Certain apps store data unencrypted within encrypted folders

[cyphunk]

I have the text app enabled. I create a new text file ("enc.md") within an encrypted folder. When I edit this file the data shows up in plain text on the server. I'm reporting this issue here rather than in the "text" app because the e2e encryption system should not permit storing of unencrypted data in encrypted folders, or should not allow apps to store data in them, or should at least note which files are actually encrypted

Steps to reproduce

• on android nextcloud app (3.10.1)
  • create new folder "Encrypted"
  • in files view change folder properties to encrypted
  • open Encrypted folder
  • press "+" and choose to create new text document "enc.md"
  • add some text to document
  • close document
• on server: cat data/user/files/Encrypted/enc.md
  • observe that plaintext data is shown

Expected behaviour

Any data stored in encrypted folder should appear encrypted on the server hard disk

Actual behaviour

cat data/_user_/files/Encrypted/enc.md shows plaintext data

Server configuration

Operating system: ubuntu 18.04

Web server: nginx 1.14.0-0ubuntu1.7

Database: whatever is in the docker hub nextcloud:18.0.2-fpm-alpine

PHP version: whatever is in the docker hub nextcloud:18.0.2-fpm-alpine

Nextcloud version: docker hub nextcloud:18.0.2-fpm-alpine

Updated from an older Nextcloud/ownCloud or fresh install: fresh

Where did you install Nextcloud from: docker hub nextcloud:18.0.2-fpm-alpine

Android app version: 3.10.1

[georgehrke]

@juliushaertl

[georgehrke]

@cyphunk Can you please use the issue template: https://github.com/nextcloud/server/blob/master/.github/ISSUE_TEMPLATE/Bug_report.md

open Encrypted folder

This step should not be possible. You should not be able to open encrypted folders in the web ui.

[cyphunk]

will correct to this format. BTW, it wasn't accessible in webui. that still remained true. enc.md file in encrypted folder was only accessible in android app. still, data on server stored unencrypted

[georgehrke]

What version of the Android app are you using?

[cyphunk]

3.10.1

[juliusknorr]

There seem to be actually two issues here:

• The text app should just not work with e2ee
• The mobile apps should not allow direct editing and creating files inside of e2ee folders

cc @tobiasKaminsky @marinofaggiana

[cyphunk]

hmm. can I submit this as a bug bounty? :)

[georgehrke]

• The text app should just not work with e2ee

@juliushaertl Any update here? :)

[juliusknorr]

@georgehrke Do you have any idea how i could check if a file or the parent folder is encrypted with e2e but not with SSE (since there the encrypted flag in the filecache would also be set)

[juliusknorr]

I didn't check in detail yet, but I would expect this could also cause issues when SSE and E2E are used in parallel: https://github.com/nextcloud/end_to_end_encryption/blob/64d372ae558b894f667a280fb4e35343f760de3e/lib/EncryptionManager.php#L100