Text app and Android Direct Editing permit creating data unencrypted within encrypted folders
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 659
- Forks
- 133
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 110
Description
I have the text app enabled. I create a new text file ("enc.md") within an encrypted folder. When I edit this file the data shows up in plain text on the server. I'm reporting this issue here rather than in the "text" app because the e2e encryption system should not permit storing of unencrypted data in encrypted folders, or should not allow apps to store data in them, or should at least note which files are actually encrypted
Steps to reproduce
- on android nextcloud app (3.10.1)
- create new folder "Encrypted"
- in files view change folder properties to encrypted
- open Encrypted folder
- press "+" and choose to create new text document "enc.md"
- add some text to document
- close document
- on server: cat data/user/files/Encrypted/enc.md
- observe that plaintext data is shown
Expected behaviour
Any data stored in encrypted folder should appear encrypted on the server hard disk
Actual behaviour
cat data/_user_/files/Encrypted/enc.md shows plaintext data
Server configuration
Operating system: ubuntu 18.04
Web server: nginx 1.14.0-0ubuntu1.7
Database: whatever is in the docker hub nextcloud:18.0.2-fpm-alpine
PHP version: whatever is in the docker hub nextcloud:18.0.2-fpm-alpine
Nextcloud version: docker hub nextcloud:18.0.2-fpm-alpine
Updated from an older Nextcloud/ownCloud or fresh install: fresh
Where did you install Nextcloud from: docker hub nextcloud:18.0.2-fpm-alpine
Android app version: 3.10.1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the Android 3.10.1 flow described in the issue, then inspect how the Text app creates and saves a document in an encrypted folder. Check the resulting data at data/user/files/Encrypted/enc.md; done means text created through the Text app is encrypted on the server or the unsupported behavior is clearly prevented or identified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100