40501301411

Committed 27 Oct 2026 12:07PM UTC coverage: 92.583% (+0.02%) from 92.562%

Build # 40501301411

Build Type

push

github

Committed by

web-flow

Commit Message

Keep git inside the store and new files private, as pass does (#2057)

* Keep git inside the store and new files private, as pass does

Two things password-store does at its start that QtPass did not:

- GIT_CEILING_DIRECTORIES stops git at the store's parent, so a store
  that is not a repository itself but lies inside one (a dotfiles
  repository in the home folder) is not committed and pushed there. Set
  in Pass's environment and in QtPass's own, which the blocking git
  calls inherit; the real parent when the store root is a link, since
  git climbs from the real path. Passed to WSL with /p.
- The GIT_DIR family is cleared at startup, so an inherited GIT_DIR or
  GIT_WORK_TREE cannot send QtPass's commits elsewhere.
- umask 077, or PASSWORD_STORE_UMASK, at startup. Entries were owner-only
  already; folders in the store and git's files under .git were not.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

* Settings: opt in to a Git repository above the store

A store kept inside a larger repository on purpose stopped syncing with
the ceiling. Settings > Git > "Use a Git repository in a folder above
the store" (gitUseParentRepository, off by default as in pass) drops
QtPass's ceiling and puts back whatever GIT_CEILING_DIRECTORIES QtPass
was started with. Upgrade note in the CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

* passUmask: take the value as it is, no trailing newline either

A blank around PASSWORD_STORE_UMASK made it valid after trimming; bash's
umask, which pass hands the value to, rejects it, so QtPass now falls
back to 077 for it. The test then showed ^...$ also accepting "022\n"
($ matches before a final newline): anchoredPattern() instead.

Co-Authored-B... (continued)

Coverage Stats

78 of 81 new or added lines in 13 files covered. (96.3%)

3 existing lines in 2 files now uncovered.

9374 of 10125 relevant lines covered (92.58%)

201.08 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

94.64

/src/util.cpp

// SPDX-FileCopyrightText: 2014 Anne Jan Brouwer
// SPDX-License-Identifier: GPL-3.0-or-later

#include "util.h"
#include "appsettings.h"
#include "executor.h"
#include <QCoreApplication>
#include <QDebug>
#include <QDir>
#include <QFile>
#include <QFileDevice>
#include <QFileInfo>
#include <QHash>
#include <QRegularExpression>
#include <QRegularExpressionMatchIterator>
#include <QStandardPaths>
#include <QTemporaryFile>
#include <QUrl>

#include <optional>

#ifdef Q_OS_WIN
#include <fcntl.h>
#include <io.h>
#include <windows.h>
#else
#include <cerrno>
#include <cstdio>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/time.h>
#include <unistd.h>
#endif

#include "qtpasslogging.h"

QProcessEnvironment Util::_env;
bool Util::_envInitialised = false;

// macOS and Windows: append the usual GPG install directories to PATH.
void Util::initialiseEnvironment() {
  if (!_envInitialised) {
    _env = QProcessEnvironment::systemEnvironment();
#ifdef __APPLE__
    QString path = _env.value("PATH");
    if (!path.contains("/usr/local/MacGPG2/bin") &&
        QDir("/usr/local/MacGPG2/bin").exists())
      path += ":/usr/local/MacGPG2/bin";
    if (!path.contains("/usr/local/bin"))
      path += ":/usr/local/bin";
    _env.insert("PATH", path);
#endif
#ifdef Q_OS_WIN
    QString path = _env.value("PATH");
    if (!path.contains("C:\\Program Files\\WinGPG\\x86") &&
        QDir("C:\\Program Files\\WinGPG\\x86").exists())
      path += ";C:\\Program Files\\WinGPG\\x86";
    if (!path.contains("C:\\Program Files\\GnuPG\\bin") &&
        QDir("C:\\Program Files\\GnuPG\\bin").exists())
      path += ";C:\\Program Files\\GnuPG\\bin";
    _env.insert("PATH", path);
#endif
    qCDebug(lcQtPass) << _env.value("PATH");
    _envInitialised = true;
  }
}

auto Util::findPasswordStore() -> QString {
  QString path;
  initialiseEnvironment();
  if (_env.contains("PASSWORD_STORE_DIR")) {
    path = Util::expandTilde(_env.value("PASSWORD_STORE_DIR"));
  } else {
#ifdef Q_OS_WIN
    path = QDir(QDir::homePath()).filePath("password-store");
#else
    path = QDir(QDir::homePath()).filePath(".password-store");
#endif
  }
  return Util::normalizeFolderPath(QDir::cleanPath(path));
}

auto Util::expandTilde(const QString &path) -> QString {
  if (path == QLatin1String("~")) {
    return QDir::homePath();
  }
  if (path.startsWith(QLatin1String("~/"))) {
    return QDir::homePath() + path.mid(1);
  }
  return path;
}

auto Util::normalizeFolderPath(const QString &path) -> QString {
  QString normalizedPath = path;
  if (!normalizedPath.endsWith('/')) {
    normalizedPath += '/';
  }
  return normalizedPath;
}

void Util::applyPassProcessDefaults() {
  // pass unsets these before it runs git: a GIT_DIR inherited from the
  // environment (QtPass started from a git hook, or an IDE terminal) would
  // send every commit and push to that repository instead of the store.
  for (const char *variable :
       {"GIT_DIR", "GIT_WORK_TREE", "GIT_NAMESPACE", "GIT_INDEX_FILE",
        "GIT_INDEX_VERSION", "GIT_OBJECT_DIRECTORY", "GIT_COMMON_DIR"}) {
    qunsetenv(variable);
  }
  Executor::setChildUmask(
      passUmask(qEnvironmentVariable("PASSWORD_STORE_UMASK")));
}

auto Util::passUmask(const QString &value) -> int {
  // Taken as it is, as bash's umask builtin (which pass hands it to) takes
  // it: " 022" is no umask there either. pass then keeps the session's;
  // QtPass falls back to 077.
  // anchoredPattern(), not ^...$: $ also matches before a final newline.
  static const QRegularExpression octal(
      QRegularExpression::anchoredPattern(QStringLiteral("[0-7]{1,4}")));
  if (!octal.match(value).hasMatch()) {
    return 077;
  }
  return value.toInt(nullptr, 8);
}

auto Util::gitCeiling(const QString &store) -> QString {
  if (store.isEmpty()) {
    return {};
  }
  QString path = QFileInfo(store).canonicalFilePath();
  if (path.isEmpty()) {
    path = QDir::cleanPath(QDir(store).absolutePath());
  }
  return QFileInfo(path).absolutePath();
}

auto Util::mkpathForStore(const QString &path) -> bool {
  const QString clean = QDir::cleanPath(QDir(path).absolutePath());
  if (QFileInfo(clean).isDir()) {
    return true;
  }
  const QString parent = QFileInfo(clean).absolutePath();
  if (parent != clean && !mkpathForStore(parent)) {
    return false;
  }
#ifdef Q_OS_UNIX
  // The store's umask, as git and gpg get it: a store shared with a group
  // (PASSWORD_STORE_UMASK=007) gets group folders, the default owner-only.
  const int umask = Executor::childUmask() >= 0 ? Executor::childUmask() : 077;
  QFile::Permissions permissions;
  const QFile::Permission bits[] = {
      QFile::ReadOwner, QFile::WriteOwner, QFile::ExeOwner,
      QFile::ReadGroup, QFile::WriteGroup, QFile::ExeGroup,
      QFile::ReadOther, QFile::WriteOther, QFile::ExeOther};
  for (int i = 0; i < 9; ++i) {
    if ((umask & (0400 >> i)) == 0) {
      permissions |= bits[i];
    }
  }
  // mkdir() still takes QtPass's own umask off (a session's 022 would drop
  // the group's write bit); set the mode exactly afterwards. That only ever
  // widens it to what was asked, never past.
  const bool made = QDir().mkdir(clean, permissions) &&
                    QFile::setPermissions(clean, permissions);
#else
  // Windows: permissions here would become an ACL of their own, replacing
  // the inherited one; the folder takes its parent's, as before.
  const bool made = QDir().mkdir(clean);
#endif
  return made || QFileInfo(clean).isDir();
}

auto Util::findBinaryInPath(const QString &binary) -> QString {
  if (binary.isEmpty()) {
    return {};
  }

  initialiseEnvironment();

  const QStringList dirs =
      _env.value(QStringLiteral("PATH"))
          .split(QDir::listSeparator(), Qt::SkipEmptyParts);
  QString ret;
  if (QDir::fromNativeSeparators(binary).contains(u'/')) {
    // An explicit path is not a PATH search: an absolute path is checked
    // as-is, a relative one is resolved against the PATH directories. The
    // directory-list overload refuses such names, so handle them here.
    if (QDir::isAbsolutePath(binary)) {
      ret = QStandardPaths::findExecutable(binary);
    } else if (!dirs.isEmpty()) {
      ret = QStandardPaths::findExecutable(binary, dirs);
    }
  } else {
    ret = findBinaryInPath(binary, dirs);
  }
#ifdef Q_OS_WIN
  if (ret.isEmpty()) {
    // Cache per-binary WSL lookup result — the wsl --version probe is a
    // blocking subprocess that can run several times per session for
    // missing binaries; once decided, the answer doesn't change at runtime.
    static QHash<QString, QString> wslBinaryCache;
    const bool hasWhitespace =
        std::any_of(binary.cbegin(), binary.cend(),
                    [](const QChar ch) { return ch.isSpace(); });
    if (!hasWhitespace) {
      auto cached = wslBinaryCache.constFind(binary);
      if (cached != wslBinaryCache.constEnd()) {
        ret = cached.value();
      } else {
        QString wslCommand = QStringLiteral("wsl ") + binary;
        qCDebug(lcQtPass)
            << "Util::findBinaryInPath(): falling back to WSL for binary"
            << binary;
        QString out, err;
        QString cachedResult;
        if (Executor::executeBlocking(wslCommand, {"--version"}, &out, &err) ==
                0 &&
            !out.isEmpty() && err.isEmpty()) {
          qCDebug(lcQtPass)
              << "Util::findBinaryInPath(): using WSL binary" << wslCommand;
          cachedResult = wslCommand;
        }
        wslBinaryCache.insert(binary, cachedResult);
        ret = cachedResult;
      }
    }
  }
#endif

  return ret;
}

// Bare names only: QStandardPaths::findExecutable() returns an absolute binary
// without consulting searchPaths, and a relative one with ".." could escape
// them.
auto Util::findBinaryInPath(const QString &binary,
                            const QStringList &searchPaths) -> QString {
  if (binary.isEmpty() || QDir::fromNativeSeparators(binary).contains(u'/')) {
    return {};
  }
  QStringList dirs;
  dirs.reserve(searchPaths.size());
  for (const QString &dir : searchPaths) {
    if (!dir.isEmpty()) {
      dirs.append(dir);
    }
  }
  if (dirs.isEmpty()) {
    // QStandardPaths::findExecutable() treats an empty list as "use PATH".
    return {};
  }
  return QStandardPaths::findExecutable(binary, dirs);
}

auto Util::configIsValid(const AppSettings &s) -> bool {
  const QString configFilePath = QDir(s.passStore).filePath(".gpg-id");
  if (!QFile(configFilePath).exists()) {
    return false;
  }

  const QString executable = s.usePass ? s.passExecutable : s.gpgExecutable;

  if (const auto wsl = Executor::parseWslCommand(executable)) {
    // Probe WSL once per session — availability doesn't change at runtime
    // and the executeBlocking call is a blocking subprocess.
    static const bool wslAvailable = [&wsl]() {
      QString out;
      QString err;
      return Executor::executeBlocking(wsl->launcher,
                                       {QStringLiteral("--version")}, &out,
                                       &err) == 0 &&
             !out.isEmpty() && err.isEmpty();
    }();
    if (wslAvailable) {
      return true;
    }
  }
  return QFile(executable).exists();
}

auto Util::endsWithGpg() -> const QRegularExpression & {
  static const QRegularExpression expr{R"(\.gpg$)"};
  return expr;
}

// Stops at whitespace, quotes and brackets so a URL on its own line keeps no
// line break. file:/// is excluded on purpose (local, not network); the test
// relies on that.
auto Util::protocolRegex() -> const QRegularExpression & {
  static const QRegularExpression regex{
      R"(((?:https?|ftp|ssh|sftp|ftps|webdav|webdavs)://[^"\s<>\)\]\[]+))"};
  return regex;
}

auto Util::isLaunchableWebUrl(const QString &value) -> bool {
  const QString trimmed = value.trimmed();
  if (trimmed.isEmpty()) {
    return false;
  }
  // Reject control characters first, before QUrl normalisation can hide a
  // CR/LF/NUL injection into the OS URL handler.
  for (const QChar &c : trimmed) {
    if (c == QLatin1Char('\r') || c == QLatin1Char('\n') ||
        c == QChar(QChar::Null)) {
      return false;
    }
  }
  const QUrl url(trimmed, QUrl::StrictMode);
  if (!url.isValid()) {
    return false;
  }
  const QString scheme = url.scheme().toLower();
  if (scheme != QLatin1String("http") && scheme != QLatin1String("https")) {
    return false;
  }
  if (url.host().isEmpty()) {
    return false;
  }
  // Embedded userinfo (user:pass@host) would leak into browser history.
  if (!url.userName().isEmpty() || !url.password().isEmpty()) {
    return false;
  }
  return true;
}

auto Util::linkifyUrls(const QString &text, bool *linked) -> QString {
  if (linked != nullptr) {
    *linked = false;
  }
  QString html;
  html.reserve(text.size());
  qsizetype lastIndex = 0;
  QRegularExpressionMatchIterator it = protocolRegex().globalMatch(text);
  while (it.hasNext()) {
    const QRegularExpressionMatch match = it.next();
    const QString url = match.captured(0);
    if (!isLaunchableWebUrl(url)) {
      // Not a web URL (or it carries credentials): leave it in the escaped
      // plain-text run instead of making it clickable.
      continue;
    }
    const qsizetype start = match.capturedStart(0);
    html += text.mid(lastIndex, start - lastIndex).toHtmlEscaped();
    const QString escapedUrl = url.toHtmlEscaped();
    html += QStringLiteral("<a href=\"%1\">%1</a>").arg(escapedUrl);
    lastIndex = match.capturedEnd(0);
    if (linked != nullptr) {
      *linked = true;
    }
  }
  html += text.mid(lastIndex).toHtmlEscaped();
  return html;
}

auto Util::newLinesRegex() -> const QRegularExpression & {
  static const QRegularExpression regex{"[\r\n]"};
  return regex;
}

// No content heuristics: a line rejected here is erased the next time .gpg-id
// is rewritten. A leading `-` is refused because the recipients also go
// positionally to `gpg --list-keys`, where it would parse as an option.
auto Util::isValidKeyId(const QString &keyId) -> bool {
  return !keyId.isEmpty() && !keyId.startsWith('-');
}

namespace {
/**
 * @brief Walk @p dir's real, visible directories in sorted pre-order and hand
 * every entry to @p visit before any recursion; a directory is entered only
 * when @p visit returns true for it.
 */
template <typename Visit> void walkStore(const QString &dir, Visit visit) {
  // Absolute, so the results are whatever the caller's cwd; not canonical,
  // so a linked root keeps the name it was configured under.
  QStringList pending{QDir(QDir::cleanPath(dir)).absolutePath()};
  while (!pending.isEmpty()) {
    const QDir current(pending.takeLast());
    // Every entry once, links and hidden entries included, so the decision
    // what to do with each is taken here, before any recursion. QDir::System
    // keeps dangling links in the listing.
    const QFileInfoList entries =
        current.entryInfoList(QDir::Dirs | QDir::Files | QDir::Hidden |
                                  QDir::System | QDir::NoDotAndDotDot,
                              QDir::Name);
    QStringList subdirs;
    for (const QFileInfo &entry : entries) {
      if (visit(entry)) {
        subdirs << entry.filePath();
      }
    }
    // Pushed last-to-first so the next one taken is the first by name.
    for (auto it = subdirs.crbegin(); it != subdirs.crend(); ++it) {
      pending << *it;
    }
  }
}

/// A symlink or an NTFS junction: never entered, never listed.
auto isLink(const QFileInfo &entry) -> bool {
  return entry.isSymLink() || entry.isJunction();
}

/// Hidden by attribute, or by the dot convention on every platform: Qt 6.11
/// on macOS answers isHidden() from the UF_HIDDEN flag alone once an entry
/// was lstat()ed (qfilesystemengine_unix.cpp marks the attribute known there
/// without the dot check), and Windows does not consider .stversions hidden
/// at all.
auto isHiddenEntry(const QFileInfo &entry) -> bool {
  return entry.isHidden() || entry.fileName().startsWith(QLatin1Char('.'));
}

/// A real directory that is part of the store: .git, .stversions,
/// .Trash-1000 are not, as with QDirIterator without QDir::Hidden.
auto isStoreDirectory(const QFileInfo &entry) -> bool {
  return !isLink(entry) && entry.isDir() && !isHiddenEntry(entry);
}
} // namespace

auto Util::regularFilesUnder(const QString &dir, const QStringList &nameFilters,
                             QStringList *skipped, bool hiddenFiles)
    -> QStringList {
  QStringList files;
  walkStore(dir, [&](const QFileInfo &entry) {
    if (isStoreDirectory(entry)) {
      return true;
    }
    const bool named = QDir::match(nameFilters, entry.fileName());
    if (isLink(entry) || (!entry.isDir() && !entry.isFile())) {
      // A linked directory hides everything behind it; a linked file, or a
      // FIFO, socket or device, is only of interest under a name the caller
      // asked for.
      if (skipped != nullptr && (entry.isDir() || named)) {
        qCWarning(lcQtPass) << "Skipping" << entry.filePath()
                            << ": not a regular file or directory";
        *skipped << entry.filePath();
      }
      return false;
    }
    if (entry.isFile() && named && (hiddenFiles || !isHiddenEntry(entry))) {
      files << entry.filePath();
    }
    return false;
  });
  return files;
}

auto Util::directoriesUnder(const QString &dir) -> QStringList {
  QStringList dirs;
  walkStore(dir, [&](const QFileInfo &entry) {
    if (!isStoreDirectory(entry)) {
      return false;
    }
    dirs << entry.filePath();
    return true;
  });
  return dirs;
}

auto Util::isLinkedFolder(const QString &path) -> bool {
  return isLink(QFileInfo(QDir::cleanPath(path)));
}

auto Util::isUnderLink(const QString &path, const QString &storeRoot,
                       bool includeSelf) -> bool {
  // "C:/Store" and "c:/store" are one directory on Windows; a path spelled
  // the other way must not skip the walk (as in Pass::getGpgIdPath).
#ifdef Q_OS_WIN
  constexpr auto cs = Qt::CaseInsensitive;
#else
  constexpr auto cs = Qt::CaseSensitive;
#endif
  const QString root = QDir::cleanPath(storeRoot);
  // A root of "/" or "C:/" already ends in the separator.
  const QString prefix =
      root.endsWith(QLatin1Char('/')) ? root : root + QLatin1Char('/');
  const auto isRoot = [&](const QString &p) {
    return p.compare(root, cs) == 0;
  };
  QString current = QDir::cleanPath(path);
  if (!current.startsWith(prefix, cs)) {
    // Not under the store as named: only the entry itself can be judged.
    return includeSelf && !isRoot(current) && isLinkedFolder(current);
  }
  if (!includeSelf) {
    current = QFileInfo(current).path();
  }
  for (; !isRoot(current) && current.startsWith(prefix, cs);
       current = QFileInfo(current).path()) {
    if (isLinkedFolder(current)) {
      return true;
    }
  }
  return false;
}

#ifndef Q_OS_WIN
namespace {

/// The filesystem cannot make hard links at all (FAT/exFAT refuse with
/// EPERM, some FUSE filesystems with ENOTSUP or ENOSYS).
auto hasNoHardLinks(int error) -> bool {
  return error == EPERM || error == ENOTSUP || error == EOPNOTSUPP ||
         error == ENOSYS;
}

/// rename() that fails with EEXIST instead of replacing, where the platform
/// has one; nothing when neither the platform nor the filesystem does.
auto renameExclusive(const QByteArray &source, const QByteArray &target)
    -> std::optional<bool> {
#if defined(__GLIBC__) &&                                                      \
    (__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 28))
  if (::renameat2(AT_FDCWD, source.constData(), AT_FDCWD, target.constData(),
                  RENAME_NOREPLACE) == 0) {
    return true;
  }
  if (errno == EINVAL || errno == ENOSYS || hasNoHardLinks(errno)) {
    return std::nullopt;
  }
  return false;
#elif defined(Q_OS_MACOS)
  if (::renamex_np(source.constData(), target.constData(), RENAME_EXCL) == 0) {
    return true;
  }
  if (errno == EINVAL || errno == ENOTSUP) {
    return std::nullopt;
  }
  return false;
#else
  Q_UNUSED(source);
  Q_UNUSED(target);
  return std::nullopt;
#endif
}

/**
 * @brief Gives @p source the name @p target unless something already has it.
 *
 * A hard link is the one way every POSIX system can do that in one step:
 * linkat() fails with EEXIST rather than replacing. Where the filesystem has
 * no hard links, an exclusive rename does it; where that is missing too, the
 * name is checked and then renamed, which leaves a short window for another
 * writer to create it in between.
 */
auto placeWithoutReplacing(const QByteArray &source, const QByteArray &target)
    -> bool {
  // linkat() without AT_SYMLINK_FOLLOW follows nothing; link() would, on
  // macOS and the BSDs, hard-link whatever a symlink planted under the
  // source's name points at.
  if (::linkat(AT_FDCWD, source.constData(), AT_FDCWD, target.constData(), 0) ==
      0) {
    ::unlink(source.constData());
    return true;
  }
  if (!hasNoHardLinks(errno)) {
    return false;
  }
  if (const std::optional<bool> renamed = renameExclusive(source, target)) {
    return *renamed;
  }
  struct stat st{};
  if (::lstat(target.constData(), &st) == 0 || errno != ENOENT) {
    errno = EEXIST;
    return false;
  }
  return ::rename(source.constData(), target.constData()) == 0;
}

} // namespace
#endif

auto Util::replaceFile(const QString &from, const QString &to, bool replace)
    -> bool {
#ifdef Q_OS_WIN
  const std::wstring source =
      QDir::toNativeSeparators(QFileInfo(from).absoluteFilePath())
          .toStdWString();
  const std::wstring target =
      QDir::toNativeSeparators(QFileInfo(to).absoluteFilePath()).toStdWString();
  // WRITE_THROUGH: the new entry is on the device when this returns.
  return MoveFileExW(source.c_str(), target.c_str(),
                     (replace ? MOVEFILE_REPLACE_EXISTING : 0) |
                         MOVEFILE_WRITE_THROUGH) != 0;
#else
  const QByteArray source = QFile::encodeName(from);
  const QByteArray target = QFile::encodeName(to);
  if (replace) {
    if (::rename(source.constData(), target.constData()) != 0) {
      return false;
    }
  } else {
    if (!placeWithoutReplacing(source, target)) {
      return false;
    }
  }
  // Sync the directory entry so a crash does not lose the new name. Best
  // effort: the bytes are already synced, and some network filesystems
  // cannot sync a directory.
  const int dir = ::open(QFile::encodeName(QFileInfo(to).path()).constData(),
                         O_RDONLY | O_DIRECTORY | O_CLOEXEC);
  if (dir >= 0) {
    int rc;
    do {
      rc = ::fsync(dir);
    } while (rc != 0 && errno == EINTR);
    ::close(dir);
  }
  return true;
#endif
}

auto Util::openRegularFile(const QString &path, QFile &file) -> bool {
#ifdef Q_OS_WIN
  // FILE_FLAG_OPEN_REPARSE_POINT opens a symbolic link or junction itself
  // rather than its target, so the handle's attributes say what the name
  // was at the moment of the open.
  const std::wstring native =
      QDir::toNativeSeparators(QFileInfo(path).absoluteFilePath())
          .toStdWString();
  HANDLE handle = CreateFileW(
      native.c_str(), GENERIC_READ,
      FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr,
      OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
  if (handle == INVALID_HANDLE_VALUE) {
    return false;
  }
  BY_HANDLE_FILE_INFORMATION info{};
  if (!GetFileInformationByHandle(handle, &info) ||
      (info.dwFileAttributes &
       (FILE_ATTRIBUTE_REPARSE_POINT | FILE_ATTRIBUTE_DIRECTORY |
        FILE_ATTRIBUTE_DEVICE)) != 0 ||
      GetFileType(handle) != FILE_TYPE_DISK) {
    CloseHandle(handle);
    return false;
  }
  const int fd = _open_osfhandle(reinterpret_cast<intptr_t>(handle),
                                 _O_RDONLY | _O_BINARY);
  if (fd < 0) {
    CloseHandle(handle);
    return false;
  }
  if (!file.open(fd, QIODevice::ReadOnly, QFileDevice::AutoCloseHandle)) {
    _close(fd);
    return false;
  }
  return true;
#else
  // O_NOFOLLOW fails with ELOOP on a symbolic link; O_NONBLOCK keeps a FIFO
  // from blocking the open until fstat() can refuse it.
  const int fd = ::open(QFile::encodeName(path).constData(),
                        O_RDONLY | O_NOFOLLOW | O_NONBLOCK | O_CLOEXEC);
  if (fd < 0) {
    return false;
  }
  struct stat st{};
  if (::fstat(fd, &st) != 0 || !S_ISREG(st.st_mode)) {
    ::close(fd);
    return false;
  }
  // The descriptor, not the name, is what QFile opens here: the object
  // fstat() judged is the object read. CodeQL's check-then-use pattern
  // matcher sees an open after a check and cannot tell.
  if (!file.open(fd, QIODevice::ReadOnly, // codeql[cpp/toctou-race-condition]
                 QFileDevice::AutoCloseHandle)) {
    ::close(fd);
    return false;
  }
  return true;
#endif
}

auto Util::syncToDisk(QFileDevice &file) -> bool {
  if (!file.flush()) {
    return false;
  }
#ifdef Q_OS_WIN
  const HANDLE handle = reinterpret_cast<HANDLE>(_get_osfhandle(file.handle()));
  return handle != INVALID_HANDLE_VALUE && FlushFileBuffers(handle) != 0;
#else
  return ::fsync(file.handle()) == 0;
#endif
}

namespace {

/**
 * @brief What tells one file object from another on its filesystem: device
 * and inode on POSIX, volume serial and file index on Windows.
 */
struct FileIdentity {
  quint64 volume = 0;
  quint64 index = 0;
  bool known = false;
};

auto operator==(const FileIdentity &a, const FileIdentity &b) -> bool {
  return a.known && b.known && a.volume == b.volume && a.index == b.index;
}

/// The identity of the object @p file is open on, or an unknown one.
auto identityOf(const QFileDevice &file) -> FileIdentity {
#ifdef Q_OS_WIN
  const HANDLE handle = reinterpret_cast<HANDLE>(_get_osfhandle(file.handle()));
  BY_HANDLE_FILE_INFORMATION info;
  if (handle == INVALID_HANDLE_VALUE ||
      GetFileInformationByHandle(handle, &info) == 0) {
    return {};
  }
  // On FAT/exFAT the file ID is the directory entry's offset, which a rename
  // can move. They have no hard links either (the swap this catches needs
  // one), so the identity is left unknown there.
  DWORD flags = 0;
  if (GetVolumeInformationByHandleW(handle, nullptr, 0, nullptr, nullptr,
                                    &flags, nullptr, 0) == 0 ||
      (flags & FILE_SUPPORTS_HARD_LINKS) == 0) {
    return {};
  }
  return {info.dwVolumeSerialNumber,
          (static_cast<quint64>(info.nFileIndexHigh) << 32) |
              info.nFileIndexLow,
          true};
#else
  struct stat st{};
  if (::fstat(file.handle(), &st) != 0) {
    return {};
  }
  return {static_cast<quint64>(st.st_dev), static_cast<quint64>(st.st_ino),
          true};
#endif
}

/// Put @p text in @p error when there is one; false, for `return fail(...)`.
auto fail(QString *error, const QString &text) -> bool {
  if (error != nullptr) {
    *error = text;
  }
  return false;
}

/// A filled, synced temporary next to its destination.
struct Staged {
  QString path;
  FileIdentity identity;
};

/**
 * @brief Create the temporary next to @p path (opaque name, exclusive,
 * owner-only), fill it through its handle and sync it. The QTemporaryFile
 * goes out of scope before the caller renames: it keeps its handle open for
 * as long as it lives, and Windows does not rename an open file.
 */
auto stageNextTo(const QString &path, const Util::Filler &fill, QString *why)
    -> std::optional<Staged> {
  Staged staged;
  {
    QTemporaryFile file(QFileInfo(path).path() +
                        QStringLiteral("/.qtpass-XXXXXX.tmp"));
    file.setAutoRemove(false);
    if (!file.open()) {
      *why = QCoreApplication::translate(
                 "Util", "Cannot create a temporary file next to %1: %2")
                 .arg(path, file.errorString());
      return std::nullopt;
    }
    staged.path = file.fileName();
    // Owner-only: a .gpg-id names the keys a store is encrypted to, an
    // entry is an entry. QTemporaryFile creates 0600 already; say so for
    // platforms where it may not.
    file.setPermissions(QFile::ReadOwner | QFile::WriteOwner);
    *why = fill(file);
    if (why->isEmpty() && !Util::syncToDisk(file)) {
      *why = QCoreApplication::translate("Util", "Cannot write %1: %2")
                 .arg(path, file.errorString());
    }
    staged.identity = identityOf(file);
  }
  if (!why->isEmpty()) {
    QFile::remove(staged.path);
    return std::nullopt;
  }
  return staged;
}

/// Why replaceFile() could not put the temporary under @p path.
auto placementError(const QString &path, bool replace) -> QString {
  if (replace) {
    return QCoreApplication::translate("Util", "Failed to replace %1.")
        .arg(path);
  }
  const QFileInfo taken(path);
  return taken.exists() || taken.isSymLink()
             ? QCoreApplication::translate("Util", "%1 already exists.")
                   .arg(path)
             : QCoreApplication::translate("Util", "Failed to write %1.")
                   .arg(path);
}

/**
 * @brief Whether what is under @p path is the file that was filled: not a
 * link, and not another file (a hard link to something of the user's, say)
 * swapped in under the temporary's name. Opened without following, compared
 * by identity; only two known identities can prove a swap, otherwise every
 * write on such a store would be reported as tampering.
 */
auto isTheFileWritten(const QString &path, const FileIdentity &written)
    -> bool {
  QFile placed;
  if (!Util::openRegularFile(path, placed)) {
    return false;
  }
  const FileIdentity there = identityOf(placed);
  if (!written.known || !there.known) {
    qCWarning(lcQtPass) << "Cannot tell whether" << path
                        << "is the file that was written here";
    return true;
  }
  return there == written;
}

} // namespace

auto Util::stageFileReplacing(const QString &path, bool replace,
                              const Filler &fill, QString *error) -> bool {
  QString why;
  const std::optional<Staged> staged = stageNextTo(path, fill, &why);
  if (!staged) {
    return fail(error, why);
  }
  if (!replaceFile(staged->path, path, replace)) {
    QFile::remove(staged->path);
    return fail(error, placementError(path, replace));
  }
  // A mismatch is reported and left: removing by name could take another
  // writer's file.
  if (!isTheFileWritten(path, staged->identity)) {
    return fail(
        error,
        QCoreApplication::translate(
            "Util", "%1 was swapped for another file while it was written.")
            .arg(path));
  }
  return true;
}

auto Util::writeFileReplacing(const QString &path, const QByteArray &bytes,
                              bool replace, QString *error) -> bool {
  return stageFileReplacing(
      path, replace,
      [&path, &bytes](QFileDevice &staged) -> QString {
        if (staged.write(bytes) != bytes.size()) {
          return QCoreApplication::translate("Util", "Cannot write %1: %2")
              .arg(path, staged.errorString());
        }
        return {};
      },
      error);
}

auto Util::copyFileReplacing(const QString &src, const QString &dst,
                             bool replace, QString *error) -> bool {
  QFile in;
  if (!openRegularFile(src, in)) {
    if (error)
      *error = QCoreApplication::translate("Util", "Cannot read %1.").arg(src);
    return false;
  }
  return stageFileReplacing(
      dst, replace,
      [&src, &dst, &in](QFileDevice &staged) -> QString {
        char buf[64 * 1024];
        for (;;) {
          const qint64 n = in.read(buf, sizeof buf);
          if (n < 0) {
            return QCoreApplication::translate("Util", "Cannot read %1: %2")
                .arg(src, in.errorString());
          }
          if (n == 0) {
            return {};
          }
          if (staged.write(buf, n) != n) {
            return QCoreApplication::translate("Util", "Cannot write %1: %2")
                .arg(dst, staged.errorString());
          }
        }
      },
      error);
}

namespace {

/// Remove one directory entry that is not a real directory: a link goes as
/// the entry itself, never its target (a junction or a directory symlink on
/// Windows is a directory entry and goes with rmdir); a read-only file gets
/// write access and one more try, as QDir::removeRecursively() does.
auto removeEntry(const QFileInfo &entry) -> bool {
  const QString path = entry.filePath();
  if (isLink(entry)) {
    if (QFile::remove(path) || QDir().rmdir(path)) {
      return true;
    }
    qCWarning(lcQtPass) << "Could not remove link" << path;
    return false;
  }
  if (QFile::remove(path)) {
    return true;
  }
  const QFile::Permissions perms = QFile::permissions(path);
  if (!perms.testFlag(QFile::WriteUser) &&
      QFile::setPermissions(path, perms | QFile::WriteUser) &&
      QFile::remove(path)) {
    return true;
  }
  qCWarning(lcQtPass) << "Could not remove" << path;
  return false;
}

} // namespace

auto Util::removeTree(const QString &dir) -> bool {
  // A trailing separator makes lstat follow a link ("link/" is the target
  // directory); the link itself is what this is about.
  const QString path = QDir::cleanPath(dir);
  const QFileInfo top(path);
  if (isLink(top)) {
    // rm -rf on a link removes the link.
    return QFile::remove(path) || QDir().rmdir(path);
  }
  if (!top.isDir()) {
    return false;
  }
  bool ok = true;
  const QFileInfoList entries =
      QDir(path).entryInfoList(QDir::Dirs | QDir::Files | QDir::Hidden |
                                   QDir::System | QDir::NoDotAndDotDot,
                               QDir::Name);
  for (const QFileInfo &entry : entries) {
    const bool removed = entry.isDir() && !isLink(entry)
                             ? removeTree(entry.filePath())
                             : removeEntry(entry);
    ok = removed && ok;
  }
  return ok && QDir().rmdir(path);
}

IJHack / QtPass / 40501301411

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous