Repository: owncloud/ocis
Pull request #7184 (2023-08-31 14:50:26)

[full-ci] fix: disallow sharee to search sharer files outside the share
<!--
Thanks for submitting a change to ownCloud!

This is the bug tracker for the oCIS component. Find other components at https://github.com/owncloud/core/blob/master/.github/CONTRIBUTING.md#guidelines

For fixing potential security issues please see https://owncloud.org/security/

To make it possible for us to get your change reviewed and merged please carefully fill out the requested information below.

Please note that any kind of change needs first be submitted to the master branch which holds the next version of oCIS.

Please set the following labels:

- Set label "Status:Needs-Review" for review or "Status:In-Progress" if the PR still has open tasks.
- Assignment: assign to self
- Reviewers: pick at least one
-->

## Description
<!--- Describe your changes in detail -->

## Related Issue
<!--- This project only accepts pull requests related to open issues -->
<!--- If suggesting a new feature or change, please discuss it in an issue first -->
<!--- If fixing a bug, there should be an issue describing it with steps to reproduce -->
<!--- Please link to the issue here: -->
- Fixes <issue_link>

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->

## How Has This Been Tested?
<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->
- test environment:
- test case 1:
- test case 2:
- ...

## Screenshots (if appropriate):

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] Technical debt
- [ ] Tests only (no source changes)

## Checklist:
<!-- Tick the checkboxes when done. -->
<!-- Raise documentation ticket in owncloud.github.io/ -->
- [ ] Code changes
- [ ] Unit tests added
- [ ] Acceptance tests added
- [ ] Documentation ticket raised: <link> 



Patch:
diff --git a/services/search/pkg/engine/bleve.go b/services/search/pkg/engine/bleve.go
index 0d757b2609a..06973515c57 100644
--- a/services/search/pkg/engine/bleve.go
+++ b/services/search/pkg/engine/bleve.go
@@ -24,6 +24,7 @@ import (
 
 	"github.com/cs3org/reva/v2/pkg/storagespace"
 	"github.com/cs3org/reva/v2/pkg/utils"
+
 	searchMessage "github.com/owncloud/ocis/v2/protogen/gen/ocis/messages/search/v0"
 	searchService "github.com/owncloud/ocis/v2/protogen/gen/ocis/services/search/v0"
 	"github.com/owncloud/ocis/v2/services/search/pkg/content"
@@ -165,9 +166,11 @@ func (b *Bleve) Search(_ context.Context, sir *searchService.SearchIndexRequest)
 	totalMatches := res.Total
 	for _, hit := range res.Hits {
 		if sir.Ref != nil {
-			path := strings.TrimSuffix(getFieldValue[string](hit.Fields, "Path"), "/")
-			relRefPath := utils.MakeRelativePath(sir.Ref.Path)
-			if relRefPath != "." && !strings.HasPrefix(path, relRefPath+"/") {
+			hitPath := strings.TrimSuffix(getFieldValue[string](hit.Fields, "Path"), "/")
+			requestedPath := utils.MakeRelativePath(sir.Ref.Path)
+			isRoot := hitPath == requestedPath
+
+			if !isRoot && requestedPath != "." && !strings.HasPrefix(hitPath, requestedPath+"/") {
 				totalMatches--
 				continue
 			}
diff --git a/services/search/pkg/search/service.go b/services/search/pkg/search/service.go
index 43707a07fe1..9edfe10d223 100644
--- a/services/search/pkg/search/service.go
+++ b/services/search/pkg/search/service.go
@@ -19,14 +19,15 @@ import (
 	"github.com/cs3org/reva/v2/pkg/storage/utils/walker"
 	"github.com/cs3org/reva/v2/pkg/storagespace"
 	"github.com/cs3org/reva/v2/pkg/utils"
+	"golang.org/x/sync/errgroup"
+	"google.golang.org/protobuf/types/known/fieldmaskpb"
+
 	"github.com/owncloud/ocis/v2/ocis-pkg/log"
 	searchmsg "github.com/owncloud/ocis/v2/protogen/gen/ocis/messages/search/v0"
 	searchsvc "github.com/owncloud/ocis/v2/protogen/gen/ocis/services/search/v0"
 	"github.com/owncloud/ocis/v2/services/search/pkg/config"
 	"github.com/owncloud/ocis/v2/services/search/pkg/content"
 	"github.com/owncloud/ocis/v2/services/search/pkg/engine"
-	"golang.org/x/sync/errgroup"
-	"google.golang.org/protobuf/types/known/fieldmaskpb"
 )
 
 //go:generate mockery --name=Searcher
@@ -332,9 +333,6 @@ func (s *Service) searchIndex(ctx context.Context, req *searchsvc.SearchRequest,
 		}
 		rootName = space.GetRootInfo().GetPath()
 		permissions = space.GetRootInfo().GetPermissionSet()
-		if req.Ref == nil && utils.MakeRelativePath(searchPathPrefix) == utils.MakeRelativePath(rootName) {
-			searchPathPrefix = "."
-		}
 		s.logger.Debug().Interface("grantSpace", space).Interface("mountpointRootId", mountpointRootID).Msg("searching a grant")
 	case _spaceTypePersonal, _spaceTypeProject:
 		permissions = space.GetRootInfo().GetPermissionSet()
@@ -361,6 +359,8 @@ func (s *Service) searchIndex(ctx context.Context, req *searchsvc.SearchRequest,
 		s.logger.Debug().Interface("searchRequest", searchRequest).Str("duration", fmt.Sprint(duration)).Str("space", space.Id.OpaqueId).Int("hits", len(res.Matches)).Msg("space search done")
 	}
 
+	var matches []*searchmsg.Match
+
 	for _, match := range res.Matches {
 		if mountpointPrefix != "" {
 			match.Entity.Ref.Path = utils.MakeRelativePath(strings.TrimPrefix(match.Entity.Ref.Path, mountpointPrefix))
@@ -374,7 +374,16 @@ func (s *Service) searchIndex(ctx context.Context, req *searchsvc.SearchRequest,
 		isMountpoint := isShared && match.GetEntity().GetRef().GetPath() == "."
 		isDir := match.GetEntity().GetMimeType() == "httpd/unix-directory"
 		match.Entity.Permissions = convertToWebDAVPermissions(isShared, isMountpoint, isDir, permissions)
+
+		if req.Ref != nil && searchPathPrefix == "/"+match.Entity.Name {
+			continue
+		}
+
+		matches = append(matches, match)
 	}
+
+	res.Matches = matches
+
 	return res, nil
 }
 


Test patch:
diff --git a/services/search/pkg/engine/bleve_test.go b/services/search/pkg/engine/bleve_test.go
index 6c54d5468ef..f5692c6f40d 100644
--- a/services/search/pkg/engine/bleve_test.go
+++ b/services/search/pkg/engine/bleve_test.go
@@ -340,7 +340,7 @@ var _ = Describe("Bleve", func() {
 			It("search *doc* in a subfolder", func() {
 				res, err := doSearch(rootResource.ID, "Name:*doc*", "./doc")
 				Expect(err).ToNot(HaveOccurred())
-				Expect(res.TotalMatches).To(Equal(int32(1)))
+				Expect(res.TotalMatches).To(Equal(int32(2)))
 			})
 			It("search *file* in a root", func() {
 				res, err := doSearch(rootResource.ID, "Name:*file*", "")