nextcloud / nextcloud/text

Text app and Android Direct Editing permit creating data unencrypted within encrypted folders

Open
#5,168 12 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

1. to develop bug feature: direct editor
Dominant language
JavaScript
Stars
659
Forks
133
Avg merge
1d 20h
Merged PRs (30d)
110

Description

I have the text app enabled. I create a new text file ("enc.md") within an encrypted folder. When I edit this file the data shows up in plain text on the server. I'm reporting this issue here rather than in the "text" app because the e2e encryption system should not permit storing of unencrypted data in encrypted folders, or should not allow apps to store data in them, or should at least note which files are actually encrypted

Steps to reproduce
  • on android nextcloud app (3.10.1)
    • create new folder "Encrypted"
    • in files view change folder properties to encrypted
    • open Encrypted folder
    • press "+" and choose to create new text document "enc.md"
    • add some text to document
    • close document
  • on server: cat data/user/files/Encrypted/enc.md
    • observe that plaintext data is shown
Expected behaviour

Any data stored in encrypted folder should appear encrypted on the server hard disk

Actual behaviour

cat data/_user_/files/Encrypted/enc.md shows plaintext data

Server configuration

Operating system: ubuntu 18.04

Web server: nginx 1.14.0-0ubuntu1.7

Database: whatever is in the docker hub nextcloud:18.0.2-fpm-alpine

PHP version: whatever is in the docker hub nextcloud:18.0.2-fpm-alpine

Nextcloud version: docker hub nextcloud:18.0.2-fpm-alpine

Updated from an older Nextcloud/ownCloud or fresh install: fresh

Where did you install Nextcloud from: docker hub nextcloud:18.0.2-fpm-alpine

Android app version: 3.10.1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the Android 3.10.1 flow described in the issue, then inspect how the Text app creates and saves a document in an encrypted folder. Check the resulting data at data/user/files/Encrypted/enc.md; done means text created through the Text app is encrypted on the server or the unsupported behavior is clearly prevented or identified.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.