refactor: secure password transmission by QDBusUnixFileDescriptor

src/dfm-mount/private/dnetworkmounter.cpp

@@ -6,16 +6,19 @@
 
 #include "dnetworkmounter.h"
 
 #include <QDBusInterface>
 #include <QDBusConnection>
 #include <QDBusConnectionInterface>
+#include <QDBusUnixFileDescriptor>
 #include <QUrl>
 #include <QDebug>
 #include <QTimer>
 #include <QtConcurrent>
 
 #include <libmount.h>
 
+#include <unistd.h>
+
 DFM_MOUNT_USE_NS
 
 #if QT_VERSION >= QT_VERSION_CHECK(6, 0, 0)
@@ -167,9 +170,13 @@
         if (err)
             qDebug() << "query password failed: " << passwd << err->message;
         else {
+#if QT_VERSION < QT_VERSION_CHECK(6, 0, 0)
             // since daemon accept base64-ed passwd to mount cifs, cleartext should be encoded with base64
             // see commit of dde-file-manager: 3b50664d4034754b15c1a516cfaab8c7fbdd3db9
             passwd.insert(kLoginPasswd, QString(QByteArray(pwd).toBase64()));
+#else
+            passwd.insert(kLoginPasswd, QString(pwd));
+#endif
         }
     }
     return passwds;
@@ -537,12 +544,56 @@
     delete finalize;
 }
 
+static QVariant preparePasswd(const QString &passwd)
+{
+    if (passwd.isEmpty()) {
+        qDebug() << "Created empty QVariant for empty passwd";
+        return QVariant("");
+    }
+
+    // Prepare passwd
+    const QByteArray passwdBytes = passwd.toLocal8Bit();
+
+    // Create pipe
+    int pipefds[2];
+    if (pipe(pipefds) == -1) {
+        qCritical() << "Failed to create pipe:" << strerror(errno);
+        return QVariant("");
+    }
+
+    // pipefds[0] is for reading
+    // pipefds[1] is for writing
+    int read_fd = pipefds[0];
+    int write_fd = pipefds[1];
+
+    // Write passwd to pipe
+    qint64 bytesWritten = write(write_fd, passwdBytes.constData(), passwdBytes.size());
+    close(write_fd);
+    if (bytesWritten != passwdBytes.size()) {
+        qCritical() << "Failed to write passwd to pipe.";
+        close(read_fd);
+        return QVariant("");
+    }
+
+    // Create file descriptor wrapper
+    QDBusUnixFileDescriptor dbusFd(read_fd);
+    // read_fd has been copied to QDBusUnixFileDescriptor
+    close(read_fd);
+
+    qDebug() << "Successfully created fd for passwd transmission";
+    return QVariant::fromValue(dbusFd);
+}
+
 DNetworkMounter::MountRet DNetworkMounter::mountWithUserInput(const QString &address,
                                                               const MountPassInfo info)
 {
     QVariantMap param { { kLoginUser, info.userName },
                         { kLoginDomain, info.domain },
+#if QT_VERSION < QT_VERSION_CHECK(6, 0, 0)
                         { kLoginPasswd, info.passwd },
+#else
+                        { kLoginPasswd, preparePasswd(info.passwd) },
+#endif
                         { kLoginTimeout, info.timeout },
                         { kMountFsType, "cifs" } };
 
@@ -562,11 +613,15 @@
         err = DeviceError::kNoError;
 
         if (!info.anonymous && info.savePasswd != NetworkMountPasswdSaveMode::kNeverSavePasswd) {
+#if QT_VERSION < QT_VERSION_CHECK(6, 0, 0)
             // since passwd from user input is base64-ed data, so the passwd should be decoded into cleartext for saving.
             // associated commit of dde-file-manager: 3b50664d4034754b15c1a516cfaab8c7fbdd3db9
             auto _info = info;
             _info.passwd = QByteArray::fromBase64(info.passwd.toLocal8Bit());
             savePasswd(address, _info);
+#else
+            savePasswd(address, info);
+#endif
         }
     }
 
@@ -583,7 +638,11 @@
     for (const auto &login : infos) {
         QVariantMap param { { kLoginUser, login.value(kSchemaUser, "") },
                             { kLoginDomain, login.value(kSchemaDomain, "") },
+#if QT_VERSION < QT_VERSION_CHECK(6, 0, 0)
                             { kLoginPasswd, login.value(kLoginPasswd, "") },
+#else
+                            { kLoginPasswd, preparePasswd(login.value(kLoginPasswd, "").toString()) },
+#endif
                             { kLoginTimeout, secs },
                             { kMountFsType, "cifs" } };