util.cpp

Go to the documentation of this file.

// SPDX-FileCopyrightText: 2014 Anne Jan Brouwer
// SPDX-License-Identifier: GPL-3.0-or-later
#include "util.h"
#include "appsettings.h"
#include "executor.h"
#include <QCoreApplication>
#include <QDebug>
#include <QDir>
#include <QFile>
#include <QFileDevice>
#include <QFileInfo>
#include <QHash>
#include <QRegularExpression>
#include <QRegularExpressionMatchIterator>
#include <QStandardPaths>
#include <QTemporaryFile>
#include <QUrl>
 
#include <optional>
 
#ifdef Q_OS_WIN
#include <fcntl.h>
#include <io.h>
#include <windows.h>
#else
#include <cerrno>
#include <cstdio>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/time.h>
#include <unistd.h>
#endif
 
#include "qtpasslogging.h"
 
QProcessEnvironment Util::_env;
bool Util::_envInitialised = false;
 
// macOS and Windows: append the usual GPG install directories to PATH.
void Util::initialiseEnvironment() {
  if (!_envInitialised) {
    _env = QProcessEnvironment::systemEnvironment();
#ifdef __APPLE__
    QString path = _env.value("PATH");
    if (!path.contains("/usr/local/MacGPG2/bin") &&
        QDir("/usr/local/MacGPG2/bin").exists())
      path += ":/usr/local/MacGPG2/bin";
    if (!path.contains("/usr/local/bin"))
      path += ":/usr/local/bin";
    _env.insert("PATH", path);
#endif
#ifdef Q_OS_WIN
    QString path = _env.value("PATH");
    if (!path.contains("C:\\Program Files\\WinGPG\\x86") &&
        QDir("C:\\Program Files\\WinGPG\\x86").exists())
      path += ";C:\\Program Files\\WinGPG\\x86";
    if (!path.contains("C:\\Program Files\\GnuPG\\bin") &&
        QDir("C:\\Program Files\\GnuPG\\bin").exists())
      path += ";C:\\Program Files\\GnuPG\\bin";
    _env.insert("PATH", path);
#endif
    qCDebug(lcQtPass) << _env.value("PATH");
    _envInitialised = true;
  }
}
 
auto Util::findPasswordStore() -> QString {
  QString path;
  initialiseEnvironment();
  if (_env.contains("PASSWORD_STORE_DIR")) {
    path = Util::expandTilde(_env.value("PASSWORD_STORE_DIR"));
  } else {
#ifdef Q_OS_WIN
    path = QDir(QDir::homePath()).filePath("password-store");
#else
    path = QDir(QDir::homePath()).filePath(".password-store");
#endif
  }
  return Util::normalizeFolderPath(QDir::cleanPath(path));
}
 
auto Util::expandTilde(const QString &path) -> QString {
  if (path == QLatin1String("~")) {
    return QDir::homePath();
  }
  if (path.startsWith(QLatin1String("~/"))) {
    return QDir::homePath() + path.mid(1);
  }
  return path;
}
 
auto Util::normalizeFolderPath(const QString &path) -> QString {
  QString normalizedPath = path;
  if (!normalizedPath.endsWith('/')) {
    normalizedPath += '/';
  }
  return normalizedPath;
}
 
void Util::applyPassProcessDefaults() {
  // pass unsets these before it runs git: a GIT_DIR inherited from the
  // environment (QtPass started from a git hook, or an IDE terminal) would
  // send every commit and push to that repository instead of the store.
  for (const char *variable :
       {"GIT_DIR", "GIT_WORK_TREE", "GIT_NAMESPACE", "GIT_INDEX_FILE",
        "GIT_INDEX_VERSION", "GIT_OBJECT_DIRECTORY", "GIT_COMMON_DIR",
        // QtPass sets GIT_LITERAL_PATHSPECS for its git; git refuses a
        // pathspec when one of these is set as well.
        "GIT_GLOB_PATHSPECS", "GIT_NOGLOB_PATHSPECS", "GIT_ICASE_PATHSPECS"}) {
    qunsetenv(variable);
  }
  Executor::setChildUmask(
      passUmask(qEnvironmentVariable("PASSWORD_STORE_UMASK")));
}
 
auto Util::passUmask(const QString &value) -> int {
  // Taken as it is, as bash's umask builtin (which pass hands it to) takes
  // it: " 022" is no umask there either. pass then keeps the session's;
  // QtPass falls back to 077.
  // anchoredPattern(), not ^...$: $ also matches before a final newline.
  static const QRegularExpression octal(
      QRegularExpression::anchoredPattern(QStringLiteral("[0-7]{1,4}")));
  if (!octal.match(value).hasMatch()) {
    return 077;
  }
  return value.toInt(nullptr, 8);
}
 
auto Util::gitCeiling(const QString &store) -> QString {
  if (store.isEmpty()) {
    return {};
  }
  QString path = QFileInfo(store).canonicalFilePath();
  if (path.isEmpty()) {
    path = QDir::cleanPath(QDir(store).absolutePath());
  }
  return QFileInfo(path).absolutePath();
}
 
auto Util::repositoryPassClimbsTo(const QString &store) -> QString {
#ifdef Q_OS_WIN
  Q_UNUSED(store);
  return {};
#else
  if (!store.contains(QLatin1Char(':'))) {
    return {};
  }
  // git walks up from the real folder, so the real path is the one to walk,
  // and for a store that does not exist yet the one it will have: its
  // nearest existing folder resolved, the rest appended. By the raw string:
  // QDir and QFileInfo clean a path by name, and "link/.." is the parent
  // of the link's target, not the folder the link is in. On macOS the
  // temporary folder is under /var, a link to /private/var.
  // Absolute as git means it, a leading "/" (Qt would take ":name" for a
  // resource path).
  QString path =
      store.startsWith(u'/') ? store : QDir::currentPath() + u'/' + store;
  while (path.size() > 1 && path.endsWith(u'/')) {
    path.chop(1);
  }
  QString rest;
  while (!QFileInfo::exists(path)) {
    const qsizetype slash = path.lastIndexOf(u'/');
    if (slash < 0) {
      return {};
    }
    const QString name = path.mid(slash + 1);
    rest = rest.isEmpty() ? name : name + u'/' + rest;
    path = slash == 0 ? QStringLiteral("/") : path.left(slash);
  }
  const QString real = QFileInfo(path).canonicalFilePath();
  QString start = real.isEmpty() ? QDir::cleanPath(path) : real;
  if (!rest.isEmpty()) {
    start = QDir::cleanPath(start + u'/' + rest);
  }
  // The pieces of pass's ceiling as git takes them (setup.c,
  // canonicalize_ceiling_entry): relative ones are dropped, the rest
  // resolved, one that cannot be resolved is dropped; after an empty piece
  // ("::") they are kept exactly as written. A piece can still be a real
  // ceiling: "/repo/:vault/.." holds "/repo/".
  QString ceiling;
  bool afterEmpty = false;
  for (const QString &piece :
       (store + QStringLiteral("/..")).split(QLatin1Char(':'))) {
    if (piece.isEmpty()) {
      afterEmpty = true;
      continue;
    }
    if (!piece.startsWith(u'/')) {
      continue;
    }
    const QString entry =
        afterEmpty ? piece : QFileInfo(piece).canonicalFilePath();
    // git stops below the longest entry the store lies under
    // (longest_ancestor_length: "/" is above everything).
    const QString under = entry == u'/' ? entry : entry + u'/';
    if (!entry.isEmpty() && start.startsWith(under) &&
        entry.size() > ceiling.size()) {
      ceiling = entry;
    }
  }
  // What git takes for a repository (setup.c, is_git_directory()): HEAD
  // naming a ref or an object, objects/ and refs/. An empty or broken .git
  // is passed by, as git passes it by.
  const auto isGitDirectory = [](const QString &candidate) {
    const QDir dir(candidate);
    if (!QFileInfo(dir.filePath(QStringLiteral("objects"))).isDir() ||
        !QFileInfo(dir.filePath(QStringLiteral("refs"))).isDir()) {
      return false;
    }
    QFile head(dir.filePath(QStringLiteral("HEAD")));
    if (!head.open(QIODevice::ReadOnly)) {
      return false;
    }
    static const QRegularExpression valid(
        QStringLiteral("^(?:ref: refs/|[0-9a-f]{40}\\s*$|[0-9a-f]{64}\\s*$)"));
    return valid.match(QString::fromUtf8(head.read(256))).hasMatch();
  };
  // At each folder, as git: a .git folder that is a repository, or a .git
  // file naming one ("gitdir: ..."), is the repository. Any other .git file
  // stops git with an error, and pass then commits nothing; a .git folder
  // that is no repository is passed by.
  enum class Found { Nothing, Repository, Refused };
  const auto repositoryAt = [&isGitDirectory](const QString &dir) {
    const QString dotGit = QDir(dir).filePath(QStringLiteral(".git"));
    const QFileInfo info(dotGit);
    if (info.isDir()) {
      return isGitDirectory(dotGit) ? Found::Repository : Found::Nothing;
    }
    if (!info.exists()) {
      return Found::Nothing;
    }
    QFile file(dotGit);
    if (!file.open(QIODevice::ReadOnly)) {
      return Found::Refused;
    }
    const QString line = QString::fromUtf8(file.readLine(4096)).trimmed();
    if (!line.startsWith(QLatin1String("gitdir: "))) {
      return Found::Refused;
    }
    const QString target = line.mid(8);
    return isGitDirectory(target.startsWith(u'/') ? target
                                                  : QDir(dir).filePath(target))
               ? Found::Repository
               : Found::Refused;
  };
  // The store's own repository comes first; only without one does git look
  // further up, and never into the ceiling. By name from here: the real
  // path holds no link or "..".
  for (QString dir = start;;) {
    switch (repositoryAt(dir)) {
    case Found::Repository:
      return dir == start ? QString() : dir;
    case Found::Refused:
      return {};
    case Found::Nothing:
      break;
    }
    // A bare repository: git stops there, and pass, finding no work tree,
    // commits nothing.
    if (isGitDirectory(dir)) {
      return {};
    }
    const QString up = QFileInfo(dir).absolutePath();
    if (up == dir || up == ceiling) {
      return {};
    }
    dir = up;
  }
#endif
}
 
namespace {
std::optional<uint> s_gitOwnerForTests;
} // namespace
 
void Util::setGitOwnerForTests(std::optional<uint> user) {
  s_gitOwnerForTests = user;
}
 
#ifdef Q_OS_UNIX
namespace {
auto isSafeDirectory(const QString &root, const QString &git) -> bool {
  // Outside any repository, as git reads its protected config: no
  // repository's own config, and no includeIf "gitdir:" or "onbranch:"
  // that matches (a GIT_DIR, even one that cannot exist, would be matched
  // against them, and one that cannot exist makes git config fail). From
  // "/", which a user cannot make a repository; a local scope is dropped
  // below in any case.
  QProcessEnvironment env = QProcessEnvironment::systemEnvironment();
  env.remove(QStringLiteral("GIT_DIR"));
  env.remove(QStringLiteral("GIT_WORK_TREE"));
  env.remove(QStringLiteral("GIT_COMMON_DIR"));
  // git config alone reads GIT_CONFIG in place of the system and global
  // configuration (and reports it as "command"); the ownership check never
  // reads it.
  env.remove(QStringLiteral("GIT_CONFIG"));
  QProcess process;
  process.setProcessEnvironment(env);
  process.setWorkingDirectory(QStringLiteral("/"));
  // Bounded: Git calls wait for this, and a git that never answers trusts
  // nothing.
  constexpr int kQueryTimeoutMs = 5000;
  QString out;
  if (Executor::executeBlocking(
          process, git.isEmpty() ? QStringLiteral("git") : git,
          {QStringLiteral("config"), QStringLiteral("--show-scope"),
           QStringLiteral("--type=path"), QStringLiteral("--get-all"),
           QStringLiteral("safe.directory")},
          QString(), &out, nullptr, nullptr, kQueryTimeoutMs) != 0) {
    return false;
  }
  bool safe = false;
  const QStringList lines = out.split(QLatin1Char('\n'));
  for (const QString &line : lines) {
    const qsizetype tab = line.indexOf(QLatin1Char('\t'));
    if (tab < 0) {
      continue;
    }
    const QString scope = line.left(tab);
    if (scope != QLatin1String("system") && scope != QLatin1String("global") &&
        scope != QLatin1String("command")) {
      continue;
    }
    const QString value = line.mid(tab + 1);
    if (value.isEmpty()) {
      safe = false;
    } else if (value == QLatin1String("*")) {
      safe = true;
    } else if (!QDir::isAbsolutePath(value)) {
      continue;
    } else if (value.endsWith(QLatin1String("/*"))) {
      const QString base = value.chopped(2);
      QString prefix = QFileInfo(base.isEmpty() ? QStringLiteral("/") : base)
                           .canonicalFilePath();
      if (prefix.isEmpty()) {
        continue;
      }
      if (!prefix.endsWith(QLatin1Char('/'))) {
        prefix += QLatin1Char('/');
      }
      safe = safe || root.startsWith(prefix);
    } else {
      const QString named = QFileInfo(value).canonicalFilePath();
      safe = safe || (!named.isEmpty() && named == root);
    }
  }
  return safe;
}
} // namespace
#endif
 
auto Util::gitStoreVariables(const QString &store, const QString &git,
                             std::optional<uint> asUser)
    -> QList<std::pair<QString, QString>> {
  const QString ceiling = gitCeiling(store);
  if (ceiling.isEmpty()) {
    return {};
  }
  QList<std::pair<QString, QString>> vars{
      {QStringLiteral("GIT_CEILING_DIRECTORIES"), ceiling}};
#ifdef Q_OS_WIN
  const QChar separator = QLatin1Char(';');
#else
  const QChar separator = QLatin1Char(':');
#endif
  // git splits the ceiling list on the separator: "/home/a:b" would be
  // "/home/a" and "b", neither of them the parent, and git would climb.
  if (ceiling.contains(separator)) {
    QString root = QFileInfo(store).canonicalFilePath();
    if (root.isEmpty()) {
      root = QDir::cleanPath(QDir(store).absolutePath());
    }
    QString gitDir = QDir(root).filePath(QStringLiteral(".git"));
#ifdef Q_OS_UNIX
    // What discovery's ownership check would have looked at: the work tree,
    // the .git, and the directory a gitfile names. Not the user's: no
    // repository at all, under a path that cannot be created (its parent
    // is a device), rather than another user's hooks run as this one.
    const uint me = asUser.value_or(
        s_gitOwnerForTests.value_or(static_cast<uint>(::geteuid())));
    const auto ownedOrMissing = [me](const QString &path) {
      const QFileInfo info(path);
      return !info.exists() || info.ownerId() == me;
    };
    bool owned = ownedOrMissing(root) && ownedOrMissing(gitDir);
    if (owned && QFileInfo(gitDir).isFile()) {
      QFile gitFile(gitDir);
      if (gitFile.open(QIODevice::ReadOnly)) {
        const QString line =
            QString::fromUtf8(gitFile.readLine(4096)).trimmed();
        if (line.startsWith(QLatin1String("gitdir:"))) {
          const QString target = line.mid(7).trimmed();
          owned = ownedOrMissing(QDir(root).absoluteFilePath(target));
        }
      }
    }
    // Or trusted as git would trust it in place of ownership.
    if (!owned && !isSafeDirectory(root, git)) {
      gitDir = QStringLiteral("/dev/null/.git");
    }
#else
    // Git for Windows runs the same ownership check during discovery, on
    // SIDs, with its own rules for the Administrators group; this pin skips
    // it there and does not repeat it (a known gap, #2089).
    Q_UNUSED(git);
    Q_UNUSED(asUser);
#endif
    vars.append({QStringLiteral("GIT_DIR"), gitDir});
    vars.append({QStringLiteral("GIT_WORK_TREE"), root});
  }
  return vars;
}
 
auto Util::mkpathForStore(const QString &path) -> bool {
  const QString clean = QDir::cleanPath(QDir(path).absolutePath());
  if (QFileInfo(clean).isDir()) {
    return true;
  }
  const QString parent = QFileInfo(clean).absolutePath();
  if (parent != clean && !mkpathForStore(parent)) {
    return false;
  }
#ifdef Q_OS_UNIX
  // The store's umask, as git and gpg get it: a store shared with a group
  // (PASSWORD_STORE_UMASK=007) gets group folders, the default owner-only.
  const int umask = Executor::childUmask() >= 0 ? Executor::childUmask() : 077;
  QFile::Permissions permissions;
  const QFile::Permission bits[] = {
      QFile::ReadOwner, QFile::WriteOwner, QFile::ExeOwner,
      QFile::ReadGroup, QFile::WriteGroup, QFile::ExeGroup,
      QFile::ReadOther, QFile::WriteOther, QFile::ExeOther};
  for (int i = 0; i < 9; ++i) {
    if ((umask & (0400 >> i)) == 0) {
      permissions |= bits[i];
    }
  }
  // mkdir() still takes QtPass's own umask off (a session's 022 would drop
  // the group's write bit); set the mode exactly afterwards. That only ever
  // widens it to what was asked, never past.
  const bool made = QDir().mkdir(clean, permissions) &&
                    QFile::setPermissions(clean, permissions);
#else
  // Windows: permissions here would become an ACL of their own, replacing
  // the inherited one; the folder takes its parent's, as before.
  const bool made = QDir().mkdir(clean);
#endif
  return made || QFileInfo(clean).isDir();
}
 
auto Util::findBinaryInPath(const QString &binary) -> QString {
  if (binary.isEmpty()) {
    return {};
  }
 
  initialiseEnvironment();
 
  const QStringList dirs =
      _env.value(QStringLiteral("PATH"))
          .split(QDir::listSeparator(), Qt::SkipEmptyParts);
  QString ret;
  if (QDir::fromNativeSeparators(binary).contains(u'/')) {
    // An explicit path is not a PATH search: an absolute path is checked
    // as-is, a relative one is resolved against the PATH directories. The
    // directory-list overload refuses such names, so handle them here.
    if (QDir::isAbsolutePath(binary)) {
      ret = QStandardPaths::findExecutable(binary);
    } else if (!dirs.isEmpty()) {
      ret = QStandardPaths::findExecutable(binary, dirs);
    }
  } else {
    ret = findBinaryInPath(binary, dirs);
  }
#ifdef Q_OS_WIN
  if (ret.isEmpty()) {
    // Cache per-binary WSL lookup result — the wsl --version probe is a
    // blocking subprocess that can run several times per session for
    // missing binaries; once decided, the answer doesn't change at runtime.
    static QHash<QString, QString> wslBinaryCache;
    const bool hasWhitespace =
        std::any_of(binary.cbegin(), binary.cend(),
                    [](const QChar ch) { return ch.isSpace(); });
    if (!hasWhitespace) {
      auto cached = wslBinaryCache.constFind(binary);
      if (cached != wslBinaryCache.constEnd()) {
        ret = cached.value();
      } else {
        QString wslCommand = QStringLiteral("wsl ") + binary;
        qCDebug(lcQtPass)
            << "Util::findBinaryInPath(): falling back to WSL for binary"
            << binary;
        QString out, err;
        QString cachedResult;
        if (Executor::executeBlocking(wslCommand, {"--version"}, &out, &err) ==
                0 &&
            !out.isEmpty() && err.isEmpty()) {
          qCDebug(lcQtPass)
              << "Util::findBinaryInPath(): using WSL binary" << wslCommand;
          cachedResult = wslCommand;
        }
        wslBinaryCache.insert(binary, cachedResult);
        ret = cachedResult;
      }
    }
  }
#endif
 
  return ret;
}
 
// Bare names only: QStandardPaths::findExecutable() returns an absolute binary
// without consulting searchPaths, and a relative one with ".." could escape
// them.
auto Util::findBinaryInPath(const QString &binary,
                            const QStringList &searchPaths) -> QString {
  if (binary.isEmpty() || QDir::fromNativeSeparators(binary).contains(u'/')) {
    return {};
  }
  QStringList dirs;
  dirs.reserve(searchPaths.size());
  for (const QString &dir : searchPaths) {
    if (!dir.isEmpty()) {
      dirs.append(dir);
    }
  }
  if (dirs.isEmpty()) {
    // QStandardPaths::findExecutable() treats an empty list as "use PATH".
    return {};
  }
  return QStandardPaths::findExecutable(binary, dirs);
}
 
auto Util::configIsValid(const AppSettings &s) -> bool {
  const QString configFilePath = QDir(s.passStore).filePath(".gpg-id");
  if (!QFile(configFilePath).exists()) {
    return false;
  }
 
  const QString executable = s.usePass ? s.passExecutable : s.gpgExecutable;
 
  if (const auto wsl = Executor::parseWslCommand(executable)) {
    // Probe WSL once per session — availability doesn't change at runtime
    // and the executeBlocking call is a blocking subprocess.
    static const bool wslAvailable = [&wsl]() {
      QString out;
      QString err;
      return Executor::executeBlocking(wsl->launcher,
                                       {QStringLiteral("--version")}, &out,
                                       &err) == 0 &&
             !out.isEmpty() && err.isEmpty();
    }();
    if (wslAvailable) {
      return true;
    }
  }
  return QFile(executable).exists();
}
 
auto Util::endsWithGpg() -> const QRegularExpression & {
  static const QRegularExpression expr{R"(\.gpg$)"};
  return expr;
}
 
// Stops at whitespace, quotes and brackets so a URL on its own line keeps no
// line break. file:/// is excluded on purpose (local, not network); the test
// relies on that.
auto Util::protocolRegex() -> const QRegularExpression & {
  static const QRegularExpression regex{
      R"(((?:https?|ftp|ssh|sftp|ftps|webdav|webdavs)://[^"\s<>\)\‍]\‍[]+))"};
  return regex;
}
 
auto Util::isLaunchableWebUrl(const QString &value) -> bool {
  const QString trimmed = value.trimmed();
  if (trimmed.isEmpty()) {
    return false;
  }
  // Reject control characters first, before QUrl normalisation can hide a
  // CR/LF/NUL injection into the OS URL handler.
  for (const QChar &c : trimmed) {
    if (c == QLatin1Char('\r') || c == QLatin1Char('\n') ||
        c == QChar(QChar::Null)) {
      return false;
    }
  }
  const QUrl url(trimmed, QUrl::StrictMode);
  if (!url.isValid()) {
    return false;
  }
  const QString scheme = url.scheme().toLower();
  if (scheme != QLatin1String("http") && scheme != QLatin1String("https")) {
    return false;
  }
  if (url.host().isEmpty()) {
    return false;
  }
  // Embedded userinfo (user:pass@host) would leak into browser history.
  if (!url.userName().isEmpty() || !url.password().isEmpty()) {
    return false;
  }
  return true;
}
 
auto Util::linkifyUrls(const QString &text, bool *linked) -> QString {
  if (linked != nullptr) {
    *linked = false;
  }
  QString html;
  html.reserve(text.size());
  qsizetype lastIndex = 0;
  QRegularExpressionMatchIterator it = protocolRegex().globalMatch(text);
  while (it.hasNext()) {
    const QRegularExpressionMatch match = it.next();
    const QString url = match.captured(0);
    if (!isLaunchableWebUrl(url)) {
      // Not a web URL (or it carries credentials): leave it in the escaped
      // plain-text run instead of making it clickable.
      continue;
    }
    const qsizetype start = match.capturedStart(0);
    html += text.mid(lastIndex, start - lastIndex).toHtmlEscaped();
    const QString escapedUrl = url.toHtmlEscaped();
    html += QStringLiteral("<a href=\"%1\">%1</a>").arg(escapedUrl);
    lastIndex = match.capturedEnd(0);
    if (linked != nullptr) {
      *linked = true;
    }
  }
  html += text.mid(lastIndex).toHtmlEscaped();
  return html;
}
 
auto Util::newLinesRegex() -> const QRegularExpression & {
  static const QRegularExpression regex{"[\r\n]"};
  return regex;
}
 
// No content heuristics: a line rejected here is erased the next time .gpg-id
// is rewritten. A leading `-` is refused because the recipients also go
// positionally to `gpg --list-keys`, where it would parse as an option.
auto Util::isValidKeyId(const QString &keyId) -> bool {
  return !keyId.isEmpty() && !keyId.startsWith('-');
}
 
namespace {
template <typename Visit> void walkStore(const QString &dir, Visit visit) {
  // Absolute, so the results are whatever the caller's cwd; not canonical,
  // so a linked root keeps the name it was configured under.
  QStringList pending{QDir(QDir::cleanPath(dir)).absolutePath()};
  while (!pending.isEmpty()) {
    const QDir current(pending.takeLast());
    // Every entry once, links and hidden entries included, so the decision
    // what to do with each is taken here, before any recursion. QDir::System
    // keeps dangling links in the listing.
    const QFileInfoList entries =
        current.entryInfoList(QDir::Dirs | QDir::Files | QDir::Hidden |
                                  QDir::System | QDir::NoDotAndDotDot,
                              QDir::Name);
    QStringList subdirs;
    for (const QFileInfo &entry : entries) {
      if (visit(entry)) {
        subdirs << entry.filePath();
      }
    }
    // Pushed last-to-first so the next one taken is the first by name.
    for (auto it = subdirs.crbegin(); it != subdirs.crend(); ++it) {
      pending << *it;
    }
  }
}

auto isLink(const QFileInfo &entry) -> bool {
  return entry.isSymLink() || entry.isJunction();
}

auto isHiddenEntry(const QFileInfo &entry) -> bool {
  return entry.isHidden() || entry.fileName().startsWith(QLatin1Char('.'));
}

auto isStoreDirectory(const QFileInfo &entry) -> bool {
  return !isLink(entry) && entry.isDir() && !isHiddenEntry(entry);
}
} // namespace
 
auto Util::regularFilesUnder(const QString &dir, const QStringList &nameFilters,
                             QStringList *skipped, bool hiddenFiles)
    -> QStringList {
  QStringList files;
  walkStore(dir, [&](const QFileInfo &entry) {
    if (isStoreDirectory(entry)) {
      return true;
    }
    const bool named = QDir::match(nameFilters, entry.fileName());
    if (isLink(entry) || (!entry.isDir() && !entry.isFile())) {
      // A linked directory hides everything behind it; a linked file, or a
      // FIFO, socket or device, is only of interest under a name the caller
      // asked for.
      if (skipped != nullptr && (entry.isDir() || named)) {
        qCWarning(lcQtPass) << "Skipping" << entry.filePath()
                            << ": not a regular file or directory";
        *skipped << entry.filePath();
      }
      return false;
    }
    if (entry.isFile() && named && (hiddenFiles || !isHiddenEntry(entry))) {
      files << entry.filePath();
    }
    return false;
  });
  return files;
}
 
auto Util::directoriesUnder(const QString &dir) -> QStringList {
  QStringList dirs;
  walkStore(dir, [&](const QFileInfo &entry) {
    if (!isStoreDirectory(entry)) {
      return false;
    }
    dirs << entry.filePath();
    return true;
  });
  return dirs;
}
 
auto Util::isLinkedFolder(const QString &path) -> bool {
  return isLink(QFileInfo(QDir::cleanPath(path)));
}
 
auto Util::isUnderLink(const QString &path, const QString &storeRoot,
                       bool includeSelf) -> bool {
  // "C:/Store" and "c:/store" are one directory on Windows; a path spelled
  // the other way must not skip the walk (as in Pass::getGpgIdPath).
#ifdef Q_OS_WIN
  constexpr auto cs = Qt::CaseInsensitive;
#else
  constexpr auto cs = Qt::CaseSensitive;
#endif
  const QString root = QDir::cleanPath(storeRoot);
  // A root of "/" or "C:/" already ends in the separator.
  const QString prefix =
      root.endsWith(QLatin1Char('/')) ? root : root + QLatin1Char('/');
  const auto isRoot = [&](const QString &p) {
    return p.compare(root, cs) == 0;
  };
  QString current = QDir::cleanPath(path);
  if (!current.startsWith(prefix, cs)) {
    // Not under the store as named: only the entry itself can be judged.
    return includeSelf && !isRoot(current) && isLinkedFolder(current);
  }
  if (!includeSelf) {
    current = QFileInfo(current).path();
  }
  for (; !isRoot(current) && current.startsWith(prefix, cs);
       current = QFileInfo(current).path()) {
    if (isLinkedFolder(current)) {
      return true;
    }
  }
  return false;
}
 
#ifndef Q_OS_WIN
namespace {

auto hasNoHardLinks(int error) -> bool {
  return error == EPERM || error == ENOTSUP || error == EOPNOTSUPP ||
         error == ENOSYS;
}

auto renameExclusive(const QByteArray &source, const QByteArray &target)
    -> std::optional<bool> {
#if defined(__GLIBC__) &&                                                      \
    (__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 28))
  if (::renameat2(AT_FDCWD, source.constData(), AT_FDCWD, target.constData(),
                  RENAME_NOREPLACE) == 0) {
    return true;
  }
  if (errno == EINVAL || errno == ENOSYS || hasNoHardLinks(errno)) {
    return std::nullopt;
  }
  return false;
#elif defined(Q_OS_MACOS)
  if (::renamex_np(source.constData(), target.constData(), RENAME_EXCL) == 0) {
    return true;
  }
  if (errno == EINVAL || errno == ENOTSUP) {
    return std::nullopt;
  }
  return false;
#else
  Q_UNUSED(source);
  Q_UNUSED(target);
  return std::nullopt;
#endif
}

auto placeWithoutReplacing(const QByteArray &source, const QByteArray &target)
    -> bool {
  // linkat() without AT_SYMLINK_FOLLOW follows nothing; link() would, on
  // macOS and the BSDs, hard-link whatever a symlink planted under the
  // source's name points at.
  if (::linkat(AT_FDCWD, source.constData(), AT_FDCWD, target.constData(), 0) ==
      0) {
    ::unlink(source.constData());
    return true;
  }
  if (!hasNoHardLinks(errno)) {
    return false;
  }
  if (const std::optional<bool> renamed = renameExclusive(source, target)) {
    return *renamed;
  }
  struct stat st{};
  if (::lstat(target.constData(), &st) == 0 || errno != ENOENT) {
    errno = EEXIST;
    return false;
  }
  return ::rename(source.constData(), target.constData()) == 0;
}
 
} // namespace
#endif
 
auto Util::replaceFile(const QString &from, const QString &to, bool replace)
    -> bool {
#ifdef Q_OS_WIN
  const std::wstring source =
      QDir::toNativeSeparators(QFileInfo(from).absoluteFilePath())
          .toStdWString();
  const std::wstring target =
      QDir::toNativeSeparators(QFileInfo(to).absoluteFilePath()).toStdWString();
  // WRITE_THROUGH: the new entry is on the device when this returns.
  return MoveFileExW(source.c_str(), target.c_str(),
                     (replace ? MOVEFILE_REPLACE_EXISTING : 0) |
                         MOVEFILE_WRITE_THROUGH) != 0;
#else
  const QByteArray source = QFile::encodeName(from);
  const QByteArray target = QFile::encodeName(to);
  if (replace) {
    if (::rename(source.constData(), target.constData()) != 0) {
      return false;
    }
  } else {
    if (!placeWithoutReplacing(source, target)) {
      return false;
    }
  }
  // Sync the directory entry so a crash does not lose the new name. Best
  // effort: the bytes are already synced, and some network filesystems
  // cannot sync a directory.
  const int dir = ::open(QFile::encodeName(QFileInfo(to).path()).constData(),
                         O_RDONLY | O_DIRECTORY | O_CLOEXEC);
  if (dir >= 0) {
    int rc;
    do {
      rc = ::fsync(dir);
    } while (rc != 0 && errno == EINTR);
    ::close(dir);
  }
  return true;
#endif
}
 
auto Util::openRegularFile(const QString &path, QFile &file) -> bool {
#ifdef Q_OS_WIN
  // FILE_FLAG_OPEN_REPARSE_POINT opens a symbolic link or junction itself
  // rather than its target, so the handle's attributes say what the name
  // was at the moment of the open.
  const std::wstring native =
      QDir::toNativeSeparators(QFileInfo(path).absoluteFilePath())
          .toStdWString();
  HANDLE handle = CreateFileW(
      native.c_str(), GENERIC_READ,
      FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr,
      OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
  if (handle == INVALID_HANDLE_VALUE) {
    return false;
  }
  BY_HANDLE_FILE_INFORMATION info{};
  if (!GetFileInformationByHandle(handle, &info) ||
      (info.dwFileAttributes &
       (FILE_ATTRIBUTE_REPARSE_POINT | FILE_ATTRIBUTE_DIRECTORY |
        FILE_ATTRIBUTE_DEVICE)) != 0 ||
      GetFileType(handle) != FILE_TYPE_DISK) {
    CloseHandle(handle);
    return false;
  }
  const int fd = _open_osfhandle(reinterpret_cast<intptr_t>(handle),
                                 _O_RDONLY | _O_BINARY);
  if (fd < 0) {
    CloseHandle(handle);
    return false;
  }
  if (!file.open(fd, QIODevice::ReadOnly, QFileDevice::AutoCloseHandle)) {
    _close(fd);
    return false;
  }
  return true;
#else
  // O_NOFOLLOW fails with ELOOP on a symbolic link; O_NONBLOCK keeps a FIFO
  // from blocking the open until fstat() can refuse it.
  const int fd = ::open(QFile::encodeName(path).constData(),
                        O_RDONLY | O_NOFOLLOW | O_NONBLOCK | O_CLOEXEC);
  if (fd < 0) {
    return false;
  }
  struct stat st{};
  if (::fstat(fd, &st) != 0 || !S_ISREG(st.st_mode)) {
    ::close(fd);
    return false;
  }
  // The descriptor, not the name, is what QFile opens here: the object
  // fstat() judged is the object read. CodeQL's check-then-use pattern
  // matcher sees an open after a check and cannot tell.
  if (!file.open(fd, QIODevice::ReadOnly, // codeql[cpp/toctou-race-condition]
                 QFileDevice::AutoCloseHandle)) {
    ::close(fd);
    return false;
  }
  return true;
#endif
}
 
auto Util::readRegularFile(const QString &path, qint64 maxBytes)
    -> std::optional<QByteArray> {
  QFile file;
  if (!openRegularFile(path, file)) {
    return std::nullopt;
  }
  // A regular file's size is reliable, also when sparse: refuse a large one
  // before reading anything. One byte past the limit still guards a file
  // that grows meanwhile.
  if (file.size() > maxBytes) {
    return std::nullopt;
  }
  QByteArray bytes = file.read(maxBytes + 1);
  if (bytes.size() > maxBytes || file.error() != QFileDevice::NoError) {
    return std::nullopt;
  }
  return bytes;
}
 
auto Util::syncToDisk(QFileDevice &file) -> bool {
  if (!file.flush()) {
    return false;
  }
#ifdef Q_OS_WIN
  const HANDLE handle = reinterpret_cast<HANDLE>(_get_osfhandle(file.handle()));
  return handle != INVALID_HANDLE_VALUE && FlushFileBuffers(handle) != 0;
#else
  return ::fsync(file.handle()) == 0;
#endif
}
 
namespace {

struct FileIdentity {
  quint64 volume = 0;
  quint64 index = 0;
  bool known = false;
};
 
auto operator==(const FileIdentity &a, const FileIdentity &b) -> bool {
  return a.known && b.known && a.volume == b.volume && a.index == b.index;
}

auto identityOf(const QFileDevice &file) -> FileIdentity {
#ifdef Q_OS_WIN
  const HANDLE handle = reinterpret_cast<HANDLE>(_get_osfhandle(file.handle()));
  BY_HANDLE_FILE_INFORMATION info;
  if (handle == INVALID_HANDLE_VALUE ||
      GetFileInformationByHandle(handle, &info) == 0) {
    return {};
  }
  // On FAT/exFAT the file ID is the directory entry's offset, which a rename
  // can move. They have no hard links either (the swap this catches needs
  // one), so the identity is left unknown there.
  DWORD flags = 0;
  if (GetVolumeInformationByHandleW(handle, nullptr, 0, nullptr, nullptr,
                                    &flags, nullptr, 0) == 0 ||
      (flags & FILE_SUPPORTS_HARD_LINKS) == 0) {
    return {};
  }
  return {info.dwVolumeSerialNumber,
          (static_cast<quint64>(info.nFileIndexHigh) << 32) |
              info.nFileIndexLow,
          true};
#else
  struct stat st{};
  if (::fstat(file.handle(), &st) != 0) {
    return {};
  }
  return {static_cast<quint64>(st.st_dev), static_cast<quint64>(st.st_ino),
          true};
#endif
}

auto fail(QString *error, const QString &text) -> bool {
  if (error != nullptr) {
    *error = text;
  }
  return false;
}

struct Staged {
  QString path;
  FileIdentity identity;
};

auto stageNextTo(const QString &path, const Util::Filler &fill, QString *why)
    -> std::optional<Staged> {
  Staged staged;
  {
    QTemporaryFile file(QFileInfo(path).path() +
                        QStringLiteral("/.qtpass-XXXXXX.tmp"));
    file.setAutoRemove(false);
    if (!file.open()) {
      *why = QCoreApplication::translate(
                 "Util", "Cannot create a temporary file next to %1: %2")
                 .arg(path, file.errorString());
      return std::nullopt;
    }
    staged.path = file.fileName();
    // Owner-only: a .gpg-id names the keys a store is encrypted to, an
    // entry is an entry. QTemporaryFile creates 0600 already; say so for
    // platforms where it may not.
    file.setPermissions(QFile::ReadOwner | QFile::WriteOwner);
    *why = fill(file);
    if (why->isEmpty() && !Util::syncToDisk(file)) {
      *why = QCoreApplication::translate("Util", "Cannot write %1: %2")
                 .arg(path, file.errorString());
    }
    staged.identity = identityOf(file);
  }
  if (!why->isEmpty()) {
    QFile::remove(staged.path);
    return std::nullopt;
  }
  return staged;
}

auto placementError(const QString &path, bool replace) -> QString {
  if (replace) {
    return QCoreApplication::translate("Util", "Failed to replace %1.")
        .arg(path);
  }
  const QFileInfo taken(path);
  return taken.exists() || taken.isSymLink()
             ? QCoreApplication::translate("Util", "%1 already exists.")
                   .arg(path)
             : QCoreApplication::translate("Util", "Failed to write %1.")
                   .arg(path);
}

auto isTheFileWritten(const QString &path, const FileIdentity &written)
    -> bool {
  QFile placed;
  if (!Util::openRegularFile(path, placed)) {
    return false;
  }
  const FileIdentity there = identityOf(placed);
  if (!written.known || !there.known) {
    qCWarning(lcQtPass) << "Cannot tell whether" << path
                        << "is the file that was written here";
    return true;
  }
  return there == written;
}
 
} // namespace
 
auto Util::stageFileReplacing(const QString &path, bool replace,
                              const Filler &fill, QString *error) -> bool {
  QString why;
  const std::optional<Staged> staged = stageNextTo(path, fill, &why);
  if (!staged) {
    return fail(error, why);
  }
  if (!replaceFile(staged->path, path, replace)) {
    QFile::remove(staged->path);
    return fail(error, placementError(path, replace));
  }
  // A mismatch is reported and left: removing by name could take another
  // writer's file.
  if (!isTheFileWritten(path, staged->identity)) {
    return fail(
        error,
        QCoreApplication::translate(
            "Util", "%1 was swapped for another file while it was written.")
            .arg(path));
  }
  return true;
}
 
auto Util::writeFileReplacing(const QString &path, const QByteArray &bytes,
                              bool replace, QString *error) -> bool {
  return stageFileReplacing(
      path, replace,
      [&path, &bytes](QFileDevice &staged) -> QString {
        if (staged.write(bytes) != bytes.size()) {
          return QCoreApplication::translate("Util", "Cannot write %1: %2")
              .arg(path, staged.errorString());
        }
        return {};
      },
      error);
}
 
auto Util::copyFileReplacing(const QString &src, const QString &dst,
                             bool replace, QString *error) -> bool {
  QFile in;
  if (!openRegularFile(src, in)) {
    if (error)
      *error = QCoreApplication::translate("Util", "Cannot read %1.").arg(src);
    return false;
  }
  return stageFileReplacing(
      dst, replace,
      [&src, &dst, &in](QFileDevice &staged) -> QString {
        char buf[64 * 1024];
        for (;;) {
          const qint64 n = in.read(buf, sizeof buf);
          if (n < 0) {
            return QCoreApplication::translate("Util", "Cannot read %1: %2")
                .arg(src, in.errorString());
          }
          if (n == 0) {
            return {};
          }
          if (staged.write(buf, n) != n) {
            return QCoreApplication::translate("Util", "Cannot write %1: %2")
                .arg(dst, staged.errorString());
          }
        }
      },
      error);
}
 
namespace {

auto removeEntry(const QFileInfo &entry) -> bool {
  const QString path = entry.filePath();
  if (isLink(entry)) {
    if (QFile::remove(path) || QDir().rmdir(path)) {
      return true;
    }
    qCWarning(lcQtPass) << "Could not remove link" << path;
    return false;
  }
  if (QFile::remove(path)) {
    return true;
  }
  const QFile::Permissions perms = QFile::permissions(path);
  if (!perms.testFlag(QFile::WriteUser) &&
      QFile::setPermissions(path, perms | QFile::WriteUser) &&
      QFile::remove(path)) {
    return true;
  }
  qCWarning(lcQtPass) << "Could not remove" << path;
  return false;
}
 
} // namespace
 
auto Util::removeTree(const QString &dir) -> bool {
  // A trailing separator makes lstat follow a link ("link/" is the target
  // directory); the link itself is what this is about.
  const QString path = QDir::cleanPath(dir);
  const QFileInfo top(path);
  if (isLink(top)) {
    // rm -rf on a link removes the link.
    return QFile::remove(path) || QDir().rmdir(path);
  }
  if (!top.isDir()) {
    return false;
  }
  bool ok = true;
  const QFileInfoList entries =
      QDir(path).entryInfoList(QDir::Dirs | QDir::Files | QDir::Hidden |
                                   QDir::System | QDir::NoDotAndDotDot,
                               QDir::Name);
  for (const QFileInfo &entry : entries) {
    const bool removed = entry.isDir() && !isLink(entry)
                             ? removeTree(entry.filePath())
                             : removeEntry(entry);
    ok = removed && ok;
  }
  return ok && QDir().rmdir(path);
}