Bug 446264

Summary:	cli plugins extraction can cause file loss
Product:	[Applications] ark	Reporter:	krab <alexey.ivanes>
Component:	plugins	Assignee:	Ragnar Thomsen <rthomsen6>
Status:	REPORTED ---
Severity:	normal	CC:	aacid, elvis.angelaccio
Priority:	NOR
Version First Reported In:	unspecified
Target Milestone:	---
Platform:	Other
OS:	Linux
Latest Commit:		Version Fixed In:
Sentry Crash Report:
Attachments:	Password is 123

Description krab 2021-11-30 02:18:51 UTC

Thats bug probably CLI plugins only like info-zip and p7zip.

1. With libzipplugin enabled create new encrypted AES256 archive with Zstd compression method.
2. Disable all plugins but left only info-zip for first extraction test and p7zip-only for second test.
3. Close ark and dolphins or simply logout/login so it will reload enabled plugins configuration.
4. Try to extract that archive in same folder with data.
5. It will accept any password (even wrong one) and click on "overwrite" old original data will be gone with 0 bytes length data.
6. Successful exit, data lost.

Comment 1 Albert Astals Cid 2021-11-30 21:19:00 UTC

Could you please provide such a file for us to test?

Comment 2 krab 2021-11-30 22:06:15 UTC

Created attachment 144103 [details]
Password is 123

Comment 3 Albert Astals Cid 2021-11-30 22:39:17 UTC

Which ark version are you using?

I get "Extraction failed due to unsupported encryption method." when trying that with kerfuffle_clizip.so and with kerfuffle_cli7z.so it just works fine

Comment 4 2wxsy58236r3 2021-12-02 07:06:21 UTC

I tested using p7zip 7z / 7-Zip 7zz and also Ark with p7zip plugin, and I guess it may be related to upstream issues, e.g.
- https://sourceforge.net/p/p7zip/bugs/105/
- https://sourceforge.net/p/sevenzip/bugs/2316/

However, I guess Ark may also have an issue - Ark does not show the "Unsupported Method" error returned by p7zip.

Password issue: Maybe upstream issue
Empty files issue: Maybe upstream issue
Unsupported method issue: Maybe Ark issue

----- ----- -----
Case 1 - ZIP using Deflate and AES256:
If using p7zip plugin to extract the file, and a wrong password is entered, Ark shows an error that the password is incorrect, but empty (0B) files are still created.
If using Info-Zip plugin to extract the file, Ark shows an error that the encryption method is unsupported.
If using p7zip 7z / 7-Zip 7zz to extract the file, and a wrong password is entered, it shows "ERROR: Wrong password" but empty files are still created.

Case 2 - ZIP using Zstd and AES256:
If using p7zip plugin to extract the file, and ...
Wrong password is entered: Ark does not show an error that the password is incorrect or the compression method is unsupported, empty files are still created.
Correct password is entered: Ark does not show an error that the compression method is unsupported, empty files are still created.
If using Info-Zip plugin to extract the file, Ark shows an error that the encryption method is unsupported.
If using p7zip 7z / 7-Zip 7zz to extract the file, and ...
Wrong password is entered: p7zip does not show "ERROR: Wrong password", only "ERROR: Unsupported Method", empty files are still created.
Correct password is entered: it shows "ERROR: Unsupported Method", empty files are still created.

Case 3 - ZIP using Zstd and unencrypted:
If using p7zip plugin to extract the file, Ark does not show an error that the compression method is unsupported, empty files are still created.
If using Info-Zip plugin to extract the file, Ark shows an error that the compression method is unsupported.
If using p7zip 7z / 7-Zip 7zz to extract the file, it shows "ERROR: Unsupported Method".
----- ----- -----
Test environment:
- Ark 21.08.3
- p7zip 16.02 (Original p7zip)
- 7-Zip 21.06 (developed by Igor Pavlov) (see also Bug 440135)
----- ----- -----

Note:
Some distros (e.g. Arch Linux) provide jinfeihan57's fork of p7zip (https://github.com/jinfeihan57/p7zip).
That fork supports Zstd in ZIP while the original p7zip does not support Zstd in ZIP.

Comment 5 Albert Astals Cid 2021-12-02 18:08:41 UTC

I have no interest in debugging problems with unmaintained p7zip, i'd suggest you save you trouble and move to the maintained one, but I am not even a big contributor to Ark, so I'll leave this in reported in case someone else wants to have a look :)