Skip to content

Commit 77a9a37

Browse files
tobiasKaminskytobiasKaminsky
committed
Prevent upload from sensitive path
Signed-off-by: tobiasKaminsky <tobias@kaminsky.me>
1 parent 7af8611 commit 77a9a37

File tree

22 files changed

+315
-110
lines changed

22 files changed

+315
-110
lines changed

‎app/src/androidTest/java/com/nextcloud/client/EndToEndRandomIT.java‎

Lines changed: 26 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -85,8 +85,9 @@ public enum Action {
8585
private static ArbitraryDataProvider arbitraryDataProvider;
8686

8787
private OCFile currentFolder;
88-
private int actionCount = 20;
88+
private final int actionCount = 20;
8989
private String rootEncFolder = "/e/";
90+
private final String nonEmptyFileName = "nonEmpty.txt";
9091

9192
@Rule
9293
public RetryTestRule retryTestRule = new RetryTestRule();
@@ -405,15 +406,17 @@ private void downloadFile(int i) {
405406
public void testUploadWithCopy() throws Exception {
406407
init();
407408

408-
OCUpload ocUpload = new OCUpload(FileStorageUtils.getTemporalPath(account.name) + "/nonEmpty.txt",
409-
currentFolder.getRemotePath() + "nonEmpty.txt",
409+
OCUpload ocUpload = new OCUpload(FileStorageUtils.getInternalTemporalPath(account.name, targetContext)
410+
+ nonEmptyFileName,
411+
currentFolder.getRemotePath() + nonEmptyFileName,
410412
account.name);
411413

412414
uploadOCUpload(ocUpload, FileUploader.LOCAL_BEHAVIOUR_COPY);
413415

414-
File originalFile = new File(FileStorageUtils.getTemporalPath(account.name) + "/nonEmpty.txt");
416+
File originalFile = new File(FileStorageUtils.getInternalTemporalPath(account.name, targetContext)
417+
+ nonEmptyFileName);
415418
OCFile uploadedFile = fileDataStorageManager.getFileByDecryptedRemotePath(currentFolder.getRemotePath() +
416-
"nonEmpty.txt");
419+
nonEmptyFileName);
417420

418421
assertTrue(originalFile.exists());
419422
assertTrue(new File(uploadedFile.getStoragePath()).exists());
@@ -423,15 +426,17 @@ public void testUploadWithCopy() throws Exception {
423426
public void testUploadWithMove() throws Exception {
424427
init();
425428

426-
OCUpload ocUpload = new OCUpload(FileStorageUtils.getTemporalPath(account.name) + "/nonEmpty.txt",
427-
currentFolder.getRemotePath() + "nonEmpty.txt",
429+
OCUpload ocUpload = new OCUpload(FileStorageUtils.getInternalTemporalPath(account.name, targetContext)
430+
+ nonEmptyFileName,
431+
currentFolder.getRemotePath() + nonEmptyFileName,
428432
account.name);
429433

430434
uploadOCUpload(ocUpload, FileUploader.LOCAL_BEHAVIOUR_MOVE);
431435

432-
File originalFile = new File(FileStorageUtils.getTemporalPath(account.name) + "/nonEmpty.txt");
436+
File originalFile = new File(FileStorageUtils.getInternalTemporalPath(account.name, targetContext)
437+
+ nonEmptyFileName);
433438
OCFile uploadedFile = fileDataStorageManager.getFileByDecryptedRemotePath(currentFolder.getRemotePath() +
434-
"nonEmpty.txt");
439+
nonEmptyFileName);
435440

436441
assertFalse(originalFile.exists());
437442
assertTrue(new File(uploadedFile.getStoragePath()).exists());
@@ -441,15 +446,17 @@ public void testUploadWithMove() throws Exception {
441446
public void testUploadWithForget() throws Exception {
442447
init();
443448

444-
OCUpload ocUpload = new OCUpload(FileStorageUtils.getTemporalPath(account.name) + "/nonEmpty.txt",
445-
currentFolder.getRemotePath() + "nonEmpty.txt",
449+
OCUpload ocUpload = new OCUpload(FileStorageUtils.getInternalTemporalPath(account.name, targetContext)
450+
+ nonEmptyFileName,
451+
currentFolder.getRemotePath() + nonEmptyFileName,
446452
account.name);
447453

448454
uploadOCUpload(ocUpload, FileUploader.LOCAL_BEHAVIOUR_FORGET);
449455

450-
File originalFile = new File(FileStorageUtils.getTemporalPath(account.name) + "/nonEmpty.txt");
456+
File originalFile = new File(FileStorageUtils.getInternalTemporalPath(account.name, targetContext)
457+
+ nonEmptyFileName);
451458
OCFile uploadedFile = fileDataStorageManager.getFileByDecryptedRemotePath(currentFolder.getRemotePath() +
452-
"nonEmpty.txt");
459+
nonEmptyFileName);
453460

454461
assertTrue(originalFile.exists());
455462
assertFalse(new File(uploadedFile.getStoragePath()).exists());
@@ -459,15 +466,17 @@ public void testUploadWithForget() throws Exception {
459466
public void testUploadWithDelete() throws Exception {
460467
init();
461468

462-
OCUpload ocUpload = new OCUpload(FileStorageUtils.getTemporalPath(account.name) + "/nonEmpty.txt",
463-
currentFolder.getRemotePath() + "nonEmpty.txt",
469+
OCUpload ocUpload = new OCUpload(FileStorageUtils.getInternalTemporalPath(account.name, targetContext)
470+
+ nonEmptyFileName,
471+
currentFolder.getRemotePath() + nonEmptyFileName,
464472
account.name);
465473

466474
uploadOCUpload(ocUpload, FileUploader.LOCAL_BEHAVIOUR_DELETE);
467475

468-
File originalFile = new File(FileStorageUtils.getTemporalPath(account.name) + "/nonEmpty.txt");
476+
File originalFile = new File(FileStorageUtils.getInternalTemporalPath(account.name, targetContext)
477+
+ nonEmptyFileName);
469478
OCFile uploadedFile = fileDataStorageManager.getFileByDecryptedRemotePath(currentFolder.getRemotePath() +
470-
"nonEmpty.txt");
479+
nonEmptyFileName);
471480

472481
assertFalse(originalFile.exists());
473482
assertFalse(new File(uploadedFile.getStoragePath()).exists());

‎app/src/androidTest/java/com/owncloud/android/AbstractIT.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,7 @@ public void enableAccessibilityChecks() {
202202

203203
@After
204204
public void after() {
205-
fileDataStorageManager.removeLocalFiles(user, fileDataStorageManager);
205+
fileDataStorageManager.removeLocalFiles(user, fileDataStorageManager, targetContext);
206206
fileDataStorageManager.deleteAllFiles();
207207
}
208208

@@ -215,7 +215,7 @@ protected Account[] getAllAccounts() {
215215
}
216216

217217
protected static void createDummyFiles() throws IOException {
218-
File tempPath = new File(FileStorageUtils.getTemporalPath(account.name));
218+
File tempPath = new File(FileStorageUtils.getInternalTemporalPath(account.name, targetContext));
219219
if (!tempPath.exists()) {
220220
assertTrue(tempPath.mkdirs());
221221
}
@@ -253,7 +253,7 @@ protected static File getDummyFile(String name) throws IOException {
253253
}
254254

255255
public static File createFile(String name, int iteration) throws IOException {
256-
File file = new File(FileStorageUtils.getTemporalPath(account.name) + File.separator + name);
256+
File file = new File(FileStorageUtils.getInternalTemporalPath(account.name, targetContext) + File.separator + name);
257257
if (!file.getParentFile().exists()) {
258258
assertTrue(file.getParentFile().mkdirs());
259259
}

‎app/src/androidTest/java/com/owncloud/android/AbstractOnServerIT.java‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,11 @@
3030
import com.owncloud.android.lib.resources.files.RemoveFileRemoteOperation;
3131
import com.owncloud.android.lib.resources.files.model.RemoteFile;
3232
import com.owncloud.android.operations.RefreshFolderOperation;
33+
import com.owncloud.android.operations.SynchronizeFolderOperation;
3334
import com.owncloud.android.operations.UploadFileOperation;
3435

36+
import junit.framework.TestCase;
37+
3538
import org.apache.commons.httpclient.HttpStatus;
3639
import org.apache.commons.httpclient.methods.GetMethod;
3740
import org.junit.After;
@@ -227,8 +230,19 @@ public boolean isPowerSavingExclusionAvailable() {
227230
RemoteOperationResult result = newUpload.execute(client);
228231
assertTrue(result.getLogMessage(), result.isSuccess());
229232

230-
OCFile parentFolder = getStorageManager()
231-
.getFileByEncryptedRemotePath(new File(ocUpload.getRemotePath()).getParent() + "/");
233+
String parentFolderPath = (new File(ocUpload.getRemotePath()).getParent() + "/").replaceAll("//", "/");
234+
235+
OCFile parentFolder = getStorageManager().getFileByEncryptedRemotePath(parentFolderPath);
236+
237+
// Sync parent folder
238+
TestCase.assertTrue(new SynchronizeFolderOperation(targetContext,
239+
parentFolderPath,
240+
user,
241+
System.currentTimeMillis(),
242+
fileDataStorageManager)
243+
.execute(targetContext)
244+
.isSuccess());
245+
232246
String uploadedFileName = new File(ocUpload.getRemotePath()).getName();
233247
OCFile uploadedFile = getStorageManager().
234248
getFileByDecryptedRemotePath(parentFolder.getDecryptedRemotePath() + uploadedFileName);

‎app/src/androidTest/java/com/owncloud/android/DownloadIT.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,13 +73,15 @@ public void after() {
7373

7474
@Test
7575
public void verifyDownload() {
76-
OCUpload ocUpload = new OCUpload(FileStorageUtils.getTemporalPath(account.name) + "/nonEmpty.txt",
76+
OCUpload ocUpload = new OCUpload(FileStorageUtils.getInternalTemporalPath(account.name, targetContext)
77+
+ "/nonEmpty.txt",
7778
FOLDER + "nonEmpty.txt",
7879
account.name);
7980

8081
uploadOCUpload(ocUpload);
8182

82-
OCUpload ocUpload2 = new OCUpload(FileStorageUtils.getTemporalPath(account.name) + "/nonEmpty.txt",
83+
OCUpload ocUpload2 = new OCUpload(FileStorageUtils.getInternalTemporalPath(account.name, targetContext)
84+
+ "/nonEmpty.txt",
8385
FOLDER + "nonEmpty2.txt",
8486
account.name);
8587

‎app/src/androidTest/java/com/owncloud/android/FileIT.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
import com.owncloud.android.operations.RenameFileOperation;
88
import com.owncloud.android.operations.SynchronizeFolderOperation;
99
import com.owncloud.android.operations.common.SyncOperation;
10+
import com.owncloud.android.utils.FileStorageUtils;
1011

1112
import org.junit.Test;
1213
import org.junit.runner.RunWith;
@@ -118,7 +119,11 @@ public void testRenameFolder() throws IOException {
118119

119120
// Rename
120121
assertTrue(
121-
new RenameFileOperation(folderPath, "test123", fileDataStorageManager)
122+
new RenameFileOperation(folderPath,
123+
"test123",
124+
fileDataStorageManager,
125+
FileStorageUtils.getInternalTemporalPath("", targetContext)
126+
)
122127
.execute(targetContext)
123128
.isSuccess()
124129
);

0 commit comments

Comments
 (0)