[Bug]: in DecryptAll, $fileinfo returns false on files with a non-unicode filenames (possibly others?), crashes the decryption process and leaves the server in a bad state

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When running occ encryption:decrypt-all, the server can fail to read the $fileinfo variable for certain files (including ones that have a non-unicode name), which then throws and crashes when trying to call getMTime() on it, and leaves the server in a bad state with certain files still being encrypted, with encryption already being off, leaving users without access.

Steps to reproduce

1.Enable encryption on server
2.Have a file that fails to read $fileinfo, such as a file with a non-unicode filename (might be other kinds of files that causes it? In my case, it was two of these files causing issues.)
3.Start the decryption process

Expected behavior

Decryption process successfully decrypts them, or leaves them alone and encrypted for manual recovery.

Nextcloud Server version

31

Operating system

RHEL/CentOS

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0
        },
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "upgrade.disable-web": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cloud.ziku.me"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "31.0.2.1",
        "overwritehost": "cloud.ziku.me",
        "overwriteprotocol": "https",
        "overwrite.cli.url": "https:\/\/cloud.ziku.me",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "default_phone_region": "DE",
        "installed": true,
        "maintenance_window_start": 1,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "loglevel": 2,
        "mail_smtpdebug": false,
        "maintenance": false,
        "mail_smtpauth": true,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "twofactor_enforced": "false",
        "twofactor_enforced_groups": [],
        "twofactor_enforced_excluded_groups": [
            "2fa-exception"
        ],
        "forbidden_filename_basenames": [
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "app_install_overwrite": [
            "unsplash",
            "extract"
        ]
    }
}

List of activated Apps

Enabled:
  - activity: 4.0.0
  - app_api: 5.0.2
  - bruteforcesettings: 4.0.0
  - circles: 31.0.0
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0
  - dashboard: 7.11.0
  - dav: 1.33.0
  - drawio: 3.1.0
  - federatedfilesharing: 1.21.0
  - federation: 1.21.0
  - files: 2.3.1
  - files_downloadlimit: 4.0.0
  - files_external: 1.23.0
  - files_pdfviewer: 4.0.0
  - files_reminders: 1.4.0
  - files_sharing: 1.23.1
  - files_versions: 1.24.0
  - files_zip: 2.1.0
  - firstrunwizard: 4.0.0
  - groupfolders: 19.0.4
  - impersonate: 2.0.0
  - integration_github: 3.1.1
  - integration_mastodon: 3.1.1
  - integration_onedrive: 3.3.1
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - nextcloud_announcements: 3.0.0
  - notifications: 4.0.0
  - oauth2: 1.19.1
  - onlyoffice: 9.8.0
  - ownershiptransfer: 1.1.0
  - password_policy: 3.0.0
  - photos: 4.0.0-dev.1
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - quota_warning: 1.21.0
  - recommendations: 4.0.0
  - related_resources: 2.0.0
  - serverinfo: 3.0.0
  - settings: 1.14.0
  - sharebymail: 1.21.0
  - sociallogin: 6.0.1
  - support: 3.0.0
  - suspicious_login: 9.0.1
  - systemtags: 1.21.1
  - text: 5.0.0
  - theming: 2.6.1
  - twofactor_backupcodes: 1.20.0
  - twofactor_nextcloud_notification: 5.0.0
  - updatenotification: 1.21.0
  - user_status: 1.11.0
  - viewer: 4.0.0
  - weather_status: 1.11.0
  - webhook_listeners: 1.2.0
  - workflowengine: 2.13.0
Disabled:
  - admin_audit: 1.21.0
  - contactsinteraction: 1.12.0 (installed 1.11.0)
  - encryption: 2.19.0 (installed 2.19.0)
  - files_trashbin: 1.21.0 (installed 1.21.0)
  - richdocuments: 8.6.4 (installed 8.6.4)
  - survey_client: 3.0.0 (installed 2.0.0)
  - twofactor_totp: 13.0.0-dev.0 (installed 12.0.0-dev)
  - user_ldap: 1.22.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

(not from Nextcloud itself, but it's the log I got from occ when DecryptAll threw)
[>]An unhandled exception has been thrown:
Error: Call to a member function getMTime() on false in /var/www/html/lib/private/Encryption/DecryptAll.php:226
Stack trace:
#0 /var/www/html/lib/private/Encryption/DecryptAll.php(191): OC\Encryption\DecryptAll->decryptFile('/dynamyc/files...')
#1 /var/www/html/lib/private/Encryption/DecryptAll.php(150): OC\Encryption\DecryptAll->decryptUsersFiles('dynamyc', Object(Symfony\Component\Console\Helper\ProgressBar), 'dynamyc (2 of ...')
#2 /var/www/html/lib/private/Encryption/DecryptAll.php(61): OC\Encryption\DecryptAll->decryptAllUsersFiles('ZITADEL-3130579...')
#3 /var/www/html/core/Command/Encryption/DecryptAll.php(118): OC\Encryption\DecryptAll->decryptAll(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput), '')
#4 /var/www/html/3rdparty/symfony/console/Command/Command.php(326): OC\Core\Command\Encryption\DecryptAll->execute(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
#5 /var/www/html/3rdparty/symfony/console/Application.php(1078): Symfony\Component\Console\Command\Command->run(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
#6 /var/www/html/3rdparty/symfony/console/Application.php(324): Symfony\Component\Console\Application->doRunCommand(Object(OC\Core\Command\Encryption\DecryptAll), Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
#7 /var/www/html/3rdparty/symfony/console/Application.php(175): Symfony\Component\Console\Application->doRun(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
#8 /var/www/html/lib/private/Console/Application.php(187): Symfony\Component\Console\Application->run(Object(Symfony\Component\Console\Input\ArgvInput), Object(Symfony\Component\Console\Output\ConsoleOutput))
#9 /var/www/html/console.php(87): OC\Console\Application->run(Object(Symfony\Component\Console\Input\ArgvInput))

Additional info

I managed to bypass the error by using the current timestamp instead of the timestamp from the $fileinfo var, but that seemed to have just caused the files to return as a 0KB file, resulting in data loss.

Start with lib/private/Encryption/DecryptAll.php around line 226 and trace how core/Command/Encryption/DecryptAll.php invokes it. Reproduce the failure with occ encryption:decrypt-all using a problematic filename, then inspect how the false file-info result is handled. Done means the command does not crash or silently produce empty files, while affected files remain recoverable.