ Implemented

Location: lib/services/printer_service.dart lines 298–306, 348.

Issue: documentName and printerName are interpolated directly into PowerShell scripts passed to Process.run('powershell', ['-NoProfile', '-Command', psScript]):

// Line 298-299
Where-Object { \$_.Document -like "*$documentName*" -and \$_.PrinterName -eq "$printerName" }

// Line 348
Filter "Name='$printerName'"

Risk: Malicious filenames (e.g. containing " or *) or printer names could break the script or, in worst case, inject PowerShell commands. Document name comes from file.path.split(Platform.pathSeparator).last (local file path). Printer name comes from system enumeration but is user‑selected and could be tampered if the enumeration is spoofed.

Implementation (Feb 2026): _sanitizeForPowerShell() in lib/services/printer_service.dart strips unsafe characters (", ', `, $, *, ?, \, \r, \n) and limits length to 200 chars. Applied to documentName and printerName before embedding in PowerShell scripts.

---

2.3 🔴 No HTTP Request Timeout — ✅ Implemented

Location: lib/services/api_service.dart — all HTTP calls.

Implementation (Feb 2026): _requestTimeout = Duration(seconds: 30) and _downloadTimeout = Duration(seconds: 120) applied to all API requests via .timeout().

---

2.4 🟠 Downloaded Filename Path Traversal — ✅ Implemented

Location: lib/screens/dashboard_screen.dart line 543:

final tempFile = File('${tempDir.path}/batch_${fileId}_$filename');

Issue: filename comes from the API response (fileInfo['filename']). The server should sanitize, but the client should not trust it. A value like ../../../malicious.pdf could cause writes outside the temp directory.

Implementation (Feb 2026): lib/utils/filename_utils.dart provides sanitizeFilename() — strips path separators, replaces unsafe chars with _, limits to 200 chars. Used in dashboard_screen.dart for downloaded files.

---

2.5 🟠 Token Fallback to Plaintext

Location: lib/services/api_service.dart lines 46–52, 324–332.

Issue: If flutter_secure_storage.write() fails (e.g. on some Windows setups), the token is stored in SharedPreferences, which is plaintext on disk. Any process with user access can read it.

Current mitigation: Primary path uses Flutter Secure Storage (DPAPI on Windows). Fallback is documented as a workaround.

Recommendation:

• Log when fallback is used; consider refusing to store the token if secure storage fails in production.
• Add a migration that moves tokens from SharedPreferences to secure storage on next successful login.

---

2.6 🟠 Hardcoded API URL — ✅ Implemented

Location: lib/config/app_config.dart.

Implementation (Feb 2026): AppConfig.baseUrl reads from --dart-define=BASE_URL=...; falls back to production URL if empty. Build: flutter run --dart-define=BASE_URL=https://....

---

2.7 🟠 Verbose Logging — ✅ Implemented

Location: lib/services/converter_engine.dart, lib/services/printer_service.dart, lib/screens/dashboard_screen.dart, lib/main.dart, lib/services/pdf_utils.dart.

Implementation (Feb 2026): All print() and debugPrint() statements wrapped with if (kDebugMode) so verbose output is disabled in release builds.

---

2.8 🟡 No Session Timeout — ✅ Implemented

Implementation (Feb 2026): lib/services/session_service.dart tracks activity via touch(). 30 min idle triggers logout and navigation to login. Wrapped with Listener(onPointerDown: ...) for user activity. Cleared on logout and dispose.

---

2.9 🟡 External Process Execution

Location: lib/services/printer_service.dart (SumatraPDF), lib/services/converter_engine.dart (LibreOffice).

Issue: The app spawns SumatraPDF.exe and soffice.exe (LibreOffice). If an attacker can replace these binaries, they could achieve code execution.

Current mitigation: Binaries are loaded from app directory or windows/runner/bin/. Setup scripts download from official sources.

Recommendation:

• Verify binaries are from known locations (next to app exe or in a controlled bin folder).
• Optionally verify checksums of SumatraPDF/LibreOffice after download.
• Document expected install paths in setup docs.

---

2.10 🟢 No File Integrity Verification

Location: lib/screens/dashboard_screen.dart — downloaded file bytes are written directly to disk.

Issue: No hash verification. A compromised or MITM’d response could deliver malicious PDFs. Combined with conversion/printing, this could lead to parsing exploits (e.g. malformed PDF).

Recommendation:

• If the API provides a hash (e.g. SHA‑256), verify before processing.
• Consider sandboxing or limiting PDF parsing to known‑safe operations.

---

3. Implemented Protections

Item	Status	Notes
Flutter Secure Storage	✅	Token stored with DPAPI on Windows; fallback to SharedPreferences when needed
Server logout	✅	Calls POST /logout on sign out
Generic error messages	✅	getSafeErrorMessage() used on auth and critical screens
Role enforcement	✅	Rejects non‑shopkeeper users at login
HTTPS in production	✅	AppConfig.baseUrl uses https://
Temp file cleanup	✅	Temp files deleted after successful print
Backend auth	✅	Bearer token required for queue/download/confirm
Certificate pinning	✅	Intermediate CA (Let's Encrypt); http_client_factory.dart
HTTP timeout	✅	30s requests, 120s downloads
API URL config	✅	--dart-define=BASE_URL
PowerShell injection fix	✅	_sanitizeForPowerShell() in printer_service
Path traversal sanitization	✅	sanitizeFilename() in filename_utils
Verbose logging reduction	✅	kDebugMode guard on all print statements
Session timeout	✅	SessionService 30 min idle; Listener for touch
Token fallback restriction	✅	No SharedPreferences fallback in release builds
File integrity verification	✅	verifyFileIntegrity() when API sends X-Content-SHA256

---

4. Priority Remediation List

Completed (Feb 2026)

1. PowerShell injection — _sanitizeForPowerShell() in printer_service

2. HTTP timeout — 30s / 120s on all API calls

3. Filename sanitization — sanitizeFilename() in filename_utils

4. Certificate pinning — Intermediate CA via http_client_factory

5. Verbose logging — kDebugMode guard on all print statements

6. API URL configuration — --dart-define=BASE_URL

7. Session timeout — Done (30 min idle via SessionService).

8. Token fallback — Done (no SharedPreferences in production).

9. File integrity — Done (verifies when API provides X-Content-SHA256).

Lower priority

10. External binaries — Document and optionally checksum SumatraPDF/LibreOffice.

---

5. Windows‑Specific Considerations

• DPAPI: Flutter Secure Storage uses Windows Data Protection API. Tokens are encrypted per‑user. On shared PCs, each user has separate storage.
• UAC: App runs with user privileges. No admin required for printing.
• Defender / Antivirus: May flag PowerShell use or process spawning. Consider code signing and vendor whitelisting.
• Updates: Ensure Flutter and dependencies are kept up to date; run flutter pub audit regularly.

---

6. References

• OWASP Mobile Security Testing Guide
• OWASP Mobile Top 10
• project-docs/docs/development/security-audit.md (main platform audit)
• SHOPKEEPER_APP_SECURITY_STATUS.md (code vs audit comparison)

---

Report generated: January 31, 2026
Last updated: February 2026 — Critical and high items implemented.
Next review: After implementing session timeout or before major release