41284697913

Committed 01 Nov 2026 07:25AM UTC coverage: 92.69% (+0.03%) from 92.659%

Build # 41284697913

Build Type

push

github

Committed by

web-flow

Commit Message

Git pin: honour safe.directory for a store another user owns (#2102)

* Git pin: honour safe.directory for a store another user owns

When the store's parent path holds git's list separator, QtPass pins
GIT_DIR to the store's own .git, which skips git's ownership check; on
Unix it therefore repeats that check and refuses another user's store.
It did not consult safe.directory, so such a store got no Git even when
the user trusted it that way.

Read safe.directory as git does, only for a store that is not the user's
own: from system, global and command-line configuration (never the
repository's own, which cannot vouch for itself; the query runs with a
GIT_DIR that cannot exist and keeps only those scopes), in order. "*"
trusts every repository, an empty value forgets the entries before it, a
path ending in "/*" trusts what lies below it, any other absolute path
trusts that one folder after resolving links; relative entries and paths
that do not exist trust nothing.

tst_util's git config is isolated now, so the user's own safe.directory
cannot trust the stores the tests hand to another user.

Tracked in #2094.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

* SECURITY: keep the Git pin bullet under the line limit

Move the note on where safe.directory counts into the next bullet; the
first one ran to 451 characters (MD013 allows 400).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

* Git pin: leave GIT_CONFIG out of the safe.directory query

git config alone reads GIT_CONFIG as if it were --file, in place of the
system and global configuration, and reports it as "command"; git's
ownership check never reads it. Inherited, it could trust a store git
refuses and hide the entries git does ... (continued)

Coverage Stats

50 of 51 new or added lines in 3 files covered. (98.04%)

10080 of 10875 relevant lines covered (92.69%)

397.57 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

93.16

/src/util.cpp

// SPDX-FileCopyrightText: 2014 Anne Jan Brouwer
// SPDX-License-Identifier: GPL-3.0-or-later

#include "util.h"
#include "appsettings.h"
#include "executor.h"
#include <QCoreApplication>
#include <QDebug>
#include <QDir>
#include <QFile>
#include <QFileDevice>
#include <QFileInfo>
#include <QHash>
#include <QRegularExpression>
#include <QRegularExpressionMatchIterator>
#include <QStandardPaths>
#include <QTemporaryFile>
#include <QUrl>

#include <optional>

#ifdef Q_OS_WIN
#include <fcntl.h>
#include <io.h>
#include <windows.h>
#else
#include <cerrno>
#include <cstdio>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/time.h>
#include <unistd.h>
#endif

#include "qtpasslogging.h"

QProcessEnvironment Util::_env;
bool Util::_envInitialised = false;

// macOS and Windows: append the usual GPG install directories to PATH.
void Util::initialiseEnvironment() {
  if (!_envInitialised) {
    _env = QProcessEnvironment::systemEnvironment();
#ifdef __APPLE__
    QString path = _env.value("PATH");
    if (!path.contains("/usr/local/MacGPG2/bin") &&
        QDir("/usr/local/MacGPG2/bin").exists())
      path += ":/usr/local/MacGPG2/bin";
    if (!path.contains("/usr/local/bin"))
      path += ":/usr/local/bin";
    _env.insert("PATH", path);
#endif
#ifdef Q_OS_WIN
    QString path = _env.value("PATH");
    if (!path.contains("C:\\Program Files\\WinGPG\\x86") &&
        QDir("C:\\Program Files\\WinGPG\\x86").exists())
      path += ";C:\\Program Files\\WinGPG\\x86";
    if (!path.contains("C:\\Program Files\\GnuPG\\bin") &&
        QDir("C:\\Program Files\\GnuPG\\bin").exists())
      path += ";C:\\Program Files\\GnuPG\\bin";
    _env.insert("PATH", path);
#endif
    qCDebug(lcQtPass) << _env.value("PATH");
    _envInitialised = true;
  }
}

auto Util::findPasswordStore() -> QString {
  QString path;
  initialiseEnvironment();
  if (_env.contains("PASSWORD_STORE_DIR")) {
    path = Util::expandTilde(_env.value("PASSWORD_STORE_DIR"));
  } else {
#ifdef Q_OS_WIN
    path = QDir(QDir::homePath()).filePath("password-store");
#else
    path = QDir(QDir::homePath()).filePath(".password-store");
#endif
  }
  return Util::normalizeFolderPath(QDir::cleanPath(path));
}

auto Util::expandTilde(const QString &path) -> QString {
  if (path == QLatin1String("~")) {
    return QDir::homePath();
  }
  if (path.startsWith(QLatin1String("~/"))) {
    return QDir::homePath() + path.mid(1);
  }
  return path;
}

auto Util::normalizeFolderPath(const QString &path) -> QString {
  QString normalizedPath = path;
  if (!normalizedPath.endsWith('/')) {
    normalizedPath += '/';
  }
  return normalizedPath;
}

void Util::applyPassProcessDefaults() {
  // pass unsets these before it runs git: a GIT_DIR inherited from the
  // environment (QtPass started from a git hook, or an IDE terminal) would
  // send every commit and push to that repository instead of the store.
  for (const char *variable :
       {"GIT_DIR", "GIT_WORK_TREE", "GIT_NAMESPACE", "GIT_INDEX_FILE",
        "GIT_INDEX_VERSION", "GIT_OBJECT_DIRECTORY", "GIT_COMMON_DIR",
        // QtPass sets GIT_LITERAL_PATHSPECS for its git; git refuses a
        // pathspec when one of these is set as well.
        "GIT_GLOB_PATHSPECS", "GIT_NOGLOB_PATHSPECS", "GIT_ICASE_PATHSPECS"}) {
    qunsetenv(variable);
  }
  Executor::setChildUmask(
      passUmask(qEnvironmentVariable("PASSWORD_STORE_UMASK")));
}

auto Util::passUmask(const QString &value) -> int {
  // Taken as it is, as bash's umask builtin (which pass hands it to) takes
  // it: " 022" is no umask there either. pass then keeps the session's;
  // QtPass falls back to 077.
  // anchoredPattern(), not ^...$: $ also matches before a final newline.
  static const QRegularExpression octal(
      QRegularExpression::anchoredPattern(QStringLiteral("[0-7]{1,4}")));
  if (!octal.match(value).hasMatch()) {
    return 077;
  }
  return value.toInt(nullptr, 8);
}

auto Util::gitCeiling(const QString &store) -> QString {
  if (store.isEmpty()) {
    return {};
  }
  QString path = QFileInfo(store).canonicalFilePath();
  if (path.isEmpty()) {
    path = QDir::cleanPath(QDir(store).absolutePath());
  }
  return QFileInfo(path).absolutePath();
}

namespace {
/// setGitOwnerForTests(): who owns "the user's own" store, when set.
std::optional<uint> s_gitOwnerForTests;
} // namespace

void Util::setGitOwnerForTests(std::optional<uint> user) {
  s_gitOwnerForTests = user;
}

#ifdef Q_OS_UNIX
namespace {
/**
 * @brief Whether git's `safe.directory` trusts the repository at @p root,
 * as git's ownership check would judge it in place of ownership.
 *
 * Read as git reads it: only from system, global and command-line
 * configuration (a repository cannot vouch for itself), in order. `*`
 * trusts every repository, an empty value forgets the entries before it,
 * a path ending in a slash and `*` trusts what lies below it, and any other
 * absolute path trusts that one folder, compared after resolving links.
 * Relative entries (including git's ".") and paths that do not exist trust
 * nothing.
 * @param root The store's canonical path.
 * @param git The git executable; "git" from PATH when empty.
 * @return True when an entry names @p root; false when none does or git
 *         cannot be asked.
 */
auto isSafeDirectory(const QString &root, const QString &git) -> bool {
  // Outside any repository, as git reads its protected config: no
  // repository's own config, and no includeIf "gitdir:" or "onbranch:"
  // that matches (a GIT_DIR, even one that cannot exist, would be matched
  // against them, and one that cannot exist makes git config fail). From
  // "/", which a user cannot make a repository; a local scope is dropped
  // below in any case.
  QProcessEnvironment env = QProcessEnvironment::systemEnvironment();
  env.remove(QStringLiteral("GIT_DIR"));
  env.remove(QStringLiteral("GIT_WORK_TREE"));
  env.remove(QStringLiteral("GIT_COMMON_DIR"));
  // git config alone reads GIT_CONFIG in place of the system and global
  // configuration (and reports it as "command"); the ownership check never
  // reads it.
  env.remove(QStringLiteral("GIT_CONFIG"));
  QProcess process;
  process.setProcessEnvironment(env);
  process.setWorkingDirectory(QStringLiteral("/"));
  // Bounded: Git calls wait for this, and a git that never answers trusts
  // nothing.
  constexpr int kQueryTimeoutMs = 5000;
  process.start(
      Executor::resolveExecutable(git.isEmpty() ? QStringLiteral("git") : git),
      {QStringLiteral("config"), QStringLiteral("--show-scope"),
       QStringLiteral("--type=path"), QStringLiteral("--get-all"),
       QStringLiteral("safe.directory")});
  if (!process.waitForStarted(kQueryTimeoutMs)) {
    return false;
  }
  process.closeWriteChannel();
  if (!process.waitForFinished(kQueryTimeoutMs)) {
    process.kill();
    process.waitForFinished(1000);
    return false;
  }
  if (process.exitStatus() != QProcess::NormalExit || process.exitCode() != 0) {
    return false;
  }
  const QString out = QString::fromUtf8(process.readAllStandardOutput());
  bool safe = false;
  const QStringList lines = out.split(QLatin1Char('\n'));
  for (const QString &line : lines) {
    const qsizetype tab = line.indexOf(QLatin1Char('\t'));
    if (tab < 0) {
      continue;
    }
    const QString scope = line.left(tab);
    if (scope != QLatin1String("system") && scope != QLatin1String("global") &&
        scope != QLatin1String("command")) {
      continue;
    }
    const QString value = line.mid(tab + 1);
    if (value.isEmpty()) {
      safe = false;
    } else if (value == QLatin1String("*")) {
      safe = true;
    } else if (!QDir::isAbsolutePath(value)) {
      continue;
    } else if (value.endsWith(QLatin1String("/*"))) {
      const QString base = value.chopped(2);
      QString prefix = QFileInfo(base.isEmpty() ? QStringLiteral("/") : base)
                           .canonicalFilePath();
      if (prefix.isEmpty()) {
        continue;
      }
      if (!prefix.endsWith(QLatin1Char('/'))) {
        prefix += QLatin1Char('/');
      }
      safe = safe || root.startsWith(prefix);
    } else {
      const QString named = QFileInfo(value).canonicalFilePath();
      safe = safe || (!named.isEmpty() && named == root);
    }
  }
  return safe;
}
} // namespace
#endif

auto Util::gitStoreVariables(const QString &store, const QString &git,
                             std::optional<uint> asUser)
    -> QList<std::pair<QString, QString>> {
  const QString ceiling = gitCeiling(store);
  if (ceiling.isEmpty()) {
    return {};
  }
  QList<std::pair<QString, QString>> vars{
      {QStringLiteral("GIT_CEILING_DIRECTORIES"), ceiling}};
#ifdef Q_OS_WIN
  const QChar separator = QLatin1Char(';');
#else
  const QChar separator = QLatin1Char(':');
#endif
  // git splits the ceiling list on the separator: "/home/a:b" would be
  // "/home/a" and "b", neither of them the parent, and git would climb.
  if (ceiling.contains(separator)) {
    QString root = QFileInfo(store).canonicalFilePath();
    if (root.isEmpty()) {
      root = QDir::cleanPath(QDir(store).absolutePath());
    }
    QString gitDir = QDir(root).filePath(QStringLiteral(".git"));
#ifdef Q_OS_UNIX
    // What discovery's ownership check would have looked at: the work tree,
    // the .git, and the directory a gitfile names. Not the user's: no
    // repository at all, under a path that cannot be created (its parent
    // is a device), rather than another user's hooks run as this one.
    const uint me = asUser.value_or(
        s_gitOwnerForTests.value_or(static_cast<uint>(::geteuid())));
    const auto ownedOrMissing = [me](const QString &path) {
      const QFileInfo info(path);
      return !info.exists() || info.ownerId() == me;
    };
    bool owned = ownedOrMissing(root) && ownedOrMissing(gitDir);
    if (owned && QFileInfo(gitDir).isFile()) {
      QFile gitFile(gitDir);
      if (gitFile.open(QIODevice::ReadOnly)) {
        const QString line =
            QString::fromUtf8(gitFile.readLine(4096)).trimmed();
        if (line.startsWith(QLatin1String("gitdir:"))) {
          const QString target = line.mid(7).trimmed();
          owned = ownedOrMissing(QDir(root).absoluteFilePath(target));
        }
      }
    }
    // Or trusted as git would trust it in place of ownership.
    if (!owned && !isSafeDirectory(root, git)) {
      gitDir = QStringLiteral("/dev/null/.git");
    }
#else
    // Git for Windows runs the same ownership check during discovery, on
    // SIDs, with its own rules for the Administrators group; this pin skips
    // it there and does not repeat it (a known gap, #2089).
    Q_UNUSED(git);
    Q_UNUSED(asUser);
#endif
    vars.append({QStringLiteral("GIT_DIR"), gitDir});
    vars.append({QStringLiteral("GIT_WORK_TREE"), root});
  }
  return vars;
}

auto Util::mkpathForStore(const QString &path) -> bool {
  const QString clean = QDir::cleanPath(QDir(path).absolutePath());
  if (QFileInfo(clean).isDir()) {
    return true;
  }
  const QString parent = QFileInfo(clean).absolutePath();
  if (parent != clean && !mkpathForStore(parent)) {
    return false;
  }
#ifdef Q_OS_UNIX
  // The store's umask, as git and gpg get it: a store shared with a group
  // (PASSWORD_STORE_UMASK=007) gets group folders, the default owner-only.
  const int umask = Executor::childUmask() >= 0 ? Executor::childUmask() : 077;
  QFile::Permissions permissions;
  const QFile::Permission bits[] = {
      QFile::ReadOwner, QFile::WriteOwner, QFile::ExeOwner,
      QFile::ReadGroup, QFile::WriteGroup, QFile::ExeGroup,
      QFile::ReadOther, QFile::WriteOther, QFile::ExeOther};
  for (int i = 0; i < 9; ++i) {
    if ((umask & (0400 >> i)) == 0) {
      permissions |= bits[i];
    }
  }
  // mkdir() still takes QtPass's own umask off (a session's 022 would drop
  // the group's write bit); set the mode exactly afterwards. That only ever
  // widens it to what was asked, never past.
  const bool made = QDir().mkdir(clean, permissions) &&
                    QFile::setPermissions(clean, permissions);
#else
  // Windows: permissions here would become an ACL of their own, replacing
  // the inherited one; the folder takes its parent's, as before.
  const bool made = QDir().mkdir(clean);
#endif
  return made || QFileInfo(clean).isDir();
}

auto Util::findBinaryInPath(const QString &binary) -> QString {
  if (binary.isEmpty()) {
    return {};
  }

  initialiseEnvironment();

  const QStringList dirs =
      _env.value(QStringLiteral("PATH"))
          .split(QDir::listSeparator(), Qt::SkipEmptyParts);
  QString ret;
  if (QDir::fromNativeSeparators(binary).contains(u'/')) {
    // An explicit path is not a PATH search: an absolute path is checked
    // as-is, a relative one is resolved against the PATH directories. The
    // directory-list overload refuses such names, so handle them here.
    if (QDir::isAbsolutePath(binary)) {
      ret = QStandardPaths::findExecutable(binary);
    } else if (!dirs.isEmpty()) {
      ret = QStandardPaths::findExecutable(binary, dirs);
    }
  } else {
    ret = findBinaryInPath(binary, dirs);
  }
#ifdef Q_OS_WIN
  if (ret.isEmpty()) {
    // Cache per-binary WSL lookup result — the wsl --version probe is a
    // blocking subprocess that can run several times per session for
    // missing binaries; once decided, the answer doesn't change at runtime.
    static QHash<QString, QString> wslBinaryCache;
    const bool hasWhitespace =
        std::any_of(binary.cbegin(), binary.cend(),
                    [](const QChar ch) { return ch.isSpace(); });
    if (!hasWhitespace) {
      auto cached = wslBinaryCache.constFind(binary);
      if (cached != wslBinaryCache.constEnd()) {
        ret = cached.value();
      } else {
        QString wslCommand = QStringLiteral("wsl ") + binary;
        qCDebug(lcQtPass)
            << "Util::findBinaryInPath(): falling back to WSL for binary"
            << binary;
        QString out, err;
        QString cachedResult;
        if (Executor::executeBlocking(wslCommand, {"--version"}, &out, &err) ==
                0 &&
            !out.isEmpty() && err.isEmpty()) {
          qCDebug(lcQtPass)
              << "Util::findBinaryInPath(): using WSL binary" << wslCommand;
          cachedResult = wslCommand;
        }
        wslBinaryCache.insert(binary, cachedResult);
        ret = cachedResult;
      }
    }
  }
#endif

  return ret;
}

// Bare names only: QStandardPaths::findExecutable() returns an absolute binary
// without consulting searchPaths, and a relative one with ".." could escape
// them.
auto Util::findBinaryInPath(const QString &binary,
                            const QStringList &searchPaths) -> QString {
  if (binary.isEmpty() || QDir::fromNativeSeparators(binary).contains(u'/')) {
    return {};
  }
  QStringList dirs;
  dirs.reserve(searchPaths.size());
  for (const QString &dir : searchPaths) {
    if (!dir.isEmpty()) {
      dirs.append(dir);
    }
  }
  if (dirs.isEmpty()) {
    // QStandardPaths::findExecutable() treats an empty list as "use PATH".
    return {};
  }
  return QStandardPaths::findExecutable(binary, dirs);
}

auto Util::configIsValid(const AppSettings &s) -> bool {
  const QString configFilePath = QDir(s.passStore).filePath(".gpg-id");
  if (!QFile(configFilePath).exists()) {
    return false;
  }

  const QString executable = s.usePass ? s.passExecutable : s.gpgExecutable;

  if (const auto wsl = Executor::parseWslCommand(executable)) {
    // Probe WSL once per session — availability doesn't change at runtime
    // and the executeBlocking call is a blocking subprocess.
    static const bool wslAvailable = [&wsl]() {
      QString out;
      QString err;
      return Executor::executeBlocking(wsl->launcher,
                                       {QStringLiteral("--version")}, &out,
                                       &err) == 0 &&
             !out.isEmpty() && err.isEmpty();
    }();
    if (wslAvailable) {
      return true;
    }
  }
  return QFile(executable).exists();
}

auto Util::endsWithGpg() -> const QRegularExpression & {
  static const QRegularExpression expr{R"(\.gpg$)"};
  return expr;
}

// Stops at whitespace, quotes and brackets so a URL on its own line keeps no
// line break. file:/// is excluded on purpose (local, not network); the test
// relies on that.
auto Util::protocolRegex() -> const QRegularExpression & {
  static const QRegularExpression regex{
      R"(((?:https?|ftp|ssh|sftp|ftps|webdav|webdavs)://[^"\s<>\)\]\[]+))"};
  return regex;
}

auto Util::isLaunchableWebUrl(const QString &value) -> bool {
  const QString trimmed = value.trimmed();
  if (trimmed.isEmpty()) {
    return false;
  }
  // Reject control characters first, before QUrl normalisation can hide a
  // CR/LF/NUL injection into the OS URL handler.
  for (const QChar &c : trimmed) {
    if (c == QLatin1Char('\r') || c == QLatin1Char('\n') ||
        c == QChar(QChar::Null)) {
      return false;
    }
  }
  const QUrl url(trimmed, QUrl::StrictMode);
  if (!url.isValid()) {
    return false;
  }
  const QString scheme = url.scheme().toLower();
  if (scheme != QLatin1String("http") && scheme != QLatin1String("https")) {
    return false;
  }
  if (url.host().isEmpty()) {
    return false;
  }
  // Embedded userinfo (user:pass@host) would leak into browser history.
  if (!url.userName().isEmpty() || !url.password().isEmpty()) {
    return false;
  }
  return true;
}

auto Util::linkifyUrls(const QString &text, bool *linked) -> QString {
  if (linked != nullptr) {
    *linked = false;
  }
  QString html;
  html.reserve(text.size());
  qsizetype lastIndex = 0;
  QRegularExpressionMatchIterator it = protocolRegex().globalMatch(text);
  while (it.hasNext()) {
    const QRegularExpressionMatch match = it.next();
    const QString url = match.captured(0);
    if (!isLaunchableWebUrl(url)) {
      // Not a web URL (or it carries credentials): leave it in the escaped
      // plain-text run instead of making it clickable.
      continue;
    }
    const qsizetype start = match.capturedStart(0);
    html += text.mid(lastIndex, start - lastIndex).toHtmlEscaped();
    const QString escapedUrl = url.toHtmlEscaped();
    html += QStringLiteral("<a href=\"%1\">%1</a>").arg(escapedUrl);
    lastIndex = match.capturedEnd(0);
    if (linked != nullptr) {
      *linked = true;
    }
  }
  html += text.mid(lastIndex).toHtmlEscaped();
  return html;
}

auto Util::newLinesRegex() -> const QRegularExpression & {
  static const QRegularExpression regex{"[\r\n]"};
  return regex;
}

// No content heuristics: a line rejected here is erased the next time .gpg-id
// is rewritten. A leading `-` is refused because the recipients also go
// positionally to `gpg --list-keys`, where it would parse as an option.
auto Util::isValidKeyId(const QString &keyId) -> bool {
  return !keyId.isEmpty() && !keyId.startsWith('-');
}

namespace {
/**
 * @brief Walk @p dir's real, visible directories in sorted pre-order and hand
 * every entry to @p visit before any recursion; a directory is entered only
 * when @p visit returns true for it.
 */
template <typename Visit> void walkStore(const QString &dir, Visit visit) {
  // Absolute, so the results are whatever the caller's cwd; not canonical,
  // so a linked root keeps the name it was configured under.
  QStringList pending{QDir(QDir::cleanPath(dir)).absolutePath()};
  while (!pending.isEmpty()) {
    const QDir current(pending.takeLast());
    // Every entry once, links and hidden entries included, so the decision
    // what to do with each is taken here, before any recursion. QDir::System
    // keeps dangling links in the listing.
    const QFileInfoList entries =
        current.entryInfoList(QDir::Dirs | QDir::Files | QDir::Hidden |
                                  QDir::System | QDir::NoDotAndDotDot,
                              QDir::Name);
    QStringList subdirs;
    for (const QFileInfo &entry : entries) {
      if (visit(entry)) {
        subdirs << entry.filePath();
      }
    }
    // Pushed last-to-first so the next one taken is the first by name.
    for (auto it = subdirs.crbegin(); it != subdirs.crend(); ++it) {
      pending << *it;
    }
  }
}

/// A symlink or an NTFS junction: never entered, never listed.
auto isLink(const QFileInfo &entry) -> bool {
  return entry.isSymLink() || entry.isJunction();
}

/// Hidden by attribute, or by the dot convention on every platform: Qt 6.11
/// on macOS answers isHidden() from the UF_HIDDEN flag alone once an entry
/// was lstat()ed (qfilesystemengine_unix.cpp marks the attribute known there
/// without the dot check), and Windows does not consider .stversions hidden
/// at all.
auto isHiddenEntry(const QFileInfo &entry) -> bool {
  return entry.isHidden() || entry.fileName().startsWith(QLatin1Char('.'));
}

/// A real directory that is part of the store: .git, .stversions,
/// .Trash-1000 are not, as with QDirIterator without QDir::Hidden.
auto isStoreDirectory(const QFileInfo &entry) -> bool {
  return !isLink(entry) && entry.isDir() && !isHiddenEntry(entry);
}
} // namespace

auto Util::regularFilesUnder(const QString &dir, const QStringList &nameFilters,
                             QStringList *skipped, bool hiddenFiles)
    -> QStringList {
  QStringList files;
  walkStore(dir, [&](const QFileInfo &entry) {
    if (isStoreDirectory(entry)) {
      return true;
    }
    const bool named = QDir::match(nameFilters, entry.fileName());
    if (isLink(entry) || (!entry.isDir() && !entry.isFile())) {
      // A linked directory hides everything behind it; a linked file, or a
      // FIFO, socket or device, is only of interest under a name the caller
      // asked for.
      if (skipped != nullptr && (entry.isDir() || named)) {
        qCWarning(lcQtPass) << "Skipping" << entry.filePath()
                            << ": not a regular file or directory";
        *skipped << entry.filePath();
      }
      return false;
    }
    if (entry.isFile() && named && (hiddenFiles || !isHiddenEntry(entry))) {
      files << entry.filePath();
    }
    return false;
  });
  return files;
}

auto Util::directoriesUnder(const QString &dir) -> QStringList {
  QStringList dirs;
  walkStore(dir, [&](const QFileInfo &entry) {
    if (!isStoreDirectory(entry)) {
      return false;
    }
    dirs << entry.filePath();
    return true;
  });
  return dirs;
}

auto Util::isLinkedFolder(const QString &path) -> bool {
  return isLink(QFileInfo(QDir::cleanPath(path)));
}

auto Util::isUnderLink(const QString &path, const QString &storeRoot,
                       bool includeSelf) -> bool {
  // "C:/Store" and "c:/store" are one directory on Windows; a path spelled
  // the other way must not skip the walk (as in Pass::getGpgIdPath).
#ifdef Q_OS_WIN
  constexpr auto cs = Qt::CaseInsensitive;
#else
  constexpr auto cs = Qt::CaseSensitive;
#endif
  const QString root = QDir::cleanPath(storeRoot);
  // A root of "/" or "C:/" already ends in the separator.
  const QString prefix =
      root.endsWith(QLatin1Char('/')) ? root : root + QLatin1Char('/');
  const auto isRoot = [&](const QString &p) {
    return p.compare(root, cs) == 0;
  };
  QString current = QDir::cleanPath(path);
  if (!current.startsWith(prefix, cs)) {
    // Not under the store as named: only the entry itself can be judged.
    return includeSelf && !isRoot(current) && isLinkedFolder(current);
  }
  if (!includeSelf) {
    current = QFileInfo(current).path();
  }
  for (; !isRoot(current) && current.startsWith(prefix, cs);
       current = QFileInfo(current).path()) {
    if (isLinkedFolder(current)) {
      return true;
    }
  }
  return false;
}

#ifndef Q_OS_WIN
namespace {

/// The filesystem cannot make hard links at all (FAT/exFAT refuse with
/// EPERM, some FUSE filesystems with ENOTSUP or ENOSYS).
auto hasNoHardLinks(int error) -> bool {
  return error == EPERM || error == ENOTSUP || error == EOPNOTSUPP ||
         error == ENOSYS;
}

/// rename() that fails with EEXIST instead of replacing, where the platform
/// has one; nothing when neither the platform nor the filesystem does.
auto renameExclusive(const QByteArray &source, const QByteArray &target)
    -> std::optional<bool> {
#if defined(__GLIBC__) &&                                                      \
    (__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 28))
  if (::renameat2(AT_FDCWD, source.constData(), AT_FDCWD, target.constData(),
                  RENAME_NOREPLACE) == 0) {
    return true;
  }
  if (errno == EINVAL || errno == ENOSYS || hasNoHardLinks(errno)) {
    return std::nullopt;
  }
  return false;
#elif defined(Q_OS_MACOS)
  if (::renamex_np(source.constData(), target.constData(), RENAME_EXCL) == 0) {
    return true;
  }
  if (errno == EINVAL || errno == ENOTSUP) {
    return std::nullopt;
  }
  return false;
#else
  Q_UNUSED(source);
  Q_UNUSED(target);
  return std::nullopt;
#endif
}

/**
 * @brief Gives @p source the name @p target unless something already has it.
 *
 * A hard link is the one way every POSIX system can do that in one step:
 * linkat() fails with EEXIST rather than replacing. Where the filesystem has
 * no hard links, an exclusive rename does it; where that is missing too, the
 * name is checked and then renamed, which leaves a short window for another
 * writer to create it in between.
 */
auto placeWithoutReplacing(const QByteArray &source, const QByteArray &target)
    -> bool {
  // linkat() without AT_SYMLINK_FOLLOW follows nothing; link() would, on
  // macOS and the BSDs, hard-link whatever a symlink planted under the
  // source's name points at.
  if (::linkat(AT_FDCWD, source.constData(), AT_FDCWD, target.constData(), 0) ==
      0) {
    ::unlink(source.constData());
    return true;
  }
  if (!hasNoHardLinks(errno)) {
    return false;
  }
  if (const std::optional<bool> renamed = renameExclusive(source, target)) {
    return *renamed;
  }
  struct stat st{};
  if (::lstat(target.constData(), &st) == 0 || errno != ENOENT) {
    errno = EEXIST;
    return false;
  }
  return ::rename(source.constData(), target.constData()) == 0;
}

} // namespace
#endif

auto Util::replaceFile(const QString &from, const QString &to, bool replace)
    -> bool {
#ifdef Q_OS_WIN
  const std::wstring source =
      QDir::toNativeSeparators(QFileInfo(from).absoluteFilePath())
          .toStdWString();
  const std::wstring target =
      QDir::toNativeSeparators(QFileInfo(to).absoluteFilePath()).toStdWString();
  // WRITE_THROUGH: the new entry is on the device when this returns.
  return MoveFileExW(source.c_str(), target.c_str(),
                     (replace ? MOVEFILE_REPLACE_EXISTING : 0) |
                         MOVEFILE_WRITE_THROUGH) != 0;
#else
  const QByteArray source = QFile::encodeName(from);
  const QByteArray target = QFile::encodeName(to);
  if (replace) {
    if (::rename(source.constData(), target.constData()) != 0) {
      return false;
    }
  } else {
    if (!placeWithoutReplacing(source, target)) {
      return false;
    }
  }
  // Sync the directory entry so a crash does not lose the new name. Best
  // effort: the bytes are already synced, and some network filesystems
  // cannot sync a directory.
  const int dir = ::open(QFile::encodeName(QFileInfo(to).path()).constData(),
                         O_RDONLY | O_DIRECTORY | O_CLOEXEC);
  if (dir >= 0) {
    int rc;
    do {
      rc = ::fsync(dir);
    } while (rc != 0 && errno == EINTR);
    ::close(dir);
  }
  return true;
#endif
}

auto Util::openRegularFile(const QString &path, QFile &file) -> bool {
#ifdef Q_OS_WIN
  // FILE_FLAG_OPEN_REPARSE_POINT opens a symbolic link or junction itself
  // rather than its target, so the handle's attributes say what the name
  // was at the moment of the open.
  const std::wstring native =
      QDir::toNativeSeparators(QFileInfo(path).absoluteFilePath())
          .toStdWString();
  HANDLE handle = CreateFileW(
      native.c_str(), GENERIC_READ,
      FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr,
      OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
  if (handle == INVALID_HANDLE_VALUE) {
    return false;
  }
  BY_HANDLE_FILE_INFORMATION info{};
  if (!GetFileInformationByHandle(handle, &info) ||
      (info.dwFileAttributes &
       (FILE_ATTRIBUTE_REPARSE_POINT | FILE_ATTRIBUTE_DIRECTORY |
        FILE_ATTRIBUTE_DEVICE)) != 0 ||
      GetFileType(handle) != FILE_TYPE_DISK) {
    CloseHandle(handle);
    return false;
  }
  const int fd = _open_osfhandle(reinterpret_cast<intptr_t>(handle),
                                 _O_RDONLY | _O_BINARY);
  if (fd < 0) {
    CloseHandle(handle);
    return false;
  }
  if (!file.open(fd, QIODevice::ReadOnly, QFileDevice::AutoCloseHandle)) {
    _close(fd);
    return false;
  }
  return true;
#else
  // O_NOFOLLOW fails with ELOOP on a symbolic link; O_NONBLOCK keeps a FIFO
  // from blocking the open until fstat() can refuse it.
  const int fd = ::open(QFile::encodeName(path).constData(),
                        O_RDONLY | O_NOFOLLOW | O_NONBLOCK | O_CLOEXEC);
  if (fd < 0) {
    return false;
  }
  struct stat st{};
  if (::fstat(fd, &st) != 0 || !S_ISREG(st.st_mode)) {
    ::close(fd);
    return false;
  }
  // The descriptor, not the name, is what QFile opens here: the object
  // fstat() judged is the object read. CodeQL's check-then-use pattern
  // matcher sees an open after a check and cannot tell.
  if (!file.open(fd, QIODevice::ReadOnly, // codeql[cpp/toctou-race-condition]
                 QFileDevice::AutoCloseHandle)) {
    ::close(fd);
    return false;
  }
  return true;
#endif
}

auto Util::readRegularFile(const QString &path, qint64 maxBytes)
    -> std::optional<QByteArray> {
  QFile file;
  if (!openRegularFile(path, file)) {
    return std::nullopt;
  }
  // A regular file's size is reliable, also when sparse: refuse a large one
  // before reading anything. One byte past the limit still guards a file
  // that grows meanwhile.
  if (file.size() > maxBytes) {
    return std::nullopt;
  }
  QByteArray bytes = file.read(maxBytes + 1);
  if (bytes.size() > maxBytes || file.error() != QFileDevice::NoError) {
    return std::nullopt;
  }
  return bytes;
}

auto Util::syncToDisk(QFileDevice &file) -> bool {
  if (!file.flush()) {
    return false;
  }
#ifdef Q_OS_WIN
  const HANDLE handle = reinterpret_cast<HANDLE>(_get_osfhandle(file.handle()));
  return handle != INVALID_HANDLE_VALUE && FlushFileBuffers(handle) != 0;
#else
  return ::fsync(file.handle()) == 0;
#endif
}

namespace {

/**
 * @brief What tells one file object from another on its filesystem: device
 * and inode on POSIX, volume serial and file index on Windows.
 */
struct FileIdentity {
  quint64 volume = 0;
  quint64 index = 0;
  bool known = false;
};

auto operator==(const FileIdentity &a, const FileIdentity &b) -> bool {
  return a.known && b.known && a.volume == b.volume && a.index == b.index;
}

/// The identity of the object @p file is open on, or an unknown one.
auto identityOf(const QFileDevice &file) -> FileIdentity {
#ifdef Q_OS_WIN
  const HANDLE handle = reinterpret_cast<HANDLE>(_get_osfhandle(file.handle()));
  BY_HANDLE_FILE_INFORMATION info;
  if (handle == INVALID_HANDLE_VALUE ||
      GetFileInformationByHandle(handle, &info) == 0) {
    return {};
  }
  // On FAT/exFAT the file ID is the directory entry's offset, which a rename
  // can move. They have no hard links either (the swap this catches needs
  // one), so the identity is left unknown there.
  DWORD flags = 0;
  if (GetVolumeInformationByHandleW(handle, nullptr, 0, nullptr, nullptr,
                                    &flags, nullptr, 0) == 0 ||
      (flags & FILE_SUPPORTS_HARD_LINKS) == 0) {
    return {};
  }
  return {info.dwVolumeSerialNumber,
          (static_cast<quint64>(info.nFileIndexHigh) << 32) |
              info.nFileIndexLow,
          true};
#else
  struct stat st{};
  if (::fstat(file.handle(), &st) != 0) {
    return {};
  }
  return {static_cast<quint64>(st.st_dev), static_cast<quint64>(st.st_ino),
          true};
#endif
}

/// Put @p text in @p error when there is one; false, for `return fail(...)`.
auto fail(QString *error, const QString &text) -> bool {
  if (error != nullptr) {
    *error = text;
  }
  return false;
}

/// A filled, synced temporary next to its destination.
struct Staged {
  QString path;
  FileIdentity identity;
};

/**
 * @brief Create the temporary next to @p path (opaque name, exclusive,
 * owner-only), fill it through its handle and sync it. The QTemporaryFile
 * goes out of scope before the caller renames: it keeps its handle open for
 * as long as it lives, and Windows does not rename an open file.
 */
auto stageNextTo(const QString &path, const Util::Filler &fill, QString *why)
    -> std::optional<Staged> {
  Staged staged;
  {
    QTemporaryFile file(QFileInfo(path).path() +
                        QStringLiteral("/.qtpass-XXXXXX.tmp"));
    file.setAutoRemove(false);
    if (!file.open()) {
      *why = QCoreApplication::translate(
                 "Util", "Cannot create a temporary file next to %1: %2")
                 .arg(path, file.errorString());
      return std::nullopt;
    }
    staged.path = file.fileName();
    // Owner-only: a .gpg-id names the keys a store is encrypted to, an
    // entry is an entry. QTemporaryFile creates 0600 already; say so for
    // platforms where it may not.
    file.setPermissions(QFile::ReadOwner | QFile::WriteOwner);
    *why = fill(file);
    if (why->isEmpty() && !Util::syncToDisk(file)) {
      *why = QCoreApplication::translate("Util", "Cannot write %1: %2")
                 .arg(path, file.errorString());
    }
    staged.identity = identityOf(file);
  }
  if (!why->isEmpty()) {
    QFile::remove(staged.path);
    return std::nullopt;
  }
  return staged;
}

/// Why replaceFile() could not put the temporary under @p path.
auto placementError(const QString &path, bool replace) -> QString {
  if (replace) {
    return QCoreApplication::translate("Util", "Failed to replace %1.")
        .arg(path);
  }
  const QFileInfo taken(path);
  return taken.exists() || taken.isSymLink()
             ? QCoreApplication::translate("Util", "%1 already exists.")
                   .arg(path)
             : QCoreApplication::translate("Util", "Failed to write %1.")
                   .arg(path);
}

/**
 * @brief Whether what is under @p path is the file that was filled: not a
 * link, and not another file (a hard link to something of the user's, say)
 * swapped in under the temporary's name. Opened without following, compared
 * by identity; only two known identities can prove a swap, otherwise every
 * write on such a store would be reported as tampering.
 */
auto isTheFileWritten(const QString &path, const FileIdentity &written)
    -> bool {
  QFile placed;
  if (!Util::openRegularFile(path, placed)) {
    return false;
  }
  const FileIdentity there = identityOf(placed);
  if (!written.known || !there.known) {
    qCWarning(lcQtPass) << "Cannot tell whether" << path
                        << "is the file that was written here";
    return true;
  }
  return there == written;
}

} // namespace

auto Util::stageFileReplacing(const QString &path, bool replace,
                              const Filler &fill, QString *error) -> bool {
  QString why;
  const std::optional<Staged> staged = stageNextTo(path, fill, &why);
  if (!staged) {
    return fail(error, why);
  }
  if (!replaceFile(staged->path, path, replace)) {
    QFile::remove(staged->path);
    return fail(error, placementError(path, replace));
  }
  // A mismatch is reported and left: removing by name could take another
  // writer's file.
  if (!isTheFileWritten(path, staged->identity)) {
    return fail(
        error,
        QCoreApplication::translate(
            "Util", "%1 was swapped for another file while it was written.")
            .arg(path));
  }
  return true;
}

auto Util::writeFileReplacing(const QString &path, const QByteArray &bytes,
                              bool replace, QString *error) -> bool {
  return stageFileReplacing(
      path, replace,
      [&path, &bytes](QFileDevice &staged) -> QString {
        if (staged.write(bytes) != bytes.size()) {
          return QCoreApplication::translate("Util", "Cannot write %1: %2")
              .arg(path, staged.errorString());
        }
        return {};
      },
      error);
}

auto Util::copyFileReplacing(const QString &src, const QString &dst,
                             bool replace, QString *error) -> bool {
  QFile in;
  if (!openRegularFile(src, in)) {
    if (error)
      *error = QCoreApplication::translate("Util", "Cannot read %1.").arg(src);
    return false;
  }
  return stageFileReplacing(
      dst, replace,
      [&src, &dst, &in](QFileDevice &staged) -> QString {
        char buf[64 * 1024];
        for (;;) {
          const qint64 n = in.read(buf, sizeof buf);
          if (n < 0) {
            return QCoreApplication::translate("Util", "Cannot read %1: %2")
                .arg(src, in.errorString());
          }
          if (n == 0) {
            return {};
          }
          if (staged.write(buf, n) != n) {
            return QCoreApplication::translate("Util", "Cannot write %1: %2")
                .arg(dst, staged.errorString());
          }
        }
      },
      error);
}

namespace {

/// Remove one directory entry that is not a real directory: a link goes as
/// the entry itself, never its target (a junction or a directory symlink on
/// Windows is a directory entry and goes with rmdir); a read-only file gets
/// write access and one more try, as QDir::removeRecursively() does.
auto removeEntry(const QFileInfo &entry) -> bool {
  const QString path = entry.filePath();
  if (isLink(entry)) {
    if (QFile::remove(path) || QDir().rmdir(path)) {
      return true;
    }
    qCWarning(lcQtPass) << "Could not remove link" << path;
    return false;
  }
  if (QFile::remove(path)) {
    return true;
  }
  const QFile::Permissions perms = QFile::permissions(path);
  if (!perms.testFlag(QFile::WriteUser) &&
      QFile::setPermissions(path, perms | QFile::WriteUser) &&
      QFile::remove(path)) {
    return true;
  }
  qCWarning(lcQtPass) << "Could not remove" << path;
  return false;
}

} // namespace

auto Util::removeTree(const QString &dir) -> bool {
  // A trailing separator makes lstat follow a link ("link/" is the target
  // directory); the link itself is what this is about.
  const QString path = QDir::cleanPath(dir);
  const QFileInfo top(path);
  if (isLink(top)) {
    // rm -rf on a link removes the link.
    return QFile::remove(path) || QDir().rmdir(path);
  }
  if (!top.isDir()) {
    return false;
  }
  bool ok = true;
  const QFileInfoList entries =
      QDir(path).entryInfoList(QDir::Dirs | QDir::Files | QDir::Hidden |
                                   QDir::System | QDir::NoDotAndDotDot,
                               QDir::Name);
  for (const QFileInfo &entry : entries) {
    const bool removed = entry.isDir() && !isLink(entry)
                             ? removeTree(entry.filePath())
                             : removeEntry(entry);
    ok = removed && ok;
  }
  return ok && QDir().rmdir(path);
}

IJHack / QtPass / 41284697913

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous