MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-20 18:06:10 -05:00
Code Issues Packages Projects Releases Wiki Activity

Extract all files from encrypted stream with inspect (#20937)

Browse Source 
Allow multiple private keys and extract all files from streams.

Place files in the folder with `.enc` removed.

Do basic checks so streams cannot traverse outside of the folder.
This commit is contained in:
Klaus Post
2025-02-17 09:09:42 -08:00
committed by GitHub
parent 727a803bc0
commit b312f13473
2 changed files with 70 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
docs/debugging/inspect/decrypt-v2.go
View File

@@ -22,6 +22,9 @@ import (
"fmt"
"io"
"os"
"path/filepath"
"strings"
"unicode/utf8"
"github.com/minio/madmin-go/v3/estream"
)
@@ -30,18 +33,18 @@ type keepFileErr struct {
error
}
func extractInspectV2(pk []byte, r io.Reader, w io.Writer, okMsg string) error {
privKey, err := bytesToPrivateKey(pk)
if err != nil {
return fmt.Errorf("decoding key returned: %w", err)
}
func extractInspectV2(pks [][]byte, r io.Reader, extractDir string) error {
sr, err := estream.NewReader(r)
if err != nil {
return err
}
sr.SetPrivateKey(privKey)
for _, pk := range pks {
privKey, err := bytesToPrivateKey(pk)
if err != nil {
return fmt.Errorf("decoding key returned: %w", err)
}
sr.SetPrivateKey(privKey)
}
sr.ReturnNonDecryptable(true)
// Debug corrupted streams.
@@ -60,33 +63,29 @@ func extractInspectV2(pk []byte, r io.Reader, w io.Writer, okMsg string) error {
return errors.New("no data found on stream")
}
if errors.Is(err, estream.ErrNoKey) {
if stream.Name == "inspect.zip" {
return errors.New("incorrect private key")
}
fmt.Println("Skipping", stream.Name, "no private key")
if err := stream.Skip(); err != nil {
return fmt.Errorf("stream skip: %w", err)
}
continue
}
if extracted {
return keepFileErr{fmt.Errorf("next stream: %w", err)}
}
return fmt.Errorf("next stream: %w", err)
}
if stream.Name == "inspect.zip" {
if extracted {
return keepFileErr{errors.New("multiple inspect.zip streams found")}
}
_, err := io.Copy(w, stream)
if err != nil {
return fmt.Errorf("reading inspect stream: %w", err)
}
fmt.Println(okMsg)
extracted = true
continue
if strings.Contains(stream.Name, "..") || !utf8.ValidString(stream.Name) {
return fmt.Errorf("invalid stream name: %q", stream.Name)
}
if err := stream.Skip(); err != nil {
return fmt.Errorf("stream skip: %w", err)
dst := filepath.Join(extractDir, stream.Name)
os.Mkdir(extractDir, 0o755)
w, err := os.Create(dst)
if err != nil {
return fmt.Errorf("creating output file: %w", err)
}
_, err = io.Copy(w, stream)
if err != nil {
return fmt.Errorf("reading inspect stream: %w", err)
}
fmt.Printf("Extracted: %s\n", dst)
extracted = true
}
}