fix: filter ACL forbidden paths from search query

Signed-off-by: Robin Appelman <robin@icewind.nl>

Author: icewind1991

lib/ACL/ACLCacheWrapper.php

@@ -9,9 +9,14 @@
 namespace OCA\GroupFolders\ACL;
 
 use OC\Files\Cache\Wrapper\CacheWrapper;
+use OC\Files\Search\SearchBinaryOperator;
+use OC\Files\Search\SearchComparison;
 use OCP\Constants;
 use OCP\Files\Cache\ICache;
 use OCP\Files\Cache\ICacheEntry;
+use OCP\Files\Search\ISearchBinaryOperator;
+use OCP\Files\Search\ISearchComparison;
+use OCP\Files\Search\ISearchOperator;
 use OCP\Files\Search\ISearchQuery;
 
 class ACLCacheWrapper extends CacheWrapper {
@@ -75,23 +80,23 @@ public function getFolderContentsById($fileId, ?string $mimeTypeFilter = null):
 
 	#[\Override]
 	public function search($pattern): array {
-		$results = $this->getCache()->search($pattern);
+		$results = parent::search($pattern);
 		$this->preloadEntries($results);
 
 		return array_filter(array_map($this->formatCacheEntry(...), $results));
 	}
 
 	#[\Override]
 	public function searchByMime($mimetype): array {
-		$results = $this->getCache()->searchByMime($mimetype);
+		$results = parent::searchByMime($mimetype);
 		$this->preloadEntries($results);
 
 		return array_filter(array_map($this->formatCacheEntry(...), $results));
 	}
 
 	#[\Override]
 	public function searchQuery(ISearchQuery $query): array {
-		$results = $this->getCache()->searchQuery($query);
+		$results = parent::searchQuery($query);
 		$this->preloadEntries($results);
 
 		return array_filter(array_map($this->formatCacheEntry(...), $results));
@@ -106,4 +111,32 @@ private function preloadEntries(array $entries): array {
 
 		return $this->aclManager->getRelevantRulesForPath($this->getNumericStorageId(), $paths, false);
 	}
+
+	/**
+	 * Construct a search operator that filters out any paths that the current user doesn't have read permissions for
+	 */
+	private function getSearchFilter(): ISearchOperator {
+		$forbiddenPaths = $this->aclManager->getForbiddenPaths($this->getNumericStorageId(), '');
+
+		$filters = array_map(fn (string $path) => new SearchBinaryOperator(ISearchBinaryOperator::OPERATOR_NOT, [
+			new SearchComparison(ISearchComparison::COMPARE_LIKE_CASE_SENSITIVE, 'path', SearchComparison::escapeLikeParameter($path) . '/%')
+		]), $forbiddenPaths);
+		$filters[] = new SearchBinaryOperator(ISearchBinaryOperator::OPERATOR_NOT, [
+			new SearchComparison(ISearchComparison::COMPARE_IN, 'path', $forbiddenPaths)
+		]);
+		return new SearchBinaryOperator(ISearchBinaryOperator::OPERATOR_AND, $filters);
+	}
+
+	#[\Override]
+	public function getQueryFilterForStorage(): ISearchOperator {
+		$storageFilter = parent::getQueryFilterForStorage();
+
+		return new SearchBinaryOperator(
+			ISearchBinaryOperator::OPERATOR_AND,
+			[
+				$storageFilter,
+				$this->getSearchFilter(),
+			]
+		);
+	}
 }

lib/ACL/ACLManager.php

@@ -293,4 +293,23 @@ public function getBasePermission(int $folderId): int {
 
 		return Constants::PERMISSION_ALL;
 	}
+
+	/**
+	 * Calculate all paths that the current user doesn't have access to.
+	 *
+	 * @return list<string>
+	 */
+	public function getForbiddenPaths(int $storageId, string $prefix): array {
+		$rules = $this->ruleManager->getRulesForPrefix($this->user, $storageId, $prefix);
+		$forbidden = [];
+
+		foreach ($rules as $path => $pathRules) {
+			$mergedRule = Rule::mergeRules($pathRules);
+			if ($mergedRule->applyPermissions(Constants::PERMISSION_READ) === 0) {
+				$forbidden[] = $path;
+			}
+		}
+
+		return $forbidden;
+	}
 }

lib/ACL/RuleManager.php

@@ -280,16 +280,19 @@ public function getRulesForPrefix(IUser $user, int $storageId, string $prefix):
 		$query->select(['f.fileid', 'mapping_type', 'mapping_id', 'mask', 'a.permissions', 'f.path'])
 			->from('group_folders_acl', 'a')
 			->innerJoin('a', 'filecache', 'f', $query->expr()->eq('f.fileid', 'a.fileid'))
-			->where($query->expr()->orX(
-				$query->expr()->like('f.path', $query->createNamedParameter($this->connection->escapeLikeParameter($prefix) . '/%')),
-				$query->expr()->eq('f.path_hash', $query->createNamedParameter(md5($prefix)))
-			))
-			->andWhere($query->expr()->eq('f.storage', $query->createNamedParameter($storageId, IQueryBuilder::PARAM_INT)))
+			->where($query->expr()->eq('f.storage', $query->createNamedParameter($storageId, IQueryBuilder::PARAM_INT)))
 			->andWhere($query->expr()->orX(...array_map(fn (IUserMapping $userMapping): ICompositeExpression => $query->expr()->andX(
 				$query->expr()->eq('mapping_type', $query->createNamedParameter($userMapping->getType())),
 				$query->expr()->eq('mapping_id', $query->createNamedParameter($userMapping->getId()))
 			), $userMappings)));
 
+		if ($prefix !== '') {
+			$query = $query->andWhere($query->expr()->orX(
+				$query->expr()->like('f.path', $query->createNamedParameter($this->connection->escapeLikeParameter($prefix) . '/%')),
+				$query->expr()->eq('f.path_hash', $query->createNamedParameter(md5($prefix)))
+			));
+		}
+
 		$rows = $query->executeQuery()->fetchAll();
 
 		/** @var list<array{fileid: int|string, mapping_type: 'circle'|'group'|'user', mapping_id: string, mask: int|string, permissions: int|string, path: string}> $rows */