Quarantine.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include "Resource.hpp"
#include "Quarantine.hpp"
#include "Backend.hpp"
 
#include <filesystem>
#include <fstream>
#include <iostream>
#include <cstdlib>
#include <system_error>
#include <unistd.h>
#include <glib/gi18n.h>
 
namespace fs = std::filesystem;
 
namespace {
 
bool is_regular_file_without_following_symlinks(const fs::path& path,
                                                std::error_code& ec)
{
    ec.clear();
    const fs::file_status status = fs::symlink_status(path, ec);
    return !ec && fs::exists(status) && fs::is_regular_file(status);
}
 
fs::path normalize_path(const fs::path& path, std::error_code& ec)
{
    ec.clear();
    fs::path normalized = fs::weakly_canonical(path, ec);
    if (!ec)
        return normalized.lexically_normal();
 
    ec.clear();
    normalized = fs::absolute(path, ec);
    if (!ec)
        return normalized.lexically_normal();
 
    return path.lexically_normal();
}
 
bool is_path_inside(const fs::path& candidate, const fs::path& directory)
{
    std::error_code candidate_ec;
    std::error_code directory_ec;
 
    const fs::path normalized_candidate = normalize_path(candidate, candidate_ec);
    const fs::path normalized_directory = normalize_path(directory, directory_ec);
 
    if (candidate_ec || directory_ec || normalized_directory.empty())
        return false;
 
    auto candidate_it = normalized_candidate.begin();
    for (auto directory_it = normalized_directory.begin();
         directory_it != normalized_directory.end();
         ++directory_it, ++candidate_it) {
        if (candidate_it == normalized_candidate.end() ||
            *candidate_it != *directory_it) {
            return false;
        }
    }
 
    return true;
}
 
void remove_without_throwing(const fs::path& path)
{
    std::error_code ec;
    fs::remove(path, ec);
}
 
bool copy_then_remove(const fs::path& source, const fs::path& destination)
{
    std::error_code copy_ec;
    fs::copy_file(source, destination, fs::copy_options::none, copy_ec);
    if (copy_ec) {
        std::cerr << _("❌ Errore copia in quarantena: ")
                  << copy_ec.message() << std::endl;
        return false;
    }
 
    std::error_code remove_ec;
    fs::remove(source, remove_ec);
    if (remove_ec) {
        std::cerr << _("❌ Impossibile rimuovere il file originale dopo la copia: ")
                  << remove_ec.message() << std::endl;
 
        // La quarantena non è riuscita: non lasciare una copia che possa
        // essere interpretata come isolamento completato.
        remove_without_throwing(destination);
        return false;
    }
 
    return true;
}
 
} // namespace
 
std::string Quarantine::getQuarantinePath()
{
    std::string path = Backend::getQuarantinePath();
    if (path.empty()) {
        const char* home = std::getenv("HOME");
        path = std::string(home ? home : "/tmp") +
               "/.local/share/BastionGuard/quarantine";
    }
 
    try {
        const fs::path quarantine_path(path);
 
        if (quarantine_path.empty() ||
            quarantine_path == quarantine_path.root_path()) {
            std::cerr << _("❌ Percorso di quarantena non valido: ")
                      << quarantine_path << std::endl;
            return {};
        }
 
        std::error_code ec;
        fs::create_directories(quarantine_path, ec);
        if (ec) {
            std::cerr << _("❌ Errore creazione cartella quarantena: ")
                      << ec.message() << std::endl;
            return {};
        }
 
        ec.clear();
        if (!fs::is_directory(quarantine_path, ec) || ec) {
            std::cerr << _("❌ Il percorso di quarantena non è una directory valida: ")
                      << quarantine_path << std::endl;
            return {};
        }
    } catch (const std::exception& e) {
        std::cerr << _("❌ Errore creazione cartella quarantena: ")
                  << e.what() << std::endl;
        return {};
    }
 
    return path;
}
 
bool Quarantine::move(const std::string& filepath)
{
    try {
        if (filepath.empty()) {
            std::cerr << _("❌ Percorso file vuoto: quarantena annullata")
                      << std::endl;
            return false;
        }
 
        std::error_code ec;
        fs::path src = fs::absolute(fs::path(filepath), ec);
        if (ec) {
            std::cerr << _("❌ Impossibile risolvere il percorso del file: ")
                      << filepath << " | " << ec.message() << std::endl;
            return false;
        }
        src = src.lexically_normal();
 
        // Protezione fondamentale: non seguire symlink e non accettare
        // directory, socket, FIFO o device. Solo file regolari.
        if (!is_regular_file_without_following_symlinks(src, ec)) {
            std::cerr << _("❌ Quarantena rifiutata: il percorso non è un file regolare: ")
                      << src;
            if (ec)
                std::cerr << " | " << ec.message();
            std::cerr << std::endl;
            return false;
        }
 
        const std::string quarantine_dir_string = getQuarantinePath();
        if (quarantine_dir_string.empty())
            return false;
 
        const fs::path quarantine_dir(quarantine_dir_string);
 
        // Evita loop e tentativi di mettere nuovamente in quarantena un file
        // che si trova già nell'area protetta.
        if (is_path_inside(src, quarantine_dir)) {
            std::cerr << _("❌ Il file è già contenuto nella quarantena: ")
                      << src << std::endl;
            return false;
        }
 
        fs::path dest = quarantine_dir / src.filename();
 
        int counter = 1;
        while (fs::exists(dest) || fs::exists(dest.string() + ".meta")) {
            dest = quarantine_dir /
                   (src.stem().string() + "_" + std::to_string(counter) +
                    src.extension().string());
            ++counter;
        }
 
        const fs::path meta_path(dest.string() + ".meta");
        std::ofstream meta(meta_path, std::ios::out | std::ios::trunc);
        if (!meta.is_open()) {
            std::cerr << _("❌ Impossibile creare i metadata di quarantena: ")
                      << meta_path << std::endl;
            return false;
        }
 
        meta << src.string() << '\n';
        meta.flush();
        if (!meta.good()) {
            meta.close();
            remove_without_throwing(meta_path);
            std::cerr << _("❌ Scrittura metadata di quarantena fallita: ")
                      << meta_path << std::endl;
            return false;
        }
        meta.close();
 
        ec.clear();
        fs::rename(src, dest, ec);
 
        if (ec) {
            if (ec == std::make_error_code(std::errc::cross_device_link)) {
                std::cerr << _("DEBUG move(): filesystem differente, uso copia e rimozione\n");
 
                if (!copy_then_remove(src, dest)) {
                    remove_without_throwing(meta_path);
                    return false;
                }
            } else {
                std::cerr << _("❌ Errore spostamento quarantena: ")
                          << ec.message() << std::endl;
                remove_without_throwing(meta_path);
                return false;
            }
        }
 
        std::cout << _("✔ File spostato in quarantena: ")
                  << dest << std::endl;
        return true;
 
    } catch (const std::exception& e) {
        std::cerr << _("❌ Errore spostamento quarantena: ")
                  << e.what() << std::endl;
        return false;
    }
}
 
bool Quarantine::restore(const std::string& quarantinedFile)
{
    try {
        std::error_code ec;
        fs::path qf = fs::absolute(fs::path(quarantinedFile), ec);
        if (ec) {
            std::cerr << _("❌ Percorso quarantena non valido: ")
                      << quarantinedFile << " | " << ec.message() << std::endl;
            return false;
        }
        qf = qf.lexically_normal();
 
        const std::string quarantine_dir_string = getQuarantinePath();
        if (quarantine_dir_string.empty())
            return false;
 
        const fs::path quarantine_dir(quarantine_dir_string);
        if (!is_path_inside(qf, quarantine_dir)) {
            std::cerr << _("❌ Ripristino rifiutato: file esterno alla quarantena: ")
                      << qf << std::endl;
            return false;
        }
 
        if (!is_regular_file_without_following_symlinks(qf, ec)) {
            std::cerr << _("❌ Ripristino rifiutato: elemento non regolare: ")
                      << qf << std::endl;
            return false;
        }
 
        const fs::path meta(qf.string() + ".meta");
        if (!is_regular_file_without_following_symlinks(meta, ec)) {
            std::cerr << _("❌ Ripristino impossibile: metadata mancante o non valido per ")
                      << qf << std::endl;
            return false;
        }
 
        std::ifstream in(meta);
        std::string original_path;
        std::getline(in, original_path);
        in.close();
 
        if (original_path.empty()) {
            std::cerr << _("❌ Ripristino impossibile: metadata vuoto o corrotto in ")
                      << meta << std::endl;
            return false;
        }
 
        fs::path original = fs::absolute(fs::path(original_path), ec);
        if (ec) {
            std::cerr << _("❌ Percorso originale non valido nei metadata: ")
                      << original_path << " | " << ec.message() << std::endl;
            return false;
        }
        original = original.lexically_normal();
 
        if (is_path_inside(original, quarantine_dir)) {
            std::cerr << _("❌ Ripristino rifiutato: destinazione interna alla quarantena: ")
                      << original << std::endl;
            return false;
        }
 
        fs::create_directories(original.parent_path(), ec);
        if (ec) {
            std::cerr << _("❌ Impossibile ricreare la directory originale: ")
                      << original.parent_path() << " | " << ec.message() << std::endl;
            return false;
        }
 
        fs::path final_dest = original;
        int counter = 1;
        while (fs::exists(final_dest)) {
            final_dest = original.parent_path() /
                         (original.stem().string() + "_restored" +
                          std::to_string(counter) + original.extension().string());
            ++counter;
        }
 
        ec.clear();
        fs::rename(qf, final_dest, ec);
 
        if (ec) {
            if (ec == std::make_error_code(std::errc::cross_device_link)) {
                std::cerr << _("DEBUG restore(): filesystem differente, uso copia e rimozione\n");
 
                if (!copy_then_remove(qf, final_dest))
                    return false;
            } else {
                std::cerr << _("❌ Errore ripristino: ")
                          << ec.message() << std::endl;
                return false;
            }
        }
 
        remove_without_throwing(meta);
 
        std::cout << _("✔ File ripristinato in: ")
                  << final_dest << std::endl;
        return true;
 
    } catch (const std::exception& e) {
        std::cerr << _("❌ Errore ripristino: ")
                  << e.what() << std::endl;
        return false;
    }
}
 
bool Quarantine::remove(const std::string& quarantinedFile)
{
    try {
        std::error_code ec;
        fs::path qf = fs::absolute(fs::path(quarantinedFile), ec);
        if (ec) {
            std::cerr << _("❌ Percorso quarantena non valido: ")
                      << quarantinedFile << " | " << ec.message() << std::endl;
            return false;
        }
        qf = qf.lexically_normal();
 
        const std::string quarantine_dir_string = getQuarantinePath();
        if (quarantine_dir_string.empty())
            return false;
 
        if (!is_path_inside(qf, fs::path(quarantine_dir_string))) {
            std::cerr << _("❌ Eliminazione rifiutata: file esterno alla quarantena: ")
                      << qf << std::endl;
            return false;
        }
 
        if (!is_regular_file_without_following_symlinks(qf, ec)) {
            std::cerr << _("❌ Eliminazione rifiutata: elemento non regolare: ")
                      << qf << std::endl;
            return false;
        }
 
        const fs::path meta(qf.string() + ".meta");
 
        ec.clear();
        fs::remove(qf, ec);
        if (ec) {
            std::cerr << _("❌ Errore eliminazione file in quarantena: ")
                      << ec.message() << std::endl;
            return false;
        }
 
        remove_without_throwing(meta);
 
        std::cout << _("✔ File eliminato dalla quarantena: ")
                  << qf << std::endl;
        return true;
 
    } catch (const std::exception& e) {
        std::cerr << _("❌ Errore eliminazione: ")
                  << e.what() << std::endl;
        return false;
    }
}