Skip to content

[stable10] Make sure we don't scan files that can not be accessed #2465

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
LukasReschke merged 1 commit into from
Dec 5, 2016
Merged

[stable10] Make sure we don't scan files that can not be accessed #2465

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions lib/private/Files/Cache/Scanner.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,22 @@ protected function getData($path) {
*/
public function scanFile($file, $reuseExisting = 0, $parentId = -1, $cacheData = null, $lock = true) {

// verify database - e.g. mysql only 3-byte chars
if (preg_match('%(?:
\xF0[\x90-\xBF][\x80-\xBF]{2} # planes 1-3
| [\xF1-\xF3][\x80-\xBF]{3} # planes 4-15
| \xF4[\x80-\x8F][\x80-\xBF]{2} # plane 16
)%xs', $file)) {
// 4-byte characters are not supported in file names
Copy link
Member

@MorrisJobke MorrisJobke Dec 2, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But this is only the case for mysql, right?

Copy link
Member Author

@nickvergessen nickvergessen Dec 2, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not really, because this is also what the view checks:

server/lib/private/Files/View.php

Lines 1809 to 1816 in 072794d

// verify database - e.g. mysql only 3-byte chars
if (preg_match('%(?:
\xF0[\x90-\xBF][\x80-\xBF]{2} # planes 1-3
| [\xF1-\xF3][\x80-\xBF]{3} # planes 4-15
| \xF4[\x80-\x8F][\x80-\xBF]{2} # plane 16
)%xs', $fileName)) {
throw new InvalidPathException($l10n->t('4-byte characters are not supported in file names'));
}

return null;
}

try {
$this->storage->verifyPath(dirname($file), basename($file));
} catch (\Exception $e) {
return null;
}

// only proceed if $file is not a partial file nor a blacklisted file
if (!self::isPartialFile($file) and !Filesystem::isFileBlacklisted($file)) {

Expand Down Expand Up @@ -167,6 +183,9 @@ public function scanFile($file, $reuseExisting = 0, $parentId = -1, $cacheData =
// scan the parent if it's not in the cache (id -1) and the current file is not the root folder
if ($file and $parentId === -1) {
$parentData = $this->scanFile($parent);
if (!$parentData) {
return null;
}
$parentId = $parentData['fileid'];
}
if ($parent) {
Expand Down
16 changes: 16 additions & 0 deletions tests/lib/Files/Cache/ScannerTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,22 @@ function testFile() {
$this->assertEquals($cachedData['mimetype'], 'image/png');
}

function testFile4Byte() {
$data = "dummy file data\n";
$this->storage->file_put_contents('foo🙈.txt', $data);

$this->assertNull($this->scanner->scanFile('foo🙈.txt'));
$this->assertFalse($this->cache->inCache('foo🙈.txt'), true);
}

function testFileInvalidChars() {
$data = "dummy file data\n";
$this->storage->file_put_contents("foo\nbar.txt", $data);

$this->assertNull($this->scanner->scanFile("foo\nbar.txt"));
$this->assertFalse($this->cache->inCache("foo\nbar.txt"), true);
}

private function fillTestFolders() {
$textData = "dummy file data\n";
$imgData = file_get_contents(\OC::$SERVERROOT . '/core/img/logo.png');
Expand Down