Bug 386104 - [Security] Integrate trash in the vault concept
Summary: [Security] Integrate trash in the vault concept
Status: ASSIGNED
Alias: None
Product: Plasma Vault
Classification: Plasma
Component: general (show other bugs)
Version: unspecified
Platform: Other Linux
: NOR grave
Target Milestone: ---
Assignee: David Edmundson
URL:
Keywords:
: 447214 (view as bug list)
Depends on:
Blocks:
 
Reported: 2017-10-23 12:27 UTC by cryptodude
Modified: 2023-03-24 09:49 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
new table (9.60 KB, text/x-csrc)
2021-01-22 05:54 UTC, Morganent04@outlook.com
Details

Note You need to log in before you can comment on or make changes to this bug.
Description cryptodude 2017-10-23 12:27:51 UTC
Should a user want to delete a file that is in his vault, she can use Dolphin or similar to move it to the kde-trash system.

This raises a security concern as this action copies the encrypted file to the trash directory which is unencrypted.

As such a user can compromise their security without realizing and closing the vault will not affect the deleted file.

I suggest integrating with the KDE trash system and creating a trash directory in the (mounted) vault and making sure that a move-to-trash action will move the file only inside the vault. Never outside of it.
Comment 1 Ivan Čukić 2019-03-22 20:32:59 UTC
Assigned and investigated. Almost fixed :)
Comment 2 David Edmundson 2019-03-22 20:48:54 UTC
Writing notes from some quick investigation.

Trash does identify that the top level of the mounted path is the top of the mounted encfs drive. It tries making a trash there.

It then uses solid to see if the device is known before using the local trash. This fails as it's not known to solid (see other bug here). 
This then falls back to using the home Trash with the rationale that you're probably in some tmpfs. 


Options are:
 - drop solid code from trash and use kmountinfo directly (which is an mtab wrapper)
 - make solid understand and list encfs mounts 
 - just disable trash
---

As for disabling trash:

The info dolphin uses to enable trash is:

        KFileItemListProperties capabilities(list);
        const bool enableMoveToTrash = capabilities.isLocal() && capabilities.supportsMoving();


It could be extended to check encfs/cryfs
Comment 3 postix 2020-08-05 15:32:05 UTC
(In reply to Ivan Čukić from comment #1)
> Assigned and investigated. Almost fixed :)

Are we there yet? Still working on it? :)
Comment 4 Morganent04@outlook.com 2021-01-22 05:54:29 UTC
Created attachment 135050 [details]
new table
Comment 5 Morganent04@outlook.com 2021-01-22 05:55:02 UTC
Comment on attachment 135050 [details]
new table

>/*
>
> Copyright The Closure Library Authors.
> SPDX-License-Identifier: Apache-2.0
>*/
>var m=this||self,w=function(a,b){a=a.split(".");var c=m;a[0]in c||"undefined"==typeof c.execScript||c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length||void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b},x=function(a,b){function c(){}c.prototype=b.prototype;a.A=b.prototype;a.prototype=new c;a.prototype.constructor=a;a.v=function(d,e,h){for(var l=Array(arguments.length-2),n=2;n<arguments.length;n++)l[n-2]=arguments[n];return b.prototype[e].apply(d,l)}};function y(a){if(Error.captureStackTrace)Error.captureStackTrace(this,y);else{var b=Error().stack;b&&(this.stack=b)}a&&(this.message=String(a))}x(y,Error);y.prototype.name="CustomError";var z=function(a,b){a=a.split("%s");for(var c="",d=a.length-1,e=0;e<d;e++)c+=a[e]+(e<b.length?b[e]:"%s");y.call(this,c+a[d])};x(z,y);z.prototype.name="AssertionError";var B=function(a,b,c){if(!a){var d="Assertion failed";if(b){d+=": "+b;var e=Array.prototype.slice.call(arguments,2)}throw new z(""+d,e||[]);}return a};var C=Array.prototype.forEach?function(a,b){B(null!=a.length);Array.prototype.forEach.call(a,b,void 0)}:function(a,b){for(var c=a.length,d="string"===typeof a?a.split(""):a,e=0;e<c;e++)e in d&&b.call(void 0,d[e],e,a)};var D;a:{var F=m.navigator;if(F){var G=F.userAgent;if(G){D=G;break a}}D=""}var H=function(a){return-1!=D.indexOf(a)};var aa=-1!=D.toLowerCase().indexOf("webkit")&&!H("Edge")&&H("Mobile");try{(new self.OffscreenCanvas(0,0)).getContext("2d")}catch(a){};var ba=H("Safari")&&!((H("Chrome")||H("CriOS"))&&!H("Edge")||H("Coast")||H("Opera")||H("Edge")||H("Edg/")||H("OPR")||H("Firefox")||H("FxiOS")||H("Silk")||H("Android"))&&!(H("iPhone")&&!H("iPod")&&!H("iPad")||H("iPad")||H("iPod"));var K=function(a){var b=window;if(aa&&ba&&b){b.focus();var c=0,d=null;d=b.setInterval(function(){a.closed||5==c?(b.clearInterval(d),I(a)):(a.close(),c++)},150)}else a.close(),I(a)},I=function(a){if(!a.closed&&a.document&&a.document.body)if(a=a.document.body,B(null!=a,"goog.dom.setTextContent expects a non-null value for node"),"textContent"in a)a.textContent="Please close this window.";else if(3==a.nodeType)a.data="Please close this window.";else if(a.firstChild&&3==a.firstChild.nodeType){for(;a.lastChild!=
>a.firstChild;)a.removeChild(B(a.lastChild));a.firstChild.data="Please close this window."}else{for(var b;b=a.firstChild;)a.removeChild(b);B(a,"Node cannot be null or undefined.");a.appendChild((9==a.nodeType?a:a.ownerDocument||a.document).createTextNode("Please close this window."))}};var ca=function(){function a(){e[0]=1732584193;e[1]=4023233417;e[2]=2562383102;e[3]=271733878;e[4]=3285377520;u=q=0}function b(g){for(var k=l,f=0;64>f;f+=4)k[f/4]=g[f]<<24|g[f+1]<<16|g[f+2]<<8|g[f+3];for(f=16;80>f;f++)g=k[f-3]^k[f-8]^k[f-14]^k[f-16],k[f]=(g<<1|g>>>31)&4294967295;g=e[0];var p=e[1],r=e[2],t=e[3],J=e[4];for(f=0;80>f;f++){if(40>f)if(20>f){var v=t^p&(r^t);var E=1518500249}else v=p^r^t,E=1859775393;else 60>f?(v=p&r|t&(p|r),E=2400959708):(v=p^r^t,E=3395469782);v=((g<<5|g>>>27)&4294967295)+
>v+J+E+k[f]&4294967295;J=t;t=r;r=(p<<30|p>>>2)&4294967295;p=g;g=v}e[0]=e[0]+g&4294967295;e[1]=e[1]+p&4294967295;e[2]=e[2]+r&4294967295;e[3]=e[3]+t&4294967295;e[4]=e[4]+J&4294967295}function c(g,k){if("string"===typeof g){g=unescape(encodeURIComponent(g));for(var f=[],p=0,r=g.length;p<r;++p)f.push(g.charCodeAt(p));g=f}k||(k=g.length);f=0;if(0==q)for(;f+64<k;)b(g.slice(f,f+64)),f+=64,u+=64;for(;f<k;)if(h[q++]=g[f++],u++,64==q)for(q=0,b(h);f+64<k;)b(g.slice(f,f+64)),f+=64,u+=64}function d(){var g=[],
>k=8*u;56>q?c(n,56-q):c(n,64-(q-56));for(var f=63;56<=f;f--)h[f]=k&255,k>>>=8;b(h);for(f=k=0;5>f;f++)for(var p=24;0<=p;p-=8)g[k++]=e[f]>>p&255;return g}for(var e=[],h=[],l=[],n=[128],A=1;64>A;++A)n[A]=0;var q,u;a();return{reset:a,update:c,digest:d,digestString:function(){for(var g=d(),k="",f=0;f<g.length;f++)k+="0123456789ABCDEF".charAt(Math.floor(g[f]/16))+"0123456789ABCDEF".charAt(g[f]%16);return k}}};var da=function(a,b,c){var d=[];if(1==(Array.isArray(null)?2:1))return d=[b,a],C(c,function(n){d.push(n)}),L(d.join(" "));var e=[],h=[];C(null,function(n){h.push(n.key);e.push(n.value)});var l=Math.floor((new Date).getTime()/1E3);d=0==e.length?[l,b,a]:[e.join(":"),l,b,a];C(c,function(n){d.push(n)});a=L(d.join(" "));l=[l,a];0==h.length||l.push(h.join(""));return l.join("_")},L=function(a){var b=ca();b.update(a);return b.digestString().toLowerCase()};var M=function(a){a=a||[];for(var b=[],c=0,d=a.length;c<d;++c){var e=String(a[c]||"");e&&b.push(e)}if(2>b.length)return null;a=b[0];c=gadgets.rpc.getOrigin(b[1]);if(c!==b[1])return null;b=b.slice(2);if(c&&a){if(d=c){d=d.split("#")[0].split("?")[0];d=d.toLowerCase();0==d.indexOf("//")&&(d=window.location.protocol+d);/^[\w\-]*:\/\//.test(d)||(d=window.location.href);c=d.substring(d.indexOf("://")+3);e=c.indexOf("/");-1!=e&&(c=c.substring(0,e));d=d.substring(0,d.indexOf("://"));if("http"!==d&&"https"!==
>d&&"chrome-extension"!==d&&"moz-extension"!==d&&"file"!==d&&"android-app"!==d&&"chrome-search"!==d&&"chrome-untrusted"!==d&&"chrome"!==d&&"app"!==d&&"devtools"!==d)throw Error("Invalid URI scheme in origin: "+d);e="";var h=c.indexOf(":");if(-1!=h){var l=c.substring(h+1);c=c.substring(0,h);if("http"===d&&"80"!==l||"https"===d&&"443"!==l)e=":"+l}c=d+"://"+c+e}else c="";a=["session_state",da(c,a,b||[])].join(" ")}else a=null;return(a=a||"")&&a.substr(14)||null},N=function(a,b,c){this.o=String(a||"");
>this.j=String(b||"");this.h=String(c||"");this.g={};this.s=this.u=this.l=this.m="";this.i=null};
>N.prototype.evaluate=function(){var a={},b="";try{b=String(document.cookie||"")}catch(l){}b=b.split("; ").join(";").split(";");for(var c=0,d=b.length;c<d;++c){var e=b[c],h=e.indexOf("=");-1!=h?a[e.substr(0,h)]=e.substr(h+1):a[e]=null}this.g=a;if(this.g.SAPISID||this.g.APISID||this.g["__Secure-3PAPISID"]||this.g.SID)if(this.j=this.j.split(".")[0].split("@")[0],this.l=O(this,this.o))if(a=gadgets.rpc.getOrigin(String(window.location.href)),this.m=O(this,a)){b=String(this.g.LSOLH||"").split(":");c=b.length;
>if(1==c||4==c)this.u=b[0];if(3==c||4==c)a=String(b[c-3]||""),b=String(b[c-1]||""),c=this.m,a?(d=[a],c&&d.push(c),c=L(d.join(" ")).substr(0,4)):c=null,c===b&&(this.s=a);this.h&&(a=this.h.indexOf("."),-1!=a&&(a=this.h.substr(0,a)||"",this.h=a+"."+M([this.l,this.o,this.j,this.u,this.s,a]).substr(0,4)));a=M([this.l,this.o,this.j,this.h]);this.h&&(a=a+"."+this.h);this.i=a}else this.i="";else this.i=""};
>var O=function(a,b){(b=String(a.g[0==b.indexOf("https://")?"SAPISID":"APISID"]||""))||(b=String(a.g["__Secure-3PAPISID"]||""));return b};N.prototype.getVersionInfo=function(a){var b=parseInt(a,10);if(String(b)!=a||!(0<=b))return null;a=this.s;if(!a)return null;a=a.split("|");return a.length<=b?null:a[b]||null};
>var P=function(a,b,c){a=new N(a,b,c);a.evaluate();return a},R=function(a,b,c){c=c||Q(this);var d=null;if(a){a=String(a);var e=a.indexOf(".");-1!=e&&(d=a.substr(e+1))}b=P(c,b,d).i;if(null==a||""==a)a=b==a;else if(null==b||b.length!=a.length)a=!1;else{d=c=0;for(e=a.length;d<e;++d)c|=a.charCodeAt(d)^b.charCodeAt(d);a=0==c}return a},S=function(a,b,c){c=c||Q(this);c=P(c);if(String(a)!=c.i)throw Error("Unauthorized request");return c.getVersionInfo(String(b))},Q=function(a){a=String(a.origin||"");if(!a)throw Error("RPC has no origin.");
>return a};w("checkSessionState",R);w("getVersionInfo",S);var T,U,V,W,X,Y,ea=window,Z=(window.location.href||ea.location.href).match(/.*(\?|#|&)usegapi=([^&#]+)/)||[];
>"1"===decodeURIComponent(Z[Z.length-1]||"")?(V=function(a,b,c,d,e,h){T.send(b,e,d,h||gapi.iframes.CROSS_ORIGIN_IFRAMES_FILTER)},W=function(a,b){T.register(a,b,gapi.iframes.CROSS_ORIGIN_IFRAMES_FILTER)},X=function(a){var b=/^(?:https?:\/\/)?[0-9.\-A-Za-z]+(?::\d+)?/.exec(a);b=gapi.iframes.makeWhiteListIframesFilter([b?b[0]:null]);V("..","oauth2callback",gadgets.rpc.getAuthToken(".."),void 0,a,b)},U=function(){fa()},Y=function(){V("..","oauth2relayReady",gadgets.rpc.getAuthToken(".."));W("check_session_state",
>ha);W("get_versioninfo",ia)}):(V=function(a,b,c,d,e){gadgets.rpc.call(a,b+":"+c,d,e)},W=function(a,b){gadgets.rpc.register(a,b)},X=function(a){gadgets.rpc.getTargetOrigin("..")==gadgets.rpc.getOrigin(a)&&V("..","oauth2callback",gadgets.rpc.getAuthToken(".."),void 0,a)},U=function(){Y()},Y=function(){V("..","oauth2relayReady",gadgets.rpc.getAuthToken(".."));W("check_session_state",R);W("get_versioninfo",S)});
>var fa=function(){var a=Y;window.gapi.load("gapi.iframes",function(){T=gapi.iframes.getContext().getParentIframe();a()})},ja=function(a){window.setTimeout(function(){X(a)},1)},ha=function(a){if(a){var b=a.session_state;var c=a.client_id}return R(b,c,T.getOrigin())},ia=function(a){return S(a.xapisidHash,a.sessionIndex,T.getOrigin())},ka=!1,la=!1,ma=function(){la=!0;ka&&U()};w("oauth2callback",ja);
>w("oauth2verify",function(a,b){var c=window.open("about:blank",a),d;if(c&&!c.closed&&(d=c.oauth2callbackUrl))return window.timeoutMap=window.timeoutMap||{},window.realSetTimeout=window.realSetTimeout||window.setTimeout,window.setTimeout=function(e,h){try{var l=e,n=!1;e=function(){if(!n){n=!0;try{window.timeoutMap[String(q)]=void 0,delete window.timeoutMap[String(q)]}catch(u){}return l.call(this)}};var A=c.setTimeout(e,h);var q=window.realSetTimeout(e,h);window.timeoutMap[String(q)]=A;return q}catch(u){}return window.realSetTimeout(e,
>h)},window.realClearTimeout=window.realClearTimeout||window.clearTimeout,window.clearTimeout=function(e){try{var h=window.timeoutMap[String(e)];h&&c.clearTimeout(h)}catch(l){}try{window.timeoutMap[String(e)]=void 0,delete window.timeoutMap[String(e)]}catch(l){}window.realClearTimeout(e)},ja(String(d)),"keep_open"!=b&&K(c),!0;c&&!c.closed&&K(c);return!1});w("init",function(){ka=!0;la&&U()});window.addEventListener?window.addEventListener("load",ma,!1):window.attachEvent("onload",ma);
Comment 6 Ben Bonacci 2023-03-24 09:49:36 UTC
*** Bug 447214 has been marked as a duplicate of this bug. ***