Bug 386104

Summary: [Security] Integrate trash in the vault concept
Product: [Plasma] Plasma Vault Reporter: cryptodude
Component: generalAssignee: David Edmundson <kde>
Status: ASSIGNED ---    
Severity: grave CC: Morganent04, postix, realnc
Priority: NOR    
Version: unspecified   
Target Milestone: ---   
Platform: Other   
OS: Linux   
Latest Commit: Version Fixed In:
Sentry Crash Report:
Attachments: new table

Description cryptodude 2017-10-23 12:27:51 UTC
Should a user want to delete a file that is in his vault, she can use Dolphin or similar to move it to the kde-trash system.

This raises a security concern as this action copies the encrypted file to the trash directory which is unencrypted.

As such a user can compromise their security without realizing and closing the vault will not affect the deleted file.

I suggest integrating with the KDE trash system and creating a trash directory in the (mounted) vault and making sure that a move-to-trash action will move the file only inside the vault. Never outside of it.
Comment 1 Ivan Čukić 2019-03-22 20:32:59 UTC
Assigned and investigated. Almost fixed :)
Comment 2 David Edmundson 2019-03-22 20:48:54 UTC
Writing notes from some quick investigation.

Trash does identify that the top level of the mounted path is the top of the mounted encfs drive. It tries making a trash there.

It then uses solid to see if the device is known before using the local trash. This fails as it's not known to solid (see other bug here). 
This then falls back to using the home Trash with the rationale that you're probably in some tmpfs. 


Options are:
 - drop solid code from trash and use kmountinfo directly (which is an mtab wrapper)
 - make solid understand and list encfs mounts 
 - just disable trash
---

As for disabling trash:

The info dolphin uses to enable trash is:

        KFileItemListProperties capabilities(list);
        const bool enableMoveToTrash = capabilities.isLocal() && capabilities.supportsMoving();


It could be extended to check encfs/cryfs
Comment 3 postix 2020-08-05 15:32:05 UTC
(In reply to Ivan Čukić from comment #1)
> Assigned and investigated. Almost fixed :)

Are we there yet? Still working on it? :)
Comment 4 Morganent04@outlook.com 2021-01-22 05:54:29 UTC
Created attachment 135050 [details]
new table
Comment 5 Morganent04@outlook.com 2021-01-22 05:55:02 UTC
Comment on attachment 135050 [details]
new table

>/*
>
> Copyright The Closure Library Authors.
> SPDX-License-Identifier: Apache-2.0
>*/
>var m=this||self,w=function(a,b){a=a.split(".");var c=m;a[0]in c||"undefined"==typeof c.execScript||c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length||void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b},x=function(a,b){function c(){}c.prototype=b.prototype;a.A=b.prototype;a.prototype=new c;a.prototype.constructor=a;a.v=function(d,e,h){for(var l=Array(arguments.length-2),n=2;n<arguments.length;n++)l[n-2]=arguments[n];return b.prototype[e].apply(d,l)}};function y(a){if(Error.captureStackTrace)Error.captureStackTrace(this,y);else{var b=Error().stack;b&&(this.stack=b)}a&&(this.message=String(a))}x(y,Error);y.prototype.name="CustomError";var z=function(a,b){a=a.split("%s");for(var c="",d=a.length-1,e=0;e<d;e++)c+=a[e]+(e<b.length?b[e]:"%s");y.call(this,c+a[d])};x(z,y);z.prototype.name="AssertionError";var B=function(a,b,c){if(!a){var d="Assertion failed";if(b){d+=": "+b;var e=Array.prototype.slice.call(arguments,2)}throw new z(""+d,e||[]);}return a};var C=Array.prototype.forEach?function(a,b){B(null!=a.length);Array.prototype.forEach.call(a,b,void 0)}:function(a,b){for(var c=a.length,d="string"===typeof a?a.split(""):a,e=0;e<c;e++)e in d&&b.call(void 0,d[e],e,a)};var D;a:{var F=m.navigator;if(F){var G=F.userAgent;if(G){D=G;break a}}D=""}var H=function(a){return-1!=D.indexOf(a)};var aa=-1!=D.toLowerCase().indexOf("webkit")&&!H("Edge")&&H("Mobile");try{(new self.OffscreenCanvas(0,0)).getContext("2d")}catch(a){};var ba=H("Safari")&&!((H("Chrome")||H("CriOS"))&&!H("Edge")||H("Coast")||H("Opera")||H("Edge")||H("Edg/")||H("OPR")||H("Firefox")||H("FxiOS")||H("Silk")||H("Android"))&&!(H("iPhone")&&!H("iPod")&&!H("iPad")||H("iPad")||H("iPod"));var K=function(a){var b=window;if(aa&&ba&&b){b.focus();var c=0,d=null;d=b.setInterval(function(){a.closed||5==c?(b.clearInterval(d),I(a)):(a.close(),c++)},150)}else a.close(),I(a)},I=function(a){if(!a.closed&&a.document&&a.document.body)if(a=a.document.body,B(null!=a,"goog.dom.setTextContent expects a non-null value for node"),"textContent"in a)a.textContent="Please close this window.";else if(3==a.nodeType)a.data="Please close this window.";else if(a.firstChild&&3==a.firstChild.nodeType){for(;a.lastChild!=
>a.firstChild;)a.removeChild(B(a.lastChild));a.firstChild.data="Please close this window."}else{for(var b;b=a.firstChild;)a.removeChild(b);B(a,"Node cannot be null or undefined.");a.appendChild((9==a.nodeType?a:a.ownerDocument||a.document).createTextNode("Please close this window."))}};var ca=function(){function a(){e[0]=1732584193;e[1]=4023233417;e[2]=2562383102;e[3]=271733878;e[4]=3285377520;u=q=0}function b(g){for(var k=l,f=0;64>f;f+=4)k[f/4]=g[f]<<24|g[f+1]<<16|g[f+2]<<8|g[f+3];for(f=16;80>f;f++)g=k[f-3]^k[f-8]^k[f-14]^k[f-16],k[f]=(g<<1|g>>>31)&4294967295;g=e[0];var p=e[1],r=e[2],t=e[3],J=e[4];for(f=0;80>f;f++){if(40>f)if(20>f){var v=t^p&(r^t);var E=1518500249}else v=p^r^t,E=1859775393;else 60>f?(v=p&r|t&(p|r),E=2400959708):(v=p^r^t,E=3395469782);v=((g<<5|g>>>27)&4294967295)+
>v+J+E+k[f]&4294967295;J=t;t=r;r=(p<<30|p>>>2)&4294967295;p=g;g=v}e[0]=e[0]+g&4294967295;e[1]=e[1]+p&4294967295;e[2]=e[2]+r&4294967295;e[3]=e[3]+t&4294967295;e[4]=e[4]+J&4294967295}function c(g,k){if("string"===typeof g){g=unescape(encodeURIComponent(g));for(var f=[],p=0,r=g.length;p<r;++p)f.push(g.charCodeAt(p));g=f}k||(k=g.length);f=0;if(0==q)for(;f+64<k;)b(g.slice(f,f+64)),f+=64,u+=64;for(;f<k;)if(h[q++]=g[f++],u++,64==q)for(q=0,b(h);f+64<k;)b(g.slice(f,f+64)),f+=64,u+=64}function d(){var g=[],
>k=8*u;56>q?c(n,56-q):c(n,64-(q-56));for(var f=63;56<=f;f--)h[f]=k&255,k>>>=8;b(h);for(f=k=0;5>f;f++)for(var p=24;0<=p;p-=8)g[k++]=e[f]>>p&255;return g}for(var e=[],h=[],l=[],n=[128],A=1;64>A;++A)n[A]=0;var q,u;a();return{reset:a,update:c,digest:d,digestString:function(){for(var g=d(),k="",f=0;f<g.length;f++)k+="0123456789ABCDEF".charAt(Math.floor(g[f]/16))+"0123456789ABCDEF".charAt(g[f]%16);return k}}};var da=function(a,b,c){var d=[];if(1==(Array.isArray(null)?2:1))return d=[b,a],C(c,function(n){d.push(n)}),L(d.join(" "));var e=[],h=[];C(null,function(n){h.push(n.key);e.push(n.value)});var l=Math.floor((new Date).getTime()/1E3);d=0==e.length?[l,b,a]:[e.join(":"),l,b,a];C(c,function(n){d.push(n)});a=L(d.join(" "));l=[l,a];0==h.length||l.push(h.join(""));return l.join("_")},L=function(a){var b=ca();b.update(a);return b.digestString().toLowerCase()};var M=function(a){a=a||[];for(var b=[],c=0,d=a.length;c<d;++c){var e=String(a[c]||"");e&&b.push(e)}if(2>b.length)return null;a=b[0];c=gadgets.rpc.getOrigin(b[1]);if(c!==b[1])return null;b=b.slice(2);if(c&&a){if(d=c){d=d.split("#")[0].split("?")[0];d=d.toLowerCase();0==d.indexOf("//")&&(d=window.location.protocol+d);/^[\w\-]*:\/\//.test(d)||(d=window.location.href);c=d.substring(d.indexOf("://")+3);e=c.indexOf("/");-1!=e&&(c=c.substring(0,e));d=d.substring(0,d.indexOf("://"));if("http"!==d&&"https"!==
>d&&"chrome-extension"!==d&&"moz-extension"!==d&&"file"!==d&&"android-app"!==d&&"chrome-search"!==d&&"chrome-untrusted"!==d&&"chrome"!==d&&"app"!==d&&"devtools"!==d)throw Error("Invalid URI scheme in origin: "+d);e="";var h=c.indexOf(":");if(-1!=h){var l=c.substring(h+1);c=c.substring(0,h);if("http"===d&&"80"!==l||"https"===d&&"443"!==l)e=":"+l}c=d+"://"+c+e}else c="";a=["session_state",da(c,a,b||[])].join(" ")}else a=null;return(a=a||"")&&a.substr(14)||null},N=function(a,b,c){this.o=String(a||"");
>this.j=String(b||"");this.h=String(c||"");this.g={};this.s=this.u=this.l=this.m="";this.i=null};
>N.prototype.evaluate=function(){var a={},b="";try{b=String(document.cookie||"")}catch(l){}b=b.split("; ").join(";").split(";");for(var c=0,d=b.length;c<d;++c){var e=b[c],h=e.indexOf("=");-1!=h?a[e.substr(0,h)]=e.substr(h+1):a[e]=null}this.g=a;if(this.g.SAPISID||this.g.APISID||this.g["__Secure-3PAPISID"]||this.g.SID)if(this.j=this.j.split(".")[0].split("@")[0],this.l=O(this,this.o))if(a=gadgets.rpc.getOrigin(String(window.location.href)),this.m=O(this,a)){b=String(this.g.LSOLH||"").split(":");c=b.length;
>if(1==c||4==c)this.u=b[0];if(3==c||4==c)a=String(b[c-3]||""),b=String(b[c-1]||""),c=this.m,a?(d=[a],c&&d.push(c),c=L(d.join(" ")).substr(0,4)):c=null,c===b&&(this.s=a);this.h&&(a=this.h.indexOf("."),-1!=a&&(a=this.h.substr(0,a)||"",this.h=a+"."+M([this.l,this.o,this.j,this.u,this.s,a]).substr(0,4)));a=M([this.l,this.o,this.j,this.h]);this.h&&(a=a+"."+this.h);this.i=a}else this.i="";else this.i=""};
>var O=function(a,b){(b=String(a.g[0==b.indexOf("https://")?"SAPISID":"APISID"]||""))||(b=String(a.g["__Secure-3PAPISID"]||""));return b};N.prototype.getVersionInfo=function(a){var b=parseInt(a,10);if(String(b)!=a||!(0<=b))return null;a=this.s;if(!a)return null;a=a.split("|");return a.length<=b?null:a[b]||null};
>var P=function(a,b,c){a=new N(a,b,c);a.evaluate();return a},R=function(a,b,c){c=c||Q(this);var d=null;if(a){a=String(a);var e=a.indexOf(".");-1!=e&&(d=a.substr(e+1))}b=P(c,b,d).i;if(null==a||""==a)a=b==a;else if(null==b||b.length!=a.length)a=!1;else{d=c=0;for(e=a.length;d<e;++d)c|=a.charCodeAt(d)^b.charCodeAt(d);a=0==c}return a},S=function(a,b,c){c=c||Q(this);c=P(c);if(String(a)!=c.i)throw Error("Unauthorized request");return c.getVersionInfo(String(b))},Q=function(a){a=String(a.origin||"");if(!a)throw Error("RPC has no origin.");
>return a};w("checkSessionState",R);w("getVersionInfo",S);var T,U,V,W,X,Y,ea=window,Z=(window.location.href||ea.location.href).match(/.*(\?|#|&)usegapi=([^&#]+)/)||[];
>"1"===decodeURIComponent(Z[Z.length-1]||"")?(V=function(a,b,c,d,e,h){T.send(b,e,d,h||gapi.iframes.CROSS_ORIGIN_IFRAMES_FILTER)},W=function(a,b){T.register(a,b,gapi.iframes.CROSS_ORIGIN_IFRAMES_FILTER)},X=function(a){var b=/^(?:https?:\/\/)?[0-9.\-A-Za-z]+(?::\d+)?/.exec(a);b=gapi.iframes.makeWhiteListIframesFilter([b?b[0]:null]);V("..","oauth2callback",gadgets.rpc.getAuthToken(".."),void 0,a,b)},U=function(){fa()},Y=function(){V("..","oauth2relayReady",gadgets.rpc.getAuthToken(".."));W("check_session_state",
>ha);W("get_versioninfo",ia)}):(V=function(a,b,c,d,e){gadgets.rpc.call(a,b+":"+c,d,e)},W=function(a,b){gadgets.rpc.register(a,b)},X=function(a){gadgets.rpc.getTargetOrigin("..")==gadgets.rpc.getOrigin(a)&&V("..","oauth2callback",gadgets.rpc.getAuthToken(".."),void 0,a)},U=function(){Y()},Y=function(){V("..","oauth2relayReady",gadgets.rpc.getAuthToken(".."));W("check_session_state",R);W("get_versioninfo",S)});
>var fa=function(){var a=Y;window.gapi.load("gapi.iframes",function(){T=gapi.iframes.getContext().getParentIframe();a()})},ja=function(a){window.setTimeout(function(){X(a)},1)},ha=function(a){if(a){var b=a.session_state;var c=a.client_id}return R(b,c,T.getOrigin())},ia=function(a){return S(a.xapisidHash,a.sessionIndex,T.getOrigin())},ka=!1,la=!1,ma=function(){la=!0;ka&&U()};w("oauth2callback",ja);
>w("oauth2verify",function(a,b){var c=window.open("about:blank",a),d;if(c&&!c.closed&&(d=c.oauth2callbackUrl))return window.timeoutMap=window.timeoutMap||{},window.realSetTimeout=window.realSetTimeout||window.setTimeout,window.setTimeout=function(e,h){try{var l=e,n=!1;e=function(){if(!n){n=!0;try{window.timeoutMap[String(q)]=void 0,delete window.timeoutMap[String(q)]}catch(u){}return l.call(this)}};var A=c.setTimeout(e,h);var q=window.realSetTimeout(e,h);window.timeoutMap[String(q)]=A;return q}catch(u){}return window.realSetTimeout(e,
>h)},window.realClearTimeout=window.realClearTimeout||window.clearTimeout,window.clearTimeout=function(e){try{var h=window.timeoutMap[String(e)];h&&c.clearTimeout(h)}catch(l){}try{window.timeoutMap[String(e)]=void 0,delete window.timeoutMap[String(e)]}catch(l){}window.realClearTimeout(e)},ja(String(d)),"keep_open"!=b&&K(c),!0;c&&!c.closed&&K(c);return!1});w("init",function(){ka=!0;la&&U()});window.addEventListener?window.addEventListener("load",ma,!1):window.attachEvent("onload",ma);
Comment 6 Ben Bonacci 2023-03-24 09:49:36 UTC
*** Bug 447214 has been marked as a duplicate of this bug. ***