diff --git a/src/main/java/org/cryptomator/launcher/VaultTemplateExtractor.java b/src/main/java/org/cryptomator/launcher/VaultTemplateExtractor.java new file mode 100644 index 000000000..6dac28d66 --- /dev/null +++ b/src/main/java/org/cryptomator/launcher/VaultTemplateExtractor.java @@ -0,0 +1,160 @@ +package org.cryptomator.launcher; + +import org.cryptomator.common.Constants; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import java.io.IOException; +import java.nio.file.AtomicMoveNotSupportedException; +import java.nio.file.FileAlreadyExistsException; +import java.nio.file.FileSystem; +import java.nio.file.FileSystems; +import java.nio.file.FileVisitResult; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.SimpleFileVisitor; +import java.nio.file.StandardCopyOption; +import java.nio.file.attribute.BasicFileAttributes; +import java.util.Comparator; +import java.util.Set; +import java.util.concurrent.atomic.AtomicReference; +import java.util.stream.Stream; + +/** + * Unpacks a vault template (a ZIP archive holding a ready-made vault) and moves the contained vault to a destination. + *

+ * The archive is expanded into a temporary directory using the Java ZIP {@link FileSystem}, and the vault directory + * (identified by containing a {@value Constants#VAULTCONFIG_FILENAME} file) is then moved to the destination in a single + * step, so the vault only ever appears complete at its final location. + */ +public final class VaultTemplateExtractor { + + private static final Logger LOG = LoggerFactory.getLogger(VaultTemplateExtractor.class); + + private VaultTemplateExtractor() { + } + + /** + * Unpacks the given template and moves the contained vault to {@code destination}. + * + * @param template the ZIP archive bytes + * @param destination the target vault directory, which must not yet exist + * @return {@code destination} + * @throws IOException if the template is not a valid ZIP, contains no vault, the destination already exists, or the + * files cannot be written or moved + */ + public static Path extractAndMove(byte[] template, Path destination) throws IOException { + if (Files.exists(destination)) { + throw new FileAlreadyExistsException(destination.toString()); + } + Path tmpZip = Files.createTempFile("vault-template-", ".zip"); + Path tmpDir = Files.createTempDirectory("vault-template-"); + try { + Files.write(tmpZip, template); + Path vaultRoot = unzip(tmpZip, tmpDir); + Path parent = destination.getParent(); + if (parent != null) { + Files.createDirectories(parent); + } + move(vaultRoot, destination); + return destination; + } finally { + deleteQuietly(tmpDir); + deleteQuietly(tmpZip); + } + } + + private static Path unzip(Path zipFile, Path targetDir) throws IOException { + AtomicReference vaultConfig = new AtomicReference<>(); + Path normalizedTarget = targetDir.normalize(); + try (FileSystem zipFs = FileSystems.newFileSystem(zipFile)) { + for (Path zipRoot : zipFs.getRootDirectories()) { + Files.walkFileTree(zipRoot, Set.of(), 6, new SimpleFileVisitor<>() { + @Override + public FileVisitResult preVisitDirectory(Path dir, BasicFileAttributes attrs) throws IOException { + Files.createDirectories(resolveSafely(normalizedTarget, zipRoot, dir)); + return FileVisitResult.CONTINUE; + } + + @Override + public FileVisitResult visitFile(Path file, BasicFileAttributes attrs) throws IOException { + var target = resolveSafely(normalizedTarget, zipRoot, file); + Files.copy(file, target, StandardCopyOption.REPLACE_EXISTING); + if (file.getFileName() != null && Constants.VAULTCONFIG_FILENAME.equals(file.getFileName().toString())) { + if (!vaultConfig.compareAndSet(null, target)) { + throw new IOException("Vault template contains more than one " + Constants.VAULTCONFIG_FILENAME); + } + } + return FileVisitResult.CONTINUE; + } + }); + } + } + + if (vaultConfig.get() == null) { + throw new IOException("Template does not contain a vault (no " + Constants.VAULTCONFIG_FILENAME + " found)."); + } + return vaultConfig.get().getParent(); + } + + private static Path resolveSafely(Path targetDir, Path zipRoot, Path entry) throws IOException { + Path resolved = targetDir.resolve(zipRoot.relativize(entry).toString()).normalize(); + if (!resolved.startsWith(targetDir)) { + throw new IOException("Refusing to extract entry outside of target directory: " + entry); + } + return resolved; + } + + private static void move(Path source, Path destination) throws IOException { + try { + Files.move(source, destination, StandardCopyOption.ATOMIC_MOVE); + return; + } catch (AtomicMoveNotSupportedException | UnsupportedOperationException e) { + // provider without atomic move support - fall through to non-atomic strategies + } + try { + Files.move(source, destination); + } catch (IOException e) { + // likely a cross-store move of a non-empty directory: copy recursively, then delete the source + copyRecursively(source, destination); + deleteRecursively(source); + } + } + + private static void copyRecursively(Path source, Path target) throws IOException { + Files.walkFileTree(source, new SimpleFileVisitor<>() { + @Override + public FileVisitResult preVisitDirectory(Path dir, BasicFileAttributes attrs) throws IOException { + Files.createDirectories(target.resolve(source.relativize(dir).toString())); + return FileVisitResult.CONTINUE; + } + + @Override + public FileVisitResult visitFile(Path file, BasicFileAttributes attrs) throws IOException { + Files.copy(file, target.resolve(source.relativize(file).toString()), StandardCopyOption.COPY_ATTRIBUTES, StandardCopyOption.REPLACE_EXISTING); + return FileVisitResult.CONTINUE; + } + }); + } + + private static void deleteQuietly(Path path) { + try { + deleteRecursively(path); + } catch (IOException e) { + LOG.warn("Failed to clean up temporary path {}", path, e); + } + } + + private static void deleteRecursively(Path path) throws IOException { + if (!Files.exists(path)) { + return; + } + try (Stream stream = Files.walk(path)) { + var paths = stream.sorted(Comparator.reverseOrder()).toList(); + for (Path p : paths) { + Files.deleteIfExists(p); + } + } + } + +} diff --git a/src/test/java/org/cryptomator/launcher/VaultTemplateExtractorTest.java b/src/test/java/org/cryptomator/launcher/VaultTemplateExtractorTest.java new file mode 100644 index 000000000..1135178d4 --- /dev/null +++ b/src/test/java/org/cryptomator/launcher/VaultTemplateExtractorTest.java @@ -0,0 +1,116 @@ +package org.cryptomator.launcher; + +import org.junit.jupiter.api.Assertions; +import org.junit.jupiter.api.DisplayName; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.io.TempDir; + +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.nio.charset.StandardCharsets; +import java.nio.file.FileAlreadyExistsException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.util.LinkedHashMap; +import java.util.Map; +import java.util.zip.ZipEntry; +import java.util.zip.ZipOutputStream; + +public class VaultTemplateExtractorTest { + + private static final byte[] CONFIG = "hub-vault-config".getBytes(StandardCharsets.UTF_8); + private static final byte[] CIPHERTEXT = "some-ciphertext".getBytes(StandardCharsets.UTF_8); + + @Test + @DisplayName("a vault at the archive root is moved to the destination") + public void testVaultAtArchiveRoot(@TempDir Path tmp) throws IOException { + var zip = zip(Map.of( // + "vault.cryptomator", CONFIG, // + "d/AB/CDEF/0.c9r", CIPHERTEXT // + )); + var destination = tmp.resolve("MyVault"); + + var result = VaultTemplateExtractor.extractAndMove(zip, destination); + + Assertions.assertEquals(destination, result); + Assertions.assertArrayEquals(CONFIG, Files.readAllBytes(destination.resolve("vault.cryptomator"))); + Assertions.assertArrayEquals(CIPHERTEXT, Files.readAllBytes(destination.resolve("d/AB/CDEF/0.c9r"))); + } + + @Test + @DisplayName("a vault nested in a single top-level folder is moved to the destination") + public void testVaultInSubfolder(@TempDir Path tmp) throws IOException { + var zip = zip(Map.of( // + "TemplateVault/vault.cryptomator", CONFIG, // + "TemplateVault/d/AB/CDEF/0.c9r", CIPHERTEXT // + )); + var destination = tmp.resolve("MyVault"); + + VaultTemplateExtractor.extractAndMove(zip, destination); + + Assertions.assertArrayEquals(CONFIG, Files.readAllBytes(destination.resolve("vault.cryptomator"))); + Assertions.assertArrayEquals(CIPHERTEXT, Files.readAllBytes(destination.resolve("d/AB/CDEF/0.c9r"))); + } + + @Test + @DisplayName("an existing destination is not overwritten") + public void testDestinationExists(@TempDir Path tmp) throws IOException { + var destination = tmp.resolve("MyVault"); + Files.createDirectory(destination); + var zip = zip(Map.of("vault.cryptomator", CONFIG)); + + Assertions.assertThrows(FileAlreadyExistsException.class, () -> VaultTemplateExtractor.extractAndMove(zip, destination)); + } + + @Test + @DisplayName("an archive without a vault config fails") + public void testNoVaultConfig(@TempDir Path tmp) throws IOException { + var zip = zip(Map.of("readme.txt", CONFIG)); + + Assertions.assertThrows(IOException.class, () -> VaultTemplateExtractor.extractAndMove(zip, tmp.resolve("MyVault"))); + } + + @Test + @DisplayName("an archive with more than one vault config fails") + public void testMultipleVaultConfigs(@TempDir Path tmp) throws IOException { + var zip = zip(Map.of( // + "vault.cryptomator", CONFIG, // + "nested/vault.cryptomator", CONFIG // + )); + + Assertions.assertThrows(IOException.class, () -> VaultTemplateExtractor.extractAndMove(zip, tmp.resolve("MyVault"))); + } + + @Test + @DisplayName("a zip-slip entry does not escape the destination") + public void testZipSlip(@TempDir Path tmp) throws IOException { + var zip = zip(Map.of( // + "vault.cryptomator", CONFIG, // + "../escaped.txt", CIPHERTEXT // + )); + var destination = tmp.resolve("nested").resolve("MyVault"); + + try { + VaultTemplateExtractor.extractAndMove(zip, destination); + } catch (IOException e) { + // acceptable: extraction refused the malicious entry + } + + Assertions.assertTrue(Files.notExists(tmp.resolve("nested").resolve("escaped.txt")), "entry escaped the destination directory"); + Assertions.assertTrue(Files.notExists(tmp.resolve("escaped.txt")), "entry escaped the temp tree"); + } + + private static byte[] zip(Map entries) throws IOException { + var ordered = new LinkedHashMap<>(entries); + var baos = new ByteArrayOutputStream(); + try (var zos = new ZipOutputStream(baos)) { + for (var entry : ordered.entrySet()) { + zos.putNextEntry(new ZipEntry(entry.getKey())); + zos.write(entry.getValue()); + zos.closeEntry(); + } + } + return baos.toByteArray(); + } + +}