From c09bf1f2284706232642431c75fa1f3d8500a9d0 Mon Sep 17 00:00:00 2001
From: Jakob Unterwurzacher
Date: Mon, 1 Oct 2018 21:28:54 +0200
Subject: fusefrontend: make DecryptPath() symlink-safe

DecryptPath is now symlink-safe through the use of *at()
functions.
---
 internal/nametransform/longnames.go | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

(limited to 'internal/nametransform')

diff --git a/internal/nametransform/longnames.go b/internal/nametransform/longnames.go
index da18ebb..9c8637e 100644
--- a/internal/nametransform/longnames.go
+++ b/internal/nametransform/longnames.go
@@ -64,18 +64,18 @@ func IsLongContent(cName string) bool {
 }
 
 // ReadLongName - read "$path.name"
-func ReadLongName(path string) (string, error) {
-	path += LongNameSuffix
-	fd, err := os.Open(path)
+func ReadLongNameAt(dirfd int, cName string) (string, error) {
+	cName += LongNameSuffix
+	fd, err := syscallcompat.Openat(dirfd, cName, syscall.O_NOFOLLOW, 0)
 	if err != nil {
 		return "", err
 	}
-	defer fd.Close()
+	defer syscall.Close(fd)
 	// 256 (=255 padded to 16) bytes base64-encoded take 344 bytes: "AAAAAAA...AAA=="
 	lim := 344
 	// Allocate a bigger buffer so we see whether the file is too big
 	buf := make([]byte, lim+1)
-	n, err := fd.ReadAt(buf, 0)
+	n, err := syscall.Pread(fd, buf, 0)
 	if err != nil && err != io.EOF {
 		return "", err
 	}
@@ -88,7 +88,9 @@ func ReadLongName(path string) (string, error) {
 	return string(buf[0:n]), nil
 }
 
-// DeleteLongName deletes "hashName.name".
+// DeleteLongName deletes "hashName.name" in the directory openend at "dirfd".
+//
+// This function is symlink-safe through the use of Unlinkat().
 func DeleteLongName(dirfd int, hashName string) error {
 	err := syscallcompat.Unlinkat(dirfd, hashName+LongNameSuffix, 0)
 	if err != nil {
@@ -99,7 +101,9 @@ func DeleteLongName(dirfd int, hashName string) error {
 
 // WriteLongName encrypts plainName and writes it into "hashName.name".
 // For the convenience of the caller, plainName may also be a path and will be
-// converted internally.
+// Base()named internally.
+//
+// This function is symlink-safe through the use of Openat().
 func (n *NameTransform) WriteLongName(dirfd int, hashName string, plainName string) (err error) {
 	plainName = filepath.Base(plainName)
 
-- 
cgit v1.2.3