35646452898

Committed 21 Sep 2026 07:41PM UTC coverage: 79.015% (+0.02%) from 78.994%

Build # 35646452898

Build Type

push

github

Committed by

web-flow

Commit Message

.gpg-id and its signature: written staged, signed over the bytes written (#1884)

* .gpg-id and its signature: written staged, signed over the bytes written

The recipient list and its signature were the last writes of entries,
lists and signatures that opened a store path by name after the link
check: .gpg-id through QSaveFile, which resolves a link under the name at
open (from the Users dialog, a new profile, and a new folder seeded with
its parent's list), and .gpg-id.sig by gpg --detach-sign in place, with
gpg reading the list back by name to sign it. A co-writer of the store who
swapped the list between the write and the signing would have had the
user's key vouch for theirs.

GpgIdSigner::sign() takes the bytes the caller just wrote and feeds them
to gpg on stdin (UTF-8 text, as verify() requires; anything else is
refused before gpg runs), with --output in a QTemporaryDir of QtPass's
own; the signature then goes next to the list through
Util::writeFileReplacing(): a staged sibling with an opaque name, written
by its open handle, flushed to the device (Util::syncToDisk, what
QSaveFile's commit did), given the name with the operating system's
rename, so a link planted under .gpg-id.sig since the check is replaced as
an entry (on Windows a junction there fails the write instead: MoveFileEx
does not replace a directory). ImitatePass::writeGpgIdFile(),
ProfileInit::writeGpgId() and Pass::seedGpgIdFile() write the list the
same way, the first two handing the bytes on to the signing step; the
Insert and Copy staging flush to the device too.

Tests: tst_gpgidsigner pins the stdin bytes, the --output outside the
store, the signature placed and the scratch gone, a gpg that writes an
empty signature leaving the old one, bytes that are not UTF-8 refused with
gpg not run, and a link under the .sig name replaced with its target
untouched; tst_util pins writeFileReplacing (owner-only, no temporary
left, refused without replace, a link replaced as an entry; on ... (continued)

Coverage Stats

108 of 140 new or added lines in 5 files covered. (77.14%)

3 existing lines in 2 files now uncovered.

7478 of 9464 relevant lines covered (79.02%)

80.3 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

86.42

/src/nativegrep.cpp

// SPDX-FileCopyrightText: 2026 Anne Jan Brouwer
// SPDX-License-Identifier: GPL-3.0-or-later
#include "nativegrep.h"
#include "executor.h"
#include "util.h"
#include <QDir>
#include <QElapsedTimer>
#include <QPointer>
#include <QProcess>
#include <QRegularExpression>
#include <QThread>
#include <utility>

NativeGrep::NativeGrep(QObject *parent) : QObject(parent) {}

NativeGrep::~NativeGrep() {
  static constexpr int kThreadTimeoutMs = 5000;
  cancel();
  QElapsedTimer elapsed;
  elapsed.start();
  for (const Worker &w : std::as_const(m_workers)) {
    if (w.thread && w.thread->isRunning()) {
      const int remaining =
          kThreadTimeoutMs - static_cast<int>(elapsed.elapsed());
      if (remaining > 0)
        w.thread->wait(remaining);
    }
  }
}

/**
 * @brief Decrypt one .gpg file and return lines matching rx.
 */
auto NativeGrep::matchFile(const QProcessEnvironment &env,
                           const QString &gpgExe, const QString &filePath,
                           const QRegularExpression &rx,
                           const std::atomic_bool *cancel) -> QStringList {
  const QString translatedPath =
      Executor::translatePathForWsl(filePath, gpgExe);
  QString plaintext;
  // The QProcess overload is the one that takes the cancel flag; it polls
  // the flag while waiting and terminates (then kills) gpg from this thread,
  // the one that owns the process.
  QProcess gpg;
  gpg.setProcessEnvironment(env);
  const int rc =
      Executor::executeBlocking(gpg, gpgExe,
                                {"-d", "--quiet", "--yes", "--no-encrypt-to",
                                 "--batch", "--use-agent", translatedPath},
                                QString(), &plaintext, nullptr, cancel);
  if (rc != 0 || plaintext.isEmpty())
    return {};
  QStringList matches;
  for (const QString &line : plaintext.split('\n')) {
    QString candidate = line;
    if (candidate.endsWith('\r'))
      candidate.chop(1);
    const QString t = candidate.trimmed();
    if (!t.isEmpty() && candidate.contains(rx))
      matches << t;
  }
  return matches;
}

/**
 * @brief Walk the store, decrypt every .gpg file, collect matches.
 */
auto NativeGrep::scanStore(const QProcessEnvironment &env,
                           const QString &gpgExe, const QString &storeDir,
                           const QRegularExpression &rx,
                           const std::atomic_bool *cancel)
    -> QList<QPair<QString, QStringList>> {
  QList<QPair<QString, QStringList>> results;
  // Regular files only: a link or junction is not an entry, and searching
  // through one would decrypt files outside the store.
  const QStringList files =
      Util::regularFilesUnder(storeDir, QStringList() << "*.gpg");
  for (const QString &filePath : files) {
    if (QThread::currentThread()->isInterruptionRequested() ||
        (cancel != nullptr && cancel->load()))
      return {};
    const QStringList matches = matchFile(env, gpgExe, filePath, rx, cancel);
    if (!matches.isEmpty()) {
      QString entry = QDir(storeDir).relativeFilePath(filePath);
      if (entry.endsWith(QLatin1String(".gpg")))
        entry.chop(4);
      results.append({entry, matches});
    }
  }
  return results;
}

/**
 * @brief Start a search on a worker thread.
 *
 * Results are emitted on the owner's thread via QMetaObject::invokeMethod. A
 * sequence counter discards results from superseded searches; the previous
 * search is asked to stop but not waited for, since blocking the UI thread
 * while gpg decrypts would freeze the interface.
 */
void NativeGrep::search(const QString &pattern, bool caseInsensitive,
                        const QString &gpgExe, const QString &storeDir,
                        const QProcessEnvironment &env) {
  cancel();

  // Advance the sequence before any early return so in-flight workers from the
  // previous query fail the seq check and cannot publish stale results.
  const int seq = ++m_seq;

  // Use trimmed() rather than isEmpty(): a whitespace-only string is a valid
  // regex that matches every non-empty line, which is almost never intentional
  // and would decrypt the entire store.
  //
  // Both early returns post finished() via Qt::QueuedConnection so that the
  // signal is always delivered asynchronously after search() returns, matching
  // the contract of the threaded path.
  if (pattern.trimmed().isEmpty()) {
    QMetaObject::invokeMethod(
        this,
        [this, seq]() {
          if (m_seq == seq)
            emit finished({});
        },
        Qt::QueuedConnection);
    return;
  }

  const QRegularExpression rx(
      pattern, caseInsensitive ? QRegularExpression::CaseInsensitiveOption
                               : QRegularExpression::PatternOptions{});
  if (!rx.isValid()) {
    QMetaObject::invokeMethod(
        this,
        [this, seq]() {
          if (m_seq == seq)
            emit finished({});
        },
        Qt::QueuedConnection);
    return;
  }
  QPointer<NativeGrep> self(this);

  auto emitResults = [self, seq](QList<QPair<QString, QStringList>> results) {
    if (!self)
      return;
    QMetaObject::invokeMethod(
        self,
        [self, seq, results = std::move(results)]() {
          if (self && self->m_seq == seq)
            emit self->finished(results);
        },
        Qt::QueuedConnection);
  };

  auto cancelFlag = std::make_shared<std::atomic_bool>(false);
  QThread *thread = QThread::create([gpgExe, storeDir, env, rx, cancelFlag,
                                     emitResults = std::move(emitResults)]() {
    std::move(emitResults)(
        scanStore(env, gpgExe, storeDir, rx, cancelFlag.get()));
  });

  m_workers.append({thread, cancelFlag});
  connect(thread, &QThread::finished, thread, &QObject::deleteLater);
  connect(thread, &QThread::finished, this, [this, thread]() {
    m_workers.removeIf(
        [thread](const Worker &w) { return w.thread == thread; });
  });
  thread->start();
}

void NativeGrep::cancel() {
  for (const Worker &w : std::as_const(m_workers)) {
    w.cancel->store(true);
    if (w.thread && w.thread->isRunning())
      w.thread->requestInterruption();
  }
}

1	// SPDX-FileCopyrightText: 2026 Anne Jan Brouwer
2	// SPDX-License-Identifier: GPL-3.0-or-later
3	#include "nativegrep.h"
4	#include "executor.h"
5	#include "util.h"
6	#include <QDir>
7	#include <QElapsedTimer>
8	#include <QPointer>
9	#include <QProcess>
10	#include <QRegularExpression>
11	#include <QThread>
12	#include <utility>
13
14	NativeGrep::NativeGrep(QObject *parent) : QObject(parent) {}	118 ✔
15
16	NativeGrep::~NativeGrep() {	118 ✔
17	static constexpr int kThreadTimeoutMs = 5000;
18	cancel();	118 ✔
19	QElapsedTimer elapsed;	118 ✔
20	elapsed.start();	118 ✔
21	for (const Worker &w : std::as_const(m_workers)) {	118 ✔
UNCOV 22	if (w.thread && w.thread->isRunning()) {	×
23	const int remaining =
24	kThreadTimeoutMs - static_cast<int>(elapsed.elapsed());	×
25	if (remaining > 0)	×
26	w.thread->wait(remaining);	×
27	}
28	}
29	}	118 ✔
30
31	/**
32	* @brief Decrypt one .gpg file and return lines matching rx.
33	*/
34	auto NativeGrep::matchFile(const QProcessEnvironment &env,	11 ✔
35	const QString &gpgExe, const QString &filePath,
36	const QRegularExpression &rx,
37	const std::atomic_bool *cancel) -> QStringList {
38	const QString translatedPath =
39	Executor::translatePathForWsl(filePath, gpgExe);	11 ✔
40	QString plaintext;	11 ✔
41	// The QProcess overload is the one that takes the cancel flag; it polls
42	// the flag while waiting and terminates (then kills) gpg from this thread,
43	// the one that owns the process.
44	QProcess gpg;	11 ✔
45	gpg.setProcessEnvironment(env);	11 ✔
46	const int rc =
47	Executor::executeBlocking(gpg, gpgExe,	99 ✔
48	{"-d", "--quiet", "--yes", "--no-encrypt-to",
49	"--batch", "--use-agent", translatedPath},
50	QString(), &plaintext, nullptr, cancel);	11 ✔
51	if (rc != 0 \|\| plaintext.isEmpty())	11 ✔
52	return {};	4 ✔
53	QStringList matches;	7 ✔
54	for (const QString &line : plaintext.split('\n')) {	34 ✔
55	QString candidate = line;
56	if (candidate.endsWith('\r'))	20 ✔
57	candidate.chop(1);	×
58	const QString t = candidate.trimmed();
59	if (!t.isEmpty() && candidate.contains(rx))	20 ✔
60	matches << t;
61	}
62	return matches;
63	}	22 ✔
64
65	/**
66	* @brief Walk the store, decrypt every .gpg file, collect matches.
67	*/
68	auto NativeGrep::scanStore(const QProcessEnvironment &env,	7 ✔
69	const QString &gpgExe, const QString &storeDir,
70	const QRegularExpression &rx,
71	const std::atomic_bool *cancel)
72	-> QList<QPair<QString, QStringList>> {
73	QList<QPair<QString, QStringList>> results;	7 ✔
74	// Regular files only: a link or junction is not an entry, and searching
75	// through one would decrypt files outside the store.
76	const QStringList files =
77	Util::regularFilesUnder(storeDir, QStringList() << "*.gpg");	21 ✔
78	for (const QString &filePath : files) {	17 ✔
79	if (QThread::currentThread()->isInterruptionRequested() \|\|	10 ✔
80	(cancel != nullptr && cancel->load()))	10 ✔
81	return {};	×
82	const QStringList matches = matchFile(env, gpgExe, filePath, rx, cancel);	10 ✔
83	if (!matches.isEmpty()) {	10 ✔
84	QString entry = QDir(storeDir).relativeFilePath(filePath);	7 ✔
85	if (entry.endsWith(QLatin1String(".gpg")))	7 ✔
86	entry.chop(4);	7 ✔
87	results.append({entry, matches});	7 ✔
88	}
89	}
90	return results;
91	}
92
93	/**
94	* @brief Start a search on a worker thread.
95	*
96	* Results are emitted on the owner's thread via QMetaObject::invokeMethod. A
97	* sequence counter discards results from superseded searches; the previous
98	* search is asked to stop but not waited for, since blocking the UI thread
99	* while gpg decrypts would freeze the interface.
100	*/
101	void NativeGrep::search(const QString &pattern, bool caseInsensitive,	7 ✔
102	const QString &gpgExe, const QString &storeDir,
103	const QProcessEnvironment &env) {
104	cancel();	7 ✔
105
106	// Advance the sequence before any early return so in-flight workers from the
107	// previous query fail the seq check and cannot publish stale results.
108	const int seq = ++m_seq;	7 ✔
109
110	// Use trimmed() rather than isEmpty(): a whitespace-only string is a valid
111	// regex that matches every non-empty line, which is almost never intentional
112	// and would decrypt the entire store.
113	//
114	// Both early returns post finished() via Qt::QueuedConnection so that the
115	// signal is always delivered asynchronously after search() returns, matching
116	// the contract of the threaded path.
117	if (pattern.trimmed().isEmpty()) {	7 ✔
118	QMetaObject::invokeMethod(	×
119	this,
120	[this, seq]() {	×
121	if (m_seq == seq)	×
122	emit finished({});	×
123	},	×
124	Qt::QueuedConnection);
125	return;	1 ✔
126	}
127
128	const QRegularExpression rx(
129	pattern, caseInsensitive ? QRegularExpression::CaseInsensitiveOption
130	: QRegularExpression::PatternOptions{});	14 ✔
131	if (!rx.isValid()) {	7 ✔
132	QMetaObject::invokeMethod(	1 ✔
133	this,
134	[this, seq]() {	1 ✔
135	if (m_seq == seq)	1 ✔
136	emit finished({});	2 ✔
137	},	1 ✔
138	Qt::QueuedConnection);
139	return;
140	}
141	QPointer<NativeGrep> self(this);
142
143	auto emitResults = [self, seq](QList<QPair<QString, QStringList>> results) {	12 ✔
144	if (!self)	6 ✔
145	return;
146	QMetaObject::invokeMethod(	6 ✔
147	self,
148	[self, seq, results = std::move(results)]() {	18 ✔
149	if (self && self->m_seq == seq)	12 ✔
150	emit self->finished(results);	6 ✔
151	},	6 ✔
152	Qt::QueuedConnection);
153	};	6 ✔
154
155	auto cancelFlag = std::make_shared<std::atomic_bool>(false);	6 ✔
156	QThread *thread = QThread::create([gpgExe, storeDir, env, rx, cancelFlag,	12 ✔
157	emitResults = std::move(emitResults)]() {
158	std::move(emitResults)(	6 ✔
159	scanStore(env, gpgExe, storeDir, rx, cancelFlag.get()));	6 ✔
160	});	6 ✔
161
162	m_workers.append({thread, cancelFlag});	12 ✔
163	connect(thread, &QThread::finished, thread, &QObject::deleteLater);	6 ✔
164	connect(thread, &QThread::finished, this, [this, thread]() {	6 ✔
165	m_workers.removeIf(	6 ✔
166	[thread](const Worker &w) { return w.thread == thread; });	6 ✔
167	});
168	thread->start();	6 ✔
169	}	13 ✔
170
171	void NativeGrep::cancel() {	243 ✔
172	for (const Worker &w : std::as_const(m_workers)) {	244 ✔
173	w.cancel->store(true);
174	if (w.thread && w.thread->isRunning())	1 ✔
175	w.thread->requestInterruption();	1 ✔
176	}
177	}	243 ✔

IJHack / QtPass / 35646452898

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous