IJHack / QtPass / 35638958349

93%

push

github

Copy: the object read is the object judged (#1883)

* Copy: the object read is the object judged

ImitatePass::Copy() judged the source with refuseLinkedPath() and then
copyFileReplacing() opened it by name, through whatever link a co-writer
of the store had put under the name in between: the bytes of any file this
user can read, copied into the store as an entry and committed before the
re-encryption could notice they were no ciphertext.

Util::openRegularFile() opens without following (O_NOFOLLOW and fstat on
POSIX; FILE_FLAG_OPEN_REPARSE_POINT and the handle's attributes on
Windows) and accepts a regular file only: a link, a directory, a FIFO (the
open does not block on it) or a device under the name fails. The copy is
written to a temporary next to the destination through its open handle
and given the destination's name with Util::replaceFile(), as an added
entry is since the previous change; QSaveFile, which resolved a link
under the destination name at open, is not used for entries any more.
Without force nothing under the name is replaced, also nothing that
appeared since the check.

Tests: tst_util pins openRegularFile (regular file read, missing file,
directory, link although a plain QFile reads through it, FIFO; a junction
on Windows); tst_imitatepass pins the copy's bytes and staging, no
temporary left, an unforced copy keeping an existing entry and a forced
one replacing it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc

* tst_imitatepass: the copy test uses a shell fake gpg; skip it on Windows

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc

* Util::openRegularFile: tell CodeQL the descriptor is what is opened

Its check-then-use matcher flags QFile::open(fd) after fstat(fd) as a
race on the name; the name is not opened again, the descriptor is.

Co-Authored-By: Claude Opus 5 <nore... (continued)

21 of 28 new or added lines in 2 files covered. (75.0%)

7431 of 9407 relevant lines covered (78.99%)

80.52 hits per line