Skip to content

Fix subfolders in encrypted folders #17608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
daniele-verducci wants to merge 5 commits into
base: master
Choose a base branch
from
+18 −16
Draft

Fix subfolders in encrypted folders #17608

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e611738
Fix subfolders in encrypted folders
daniele-verducci Sep 10, 2026
eef7e94
Better fix subfolders in encrypted folders (using existing metadata r…
daniele-verducci Sep 14, 2026
8bc21c7
Proposal to fix metadata key check
daniele-verducci Sep 14, 2026
6160ea2
Revert "Updated android-library"
daniele-verducci Sep 15, 2026
d374ffa
Rebased
daniele-verducci Sep 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 16 additions & 12 deletions app/src/main/java/com/nextcloud/utils/e2ee/E2EEKeyInspector.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ import com.owncloud.android.datamodel.ArbitraryDataProvider
import com.owncloud.android.datamodel.FileDataStorageManager
import com.owncloud.android.datamodel.OCFile
import com.owncloud.android.datamodel.e2e.v1.encrypted.EncryptedFolderMetadataFileV1
import com.owncloud.android.datamodel.e2e.v2.encrypted.EncryptedFolderMetadataFile
import com.owncloud.android.lib.common.OwnCloudClient
import com.owncloud.android.lib.common.OwnCloudClientFactory
import com.owncloud.android.lib.common.utils.Log_OC
import com.owncloud.android.lib.resources.e2ee.GetMetadataRemoteOperation
Expand All @@ -25,6 +25,7 @@ import com.owncloud.android.operations.GetCapabilitiesOperation
import com.owncloud.android.ui.dialog.setupEncryption.CertificateValidator
import com.owncloud.android.ui.dialog.setupEncryption.model.DownloadKeyResult
import com.owncloud.android.utils.EncryptionUtils
import com.owncloud.android.utils.EncryptionUtilsV2
import kotlinx.coroutines.Dispatchers
import kotlinx.coroutines.withContext
import org.apache.commons.httpclient.HttpStatus
Expand Down Expand Up @@ -102,24 +103,27 @@ class E2EEKeyInspector @Inject constructor(
val metadata = metadataResult.resultData

return@withContext if (E2EVersionHelper.isV2Plus(capability)) {
decryptsMetadataV2(metadata.metadata, privateKey, client.userId)
decryptsMetadataV2(folder, privateKey, client)
} else {
decryptsMetadataV1(metadata.metadata, privateKey, folder.localId)
}
}

private fun decryptsMetadataV2(serializedMetadata: String, privateKey: String, userId: String): Boolean {
val metadataFile = EncryptionUtils.deserializeJSON(
serializedMetadata,
object : TypeToken<EncryptedFolderMetadataFile>() {}
)

val user = metadataFile.users.find { it.userId == userId }
?: throw IllegalStateException("cannot find current user in metadata")
private fun decryptsMetadataV2(ocFile: OCFile, privateKey: String, client: OwnCloudClient): Boolean {

@alperozturk96 alperozturk96 Sep 14, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Previously GetMetadataRemoteOperation was already given the metadata why now we need to retrieveTopMostMetadata and also eventually call decryptFolderMetadataFile ?

@daniele-verducci daniele-verducci Sep 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GetMetadataRemoteOperation retrieves the metadata for the current folder, but I saw with the debugger that the users array is present only if the folder is the root encrypted folder. If we are in a subfolder, it's not. I think this isn't a server bug because it's working in the web version (checked the calls and the answer is the same, just in XML instead of JSON, so they must be keeping the root encrypted folder's key and using it for the subfolders, I believe)

val userId = client.userId

return try {
EncryptionUtils.decryptStringAsymmetricV2(user.encryptedMetadataKey, privateKey)
true
val metadataKey = EncryptionUtilsV2().retrieveTopMostMetadataKey(

@alperozturk96 alperozturk96 Sep 15, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I saw this comment in the master. @tobiasKaminsky I think using retrieveTopMostMetadataKey directly here is okay. What do you think?

// we are in a subfolder, decrypt information is in top most encrypted folder

ocFile,
storageManager,
client,
userId,
privateKey,
accountManager.user,
context,
arbitraryDataProvider
)
!metadataKey.isEmpty()
} catch (e: Exception) {
Log_OC.w(TAG, "user tried to decrypt folder's metadata with different private key: $e")
false
Expand Down
4 changes: 1 addition & 3 deletions .../main/java/com/owncloud/android/datamodel/e2e/v2/encrypted/EncryptedFolderMetadataFile.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,12 @@
*/
package com.owncloud.android.datamodel.e2e.v2.encrypted

import com.nextcloud.utils.e2ee.E2EVersionHelper

/**
* Decrypted class representation of metadata json of folder metadata.
*/
data class EncryptedFolderMetadataFile(
val metadata: EncryptedMetadata,
val users: List<EncryptedUser>,
val users: List<EncryptedUser>?,
@Transient val filedrop: MutableMap<String, EncryptedFiledrop>?,
val version: String
)
2 changes: 1 addition & 1 deletion app/src/main/java/com/owncloud/android/utils/EncryptionUtilsV2.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,7 +193,7 @@ class EncryptionUtilsV2 {
)
} else {
// Top folder
val encryptedUser = metadataFile.users.find { it.userId == userId }
val encryptedUser = metadataFile.users?.find { it.userId == userId }
?: throw IllegalStateException("Cannot find current user in metadata")

val decryptedMetadataKey = decryptMetadataKey(encryptedUser, privateKey)
Expand Down
Loading