From 7f9b827e8a8859322732273eb96d076e84a3e65a Mon Sep 17 00:00:00 2001 From: Levi Neely Date: Fri, 1 May 2026 11:33:35 +0200 Subject: [PATCH] Address build review feedback and fix security/bug issues - Fix passascrypto logic and type (now a flag) in main.cpp - Fix typo in daemon process name - Add secret wiping (putil_wipe) for tfa_code and singleton passwords - Remove redundant App setup in control_tools.cpp - Use CLI11 envname for PCLOUD_USER - Fix C++11 compatibility for putil_wipe and App initialization in control_tools.cpp --- control_tools.cpp | 13 +++++++------ main.cpp | 30 ++++++++++++++++-------------- 2 files changed, 23 insertions(+), 20 deletions(-) diff --git a/control_tools.cpp b/control_tools.cpp index f573b7d..7a8aec0 100644 --- a/control_tools.cpp +++ b/control_tools.cpp @@ -198,7 +198,9 @@ void setup_app(CLI::App *app) { size_t errm_size = 0; RpcClient *rpc = new RpcClient(); int result = rpc->Call(SENDAUTH, auth_pass_input.c_str(), &errm, &errm_size); - putil_wipe(auth_pass_input.data(), auth_pass_input.size()); + if (!auth_pass_input.empty()) { + putil_wipe(&auth_pass_input[0], auth_pass_input.size()); + } auth_pass_input.clear(); if (result != 0) { std::cerr << "Failed to send auth: " << (errm ? errm : "no message") << std::endl; @@ -221,7 +223,9 @@ void setup_app(CLI::App *app) { size_t errm_size = 0; RpcClient *rpc = new RpcClient(); int result = rpc->Call(SENDAUTHSAVE, authsave_pass_input.c_str(), &errm, &errm_size); - putil_wipe(authsave_pass_input.data(), authsave_pass_input.size()); + if (!authsave_pass_input.empty()) { + putil_wipe(&authsave_pass_input[0], authsave_pass_input.size()); + } authsave_pass_input.clear(); if (result != 0) { std::cerr << "Failed to send auth: " << (errm ? errm : "no message") << std::endl; @@ -440,7 +444,7 @@ void setup_app(CLI::App *app) { } int process_command(const std::string &command) { - CLI::App app = CLI::App{"pcloudcc-lneely"}; + CLI::App app{"pcloudcc-lneely"}; setup_app(&app); try { app.parse(command); @@ -480,9 +484,6 @@ int process_command(const std::string &command) { } void process_commands() { - CLI::App app = CLI::App{"pcloudcc-lneely"}; - setup_app(&app); - using_history(); rl_attempted_completion_function = command_completion; diff --git a/main.cpp b/main.cpp index 63f3119..659c8fc 100644 --- a/main.cpp +++ b/main.cpp @@ -39,6 +39,7 @@ #include "pclsync_lib.h" #include "pclsync/psettings.h" #include "pclsync/psignal.h" +#include "pclsync/putil.h" namespace ct = control_tools; namespace cc = console_client; @@ -53,7 +54,6 @@ int main(int argc, char **argv) { std::cout << "pCloud console client (" << version << ")" << std::endl; std::string username = ""; - std::string password = ""; std::string tfa_code = ""; bool daemon = false; bool commands = false; @@ -62,8 +62,8 @@ int main(int argc, char **argv) { bool passwordsw = false; bool save_pass = false; bool crypto = false; + bool passascrypto_sw = false; bool trusted_device = false; - std::string passascrypto = ""; std::string mountpoint = ""; uint64_t cache_size_gb = 0; std::string log_path = ""; @@ -74,12 +74,13 @@ int main(int argc, char **argv) { CLI::App app{"Allowed options"}; app.set_help_flag("-h,--help", "Show this help message."); - app.add_option("-u,--username", username, "pCloud account name."); + app.add_option("-u,--username", username, "pCloud account name.") + ->envname("PCLOUD_USER"); app.add_flag("-p,--password", passwordsw, "Ask for pCloud account password."); app.add_option("-t,--tfa_code", tfa_code, "pCloud tfa code"); app.add_flag("-r,--trusted_device", trusted_device, "Trust this device."); app.add_flag("-c,--crypto", crypto, "Ask for crypto password."); - app.add_option("-y,--passascrypto", passascrypto, "User password is the same as crypto password."); + app.add_flag("-y,--passascrypto", passascrypto_sw, "User password is the same as crypto password."); app.add_flag("-d,--daemonize", daemon, "Run the process as a background daemon."); app.add_flag("-o,--commands", commands, "Keep parent process alive and process commands."); app.add_option("-m,--mountpoint", mountpoint, "Specify where pCloud filesystem is mounted."); @@ -110,13 +111,6 @@ int main(int argc, char **argv) { } } - // Environment variable fallbacks - if (app.count("--username") == 0 && app.count("-u") == 0) { - const char *env_user = std::getenv("PCLOUD_USER"); - if (env_user && env_user[0]) - username = env_user; - } - if (username.empty()) { std::cout << "Username option is required, specify with " << "-u or --username, or set PCLOUD_USER." << std::endl; @@ -127,7 +121,7 @@ int main(int argc, char **argv) { memset(argv[i], 0, strlen(argv[i])); } if (daemon) { - strncpy(argv[0], "pCloudDriveDeamon", strlen(argv[0])); + strncpy(argv[0], "pCloudDriveDaemon", strlen(argv[0])); } else { strncpy(argv[0], "pCloudDrive", strlen(argv[0])); } @@ -145,8 +139,8 @@ int main(int argc, char **argv) { cc::clibrary::pclsync_lib::get_lib().set_trusted_device(trusted_device); if (crypto) { cc::clibrary::pclsync_lib::get_lib().setup_crypto_ = true; - if (app.count("--passascrypto") > 0 || app.count("-y") > 0) { - cc::clibrary::pclsync_lib::get_lib().set_crypto_pass(password); + if (passascrypto_sw) { + cc::clibrary::pclsync_lib::get_lib().set_crypto_pass(cc::clibrary::pclsync_lib::get_lib().get_password()); } else { const char *env_crypto = std::getenv("PCLOUD_CRYPTO_PASSWORD"); if (env_crypto && env_crypto[0]) { @@ -229,5 +223,13 @@ int main(int argc, char **argv) { } } + if (!tfa_code.empty()) { + putil_wipe(&tfa_code[0], tfa_code.size()); + } + + cc::clibrary::pclsync_lib::get_lib().wipe_password(); + cc::clibrary::pclsync_lib::get_lib().wipe_crypto_pass(); + cc::clibrary::pclsync_lib::get_lib().wipe_tfa_code(); + return 0; }