Differential D5394 Diff 13314 src/buffer/katesecuretextbuffer.cpp

Changeset View

Standalone View

src/buffer/katesecuretextbuffer.cpp

Context not available.
27		27
28	#include <QString>	28		#include <QString>
29	#include <QFile>	29		#include <QFile>
30	#include <QTemporaryFile>
31	#include <QSaveFile>	30		#include <QSaveFile>
32		31
33	KAUTH_HELPER_MAIN("org.kde.ktexteditor.katetextbuffer", SecureTextBuffer)	32		KAUTH_HELPER_MAIN("org.kde.ktexteditor.katetextbuffer", SecureTextBuffer)
34		33
35	ActionReply SecureTextBuffer::savefile(const QVariantMap &args)	34		ActionReply SecureTextBuffer::savefile(const QVariantMap &args)
36	{	35		{
37	const ActionMode actionMode = static_cast<ActionMode>(args[QLatin1String("actionMode")].toInt());
38	const QString targetFile = args[QLatin1String("targetFile")].toString();	36		const QString targetFile = args[QLatin1String("targetFile")].toString();
		37		const QByteArray fileData = args[QLatin1String("fileData")].toByteArray();
39	const uint ownerId = (uint) args[QLatin1String("ownerId")].toInt();	38		const uint ownerId = (uint) args[QLatin1String("ownerId")].toInt();
		39		const uint groupId = (uint) args[QLatin1String("groupId")].toInt();
40		40
41	if (actionMode == ActionMode::Prepare) {	41		if (saveFileInternal(targetFile, fileData, ownerId, groupId)) {
42		42		return ActionReply::SuccessReply();
43	const QString temporaryFile = prepareTempFileInternal(targetFile, ownerId);
44
45	if (temporaryFile.isEmpty()) {
46	return ActionReply::HelperErrorReply();
47	}
48
49	ActionReply reply;
50	reply.addData(QLatin1String("temporaryFile"), temporaryFile);
51
52	return reply;
53
54	}
55
56	if (actionMode == ActionMode::Move) {
57
58	const QString sourceFile = args[QLatin1String("sourceFile")].toString();
59	const uint groupId = (uint) args[QLatin1String("groupId")].toInt();
60
61	if (moveFileInternal(sourceFile, targetFile, ownerId, groupId)) {
62	return ActionReply::SuccessReply();
63	}
64	}	43		}
65		44
66	return ActionReply::HelperErrorReply();	45		return ActionReply::HelperErrorReply();
67	}	46		}
68		47
69	bool SecureTextBuffer::moveFileInternal(const QString &sourceFile, const QString &targetFile, const uint ownerId, const uint groupId)	48		bool SecureTextBuffer::saveFileInternal(const QString &targetFile, const QByteArray &fileData, const uint ownerId, const uint groupId)
70	{	49		{
71	const bool newFile = !QFile::exists(targetFile);	50		const bool newFile = !QFile::exists(targetFile);
72	bool atomicRenameSucceeded = false;
73		51
74	/**	52		QSaveFile saveFile(targetFile);
75	* There is no atomic rename operation publicly exposed by Qt.	53		if (!saveFile.open(QIODevice::WriteOnly)) {
76	*	54		return false;
77	* We use std::rename for UNIX and for now no-op for windows (triggers fallback).
78	*
79	* As fallback we are copying source file to destination with the help of QSaveFile
80	* to ensure targetFile is overwritten safely.
81	*/
82	#ifndef Q_OS_WIN
83	const int result = std::rename(QFile::encodeName(sourceFile).constData(), QFile::encodeName(targetFile).constData());
84	if (result == 0) {
85	syncToDisk(QFile(targetFile).handle());
86	atomicRenameSucceeded = true;
87	}	55		}
88	#else
89	atomicRenameSucceeded = false;
90	#endif
91		56
92	if (!atomicRenameSucceeded) {	57		if (saveFile.write(fileData) == -1) {
93	// as fallback copy the temporary file to the target with help of QSaveFile	58		return false;
94	QFile readFile(sourceFile);	59		}
95	QSaveFile saveFile(targetFile);	60
96	if (!readFile.open(QIODevice::ReadOnly) \|\| !saveFile.open(QIODevice::WriteOnly)) {	61		if (!saveFile.commit()) {
97	return false;	62		return false;
98	}
99	char buffer[bufferLength];
100	qint64 read = -1;
101	while ((read = readFile.read(buffer, bufferLength)) > 0) {
102	if (saveFile.write(buffer, read) == -1) {
103	return false;
104	}
105	}
106	if (read == -1 \|\| !saveFile.commit()) {
107	return false;
108	}
109	}	63		}
110		64
111	if (!newFile) {	65		if (!newFile) {
Context not available.
116	return true;	70		return true;
117	}	71		}
118		72
119	QString SecureTextBuffer::prepareTempFileInternal(const QString &targetFile, const uint ownerId)
120	{
121	QTemporaryFile tempFile(targetFile);
122	if (!tempFile.open()) {
123	return QString();
124	}
125	tempFile.setAutoRemove(false);
126	setOwner(tempFile.fileName(), ownerId, -1);
127	return tempFile.fileName();
128	}
129
130	void SecureTextBuffer::setOwner(const QString &filename, const uint ownerId, const uint groupId)	73		void SecureTextBuffer::setOwner(const QString &filename, const uint ownerId, const uint groupId)
131	{	74		{
132	#ifndef Q_OS_WIN	75		#ifndef Q_OS_WIN
Context not available.
141	// no-op for windows	84		// no-op for windows
142	#endif	85		#endif
143	}	86		}
			fvogtUnsubmitted Done This is racy: If the newly set permissions allow someone to delete the file, it can be replaced with a symlink and the chown will take effect on the symlink target, which can be literally anything -> escalation. This is not an issue for the rename call as if the file permissions allow deleting, they allow deleting for the destination file as well -> no escalation. Solution: Use fchown. fvogt: This is racy: If the newly set permissions allow someone to delete the file, it can be replaced…
			fvogtUnsubmitted Done The destructor of QTemporaryFile here tries to unlink the temporary file here, which fails if the rename was successful. fvogt: The destructor of QTemporaryFile here tries to unlink the temporary file here, which fails if…
144
145	void SecureTextBuffer::syncToDisk(const int fd)
146	{
147	#ifndef Q_OS_WIN
148	#ifdef HAVE_FDATASYNC
149	fdatasync(fd);
150	#else
151	fsync(fd);
152	#endif
153	#else
154	// no-op for windows
155	#endif
156	}
157	No newline at end of file
Context not available.