R eplace SecureTemporaryFiles with an EphemeralFile implementation based on ChaCha20

.github/workflows/scripts/build_and_install.sh

@@ -8,7 +8,7 @@ cd /build/globaleaks-whistleblowing-software
 
 sudo apt-get -y update
 
-sudo apt-get -y install curl git debhelper devscripts dh-apparmor dh-python python3-all python3-pip python3-setuptools python3-sphinx
+sudo apt-get -y install curl git debhelper devscripts dh-apparmor dh-python libfuse2 python3-all python3-pip python3-setuptools python3-sphinx
 
 curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
 sudo apt-get update

.github/workflows/scripts/run_tests_backend.sh

@@ -15,7 +15,7 @@ setupClient() {
 
 echo "Running setup"
 sudo apt-get update
-sudo apt-get install -y tor
+sudo apt-get install -y libfuse2 tor
 npm install -g grunt grunt-cli
 pip install coverage
 

.github/workflows/scripts/run_tests_client.sh

@@ -15,7 +15,7 @@ setupClient() {
 
 echo "Running setup"
 sudo apt-get update
-sudo apt-get install -y tor
+sudo apt-get install -y libfuse2 tor
 npm install -g grunt grunt-cli
 setupBackend
 setupClient

backend/bin/globaleaks-eph-fs

@@ -0,0 +1,6 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+import sys
+from globaleaks.utils.eph_fs import main
+if __name__ == '__main__':
+    sys.exit(main())

backend/globaleaks/handlers/base.py

@@ -23,7 +23,7 @@
 from globaleaks.utils.ip import check_ip
 from globaleaks.utils.log import log
 from globaleaks.utils.pgp import PGPContext
-from globaleaks.utils.securetempfile import SecureTemporaryFile
+from globaleaks.utils.eph_fs import EphemeralFile
 from globaleaks.utils.utility import datetime_now
 
 mimetypes.add_type('text/javascript', '.js')
@@ -347,7 +347,7 @@ def process_file_upload(self):
                 State.RateLimitingTable.check(self.request.path + b'#' + self.request.client_ip.encode(),
                                               State.tenants[1].cache.threshold_attachments_per_hour_per_ip)
 
-            self.state.TempUploadFiles[file_id] = SecureTemporaryFile(Settings.tmp_path)
+            self.state.TempUploadFiles[file_id] = EphemeralFile(Settings.tmp_path)
 
         f = self.state.TempUploadFiles[file_id]
 
@@ -364,8 +364,6 @@ def process_file_upload(self):
             if self.request.args[b'flowChunkNumber'][0] != self.request.args[b'flowTotalChunks'][0]:
                 return None
 
-            f.finalize_write()
-
         mime_type, _ = mimetypes.guess_type(self.request.args[b'flowFilename'][0].decode())
         if mime_type is None:
             mime_type = 'application/octet-stream'

backend/globaleaks/handlers/recipient/export.py

@@ -20,8 +20,8 @@
 from globaleaks.rest import errors
 from globaleaks.settings import Settings
 from globaleaks.utils.crypto import Base64Encoder, GCE
+from globaleaks.utils.eph_fs import EphemeralFile
 from globaleaks.utils.fs import directory_traversal_check
-from globaleaks.utils.securetempfile import SecureTemporaryFile
 from globaleaks.utils.templating import Templating
 from globaleaks.utils.utility import datetime_now, datetime_null, msdos_encode
 from globaleaks.utils.zipstream import ZipStream
@@ -216,12 +216,11 @@ def get(self, itip_id):
 
         zipstream = ZipStream(files)
 
-        stf = SecureTemporaryFile(self.state.settings.tmp_path)
+        stf = EphemeralFile(self.state.settings.tmp_path)
 
         with stf.open('w') as f:
             for x in zipstream:
                 f.write(x)
-            f.finalize_write()
 
         with stf.open('r') as f:
             yield self.write_file_as_download(filename, f, pgp_key)

backend/globaleaks/tests/helpers.py

@@ -45,7 +45,7 @@
 from globaleaks.state import State, TenantState
 from globaleaks.utils import tempdict, token
 from globaleaks.utils.crypto import generateRandomKey, GCE
-from globaleaks.utils.securetempfile import SecureTemporaryFile
+from globaleaks.utils.eph_fs import EphemeralFile
 from globaleaks.utils.utility import datetime_now, uuid4
 from globaleaks.utils.log import log
 
@@ -432,11 +432,10 @@ def get_dummy_file(content=None):
     if content is None:
         content = base64.b64decode(VALID_BASE64_IMG)
 
-    temporary_file = SecureTemporaryFile(Settings.tmp_path)
+    temporary_file = EphemeralFile(Settings.tmp_path)
 
     with temporary_file.open('w') as f:
         f.write(content)
-        f.finalize_write()
 
     State.TempUploadFiles[os.path.basename(temporary_file.filepath)] = temporary_file