nextcloud / nextcloud/end_to_end_encryption

Lock folder, directly unlock fails with "Intermediate meta-data file missing"

Open
#304 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

backend feature: locking
Dominant language
PHP
Stars
320
Forks
36
Avg merge
1d 8h
Merged PRs (30d)
81

Description

Steps to reproduce:

  • lock folder, store token
  • unlock folder with token
    --> fails with above error

Reason I found it is (on Android):

  • upload 1.png in encrypted folder -> works
  • upload 1.png again
    • Android locks folder
    • checks for name collision
    • bails out
    • unlocks folder
      --> fails
      While upload never actually tried to modify something on server, we immediately locked (which I changed now), but still this should be possible.

My assumption is that this "sanity" check misses this case and it should only fail if there was an upload of payload.

@CarlSchwan as discussed

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files or tests are named. Start by tracing the lock/unlock path and the sanity check used after Android's name-collision flow, then reproduce direct unlock with the stored token after a failed duplicate upload. Done means a collision check that uploaded no payload no longer prevents the folder from being unlocked.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend-api-design, cryptography, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.