checkFileAccess(): Argument #1 ($path) must be of type string, null given when copying in share with server side encryption

[max-nextcloud]

Steps to reproduce

1. Install nextcloud-docker-dev container with files_accesscontrol and encryption apps
2. Activate server side encryption
3. Create folder as admin and share with user
4. login as user
5. move Manual pdf into the shared folder
6. open shared folder
7. copy Manual to new subfolder
8. See error message in browser and nextcloud.log for COPY request

Expected behaviour

Copy as normal

Actual behaviour

I get "could not be copied" (my translation, see screenshot) If i reload the folder, the file is missing. If i copy the file again, i get "could not be copied, target exists." If i reload the folder the file is in fact there.

Server configuration

Fresh nextcloud-docker-dev with stable25 and stable28 codebase checked out.

List of activated apps:

Enabled:
  - cloud_federation_api: 1.11.0
  - collectives: 2.9.2
  - comments: 1.18.0
  - contacts: 5.5.0-rc.2
  - contactsinteraction: 1.9.0
  - dashboard: 7.8.0
  - dav: 1.29.1
  - encryption: 2.16.0
  - federatedfilesharing: 1.18.0
  - federation: 1.18.0
  - files: 2.0.0
  - files_accesscontrol: 1.18.0
  - files_reminders: 1.1.0
  - files_sharing: 1.20.0
  - files_trashbin: 1.18.0
  - files_versions: 1.21.0
  - lookup_server_connector: 1.16.0
  - oauth2: 1.16.3
  - provisioning_api: 1.18.0
  - settings: 1.10.0
  - sharebymail: 1.18.0
  - systemtags: 1.18.0
  - theming: 2.3.0
  - twofactor_backupcodes: 1.17.0
  - updatenotification: 1.18.0
  - user_oidc: 1.3.5
  - user_status: 1.8.1
  - weather_status: 1.8.0
  - workflowengine: 2.10.0
Disabled:
  - admin_audit: 1.18.0
  - files_external: 1.20.0
  - terms_of_service: 2.3.2-beta.4 (installed 2.3.2-beta.4)
  - testing: 1.18.0
  - user_ldap: 1.19.0

Nextcloud configuration:

{
    "system": {
        "debug": true,
        "profiler": true,
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/apps-extra",
                "url": "\/apps-extra",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/apps-shared",
                "url": "\/apps-shared",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/apps-writable",
                "url": "\/apps-writable",
                "writable": true
            }
        ],
        "allow_local_remote_servers": true,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "1025",
        "skeletondirectory": "\/skeleton",
        "setup_create_db_user": false,
        "loglevel": 2,
        "log_query": false,
        "query_log_file": "\/shared\/log\/querylog-nextcloud.log",
        "query_log_file_requestid": "yes",
        "diagnostics.logging": false,
        "diagnostics.logging.threshold": 0,
        "log.condition": {
            "apps": [
                "diagnostics",
                "admin_audit"
            ]
        },
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "nextcloud",
            "nextcloud.local",
            "192.168.28.6",
            "localhost"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "28.0.0.8",
        "overwrite.cli.url": "http:\/\/nextcloud.local",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "updater.release.channel": "git",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "lookup_server": "",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "memcache.local": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***"
    }
}

Are you using external storage, if yes which one: no

Are you using encryption: yes

Are you using an external user-backend, if yes which one: no

Client configuration

Browser: current firefox

Operating system: ubuntu 22.04

Logs

Nextcloud log (data/owncloud.log)

{
 "reqId": "0HgGenpSPLgh4raYI3s5",
 "level": 3,
 "time": "2023-12-07T11:44:32+00:00",
 "remoteAddr": "192.168.28.3",
 "user": "bob",
 "app": "webdav",
 "method": "COPY",
 "url": "/remote.php/dav/files/bob/share%20me/Nextcloud_Server_Administration_Manual.pdf",
 "message": "OCA\\FilesAccessControl\\StorageWrapper::checkFileAccess(): Argument #1 ($path) must be of type string, null given, called in /var/www/html/apps-writable/files_accesscontrol/lib/StorageWrapper.php on line 153",
 "userAgent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0",
 "version": "28.0.0.8",
 "exception": {
   "Exception": "TypeError",
   "Message": "OCA\\FilesAccessControl\\StorageWrapper::checkFileAccess(): Argument #1 ($path) must be of type string, null given, called in /var/www/html/apps-writable/files_accesscontrol/lib/StorageWrapper.php on line 153",
   "Code": 0,
   "Trace": [
     {
       "file": "/var/www/html/apps-writable/files_accesscontrol/lib/StorageWrapper.php",
       "line": 153,
       "function": "checkFileAccess",
       "class": "OCA\\FilesAccessControl\\StorageWrapper",
       "type": "->",
       "args": [
         null
       ]
     },
     {
       "file": "/var/www/html/apps/files_sharing/lib/Cache.php",
       "line": 161,
       "function": "getPermissions",
       "class": "OCA\\FilesAccessControl\\StorageWrapper",
       "type": "->",
       "args": [
         null
       ]
     },
     {
       "file": "/var/www/html/lib/private/Files/Cache/Wrapper/CacheWrapper.php",
       "line": 95,
       "function": "formatCacheEntry",
       "class": "OCA\\Files_Sharing\\Cache",
       "type": "->",
       "args": [
         [
           true,
           1,
           null
         ]
       ]
     },
     {
       "file": "/var/www/html/lib/private/Files/Cache/Wrapper/CacheJail.php",
       "line": 123,
       "function": "get",
       "class": "OC\\Files\\Cache\\Wrapper\\CacheWrapper",
       "type": "->",
       "args": [
         "files/share me/asdf/Nextcloud_Server_Administration_Manual.pdf"
       ]
     },
     {
       "file": "/var/www/html/apps/files_sharing/lib/Cache.php",
       "line": 126,
       "function": "get",
       "class": "OC\\Files\\Cache\\Wrapper\\CacheJail",
       "type": "->",
       "args": [
         "files/share me/asdf/Nextcloud_Server_Administration_Manual.pdf"
       ]
     },
     {
       "file": "/var/www/html/lib/private/Files/Cache/Wrapper/CacheWrapper.php",
       "line": 93,
       "function": "get",
       "class": "OCA\\Files_Sharing\\Cache",
       "type": "->",
       "args": [
         "*** sensitive parameters replaced ***"
       ]
     },
     {
       "file": "/var/www/html/lib/private/Files/Cache/Scanner.php",
       "line": 198,
       "function": "get",
       "class": "OC\\Files\\Cache\\Wrapper\\CacheWrapper",
       "type": "->",
       "args": [
         "*** sensitive parameters replaced ***"
       ]
     },
     {
       "file": "/var/www/html/apps/files_sharing/lib/Scanner.php",
       "line": 79,
       "function": "scanFile",
       "class": "OC\\Files\\Cache\\Scanner",
       "type": "->",
       "args": [
         "*** sensitive parameters replaced ***",
         3,
         171,
         null,
         false
       ]
     },
     {
       "file": "/var/www/html/lib/private/Files/Cache/Scanner.php",
       "line": 345,
       "function": "scanFile",
       "class": "OCA\\Files_Sharing\\Scanner",
       "type": "->",
       "args": [
         "*** sensitive parameters replaced ***",
         3,
         -1,
         null,
         false
       ]
     },
     {
       "file": "/var/www/html/lib/private/Files/Cache/Updater.php",
       "line": 130,
       "function": "scan",
       "class": "OC\\Files\\Cache\\Scanner",
       "type": "->",
       "args": [
         "*** sensitive parameters replaced ***",
         false,
         3,
         false
       ]
     },
     {
       "file": "/var/www/html/lib/private/Files/View.php",
       "line": 295,
       "function": "update",
       "class": "OC\\Files\\Cache\\Updater",
       "type": "->",
       "args": [
         "*** sensitive parameters replaced ***"
       ]
     },
     {
       "file": "/var/www/html/lib/private/Files/View.php",
       "line": 925,
       "function": "writeUpdate",
       "class": "OC\\Files\\View",
       "type": "->",
       "args": [
         [
           "OCA\\FilesAccessControl\\StorageWrapper",
           null,
           null,
           null,
           null,
           [
             "OC\\Files\\Cache\\Updater"
           ],
           "/bob/files/share me/"
         ],
         "*** sensitive parameters replaced ***"
       ]
     },
     {
       "file": "/var/www/html/apps/dav/lib/Connector/Sabre/Directory.php",
       "line": 485,
       "function": "copy",
       "class": "OC\\Files\\View",
       "type": "->",
       "args": [
         "/share me/Nextcloud_Server_Administration_Manual.pdf",
         "/share me/asdf/Nextcloud_Server_Administration_Manual.pdf"
       ]
     },
     {
       "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Tree.php",
       "line": 138,
       "function": "copyInto",
       "class": "OCA\\DAV\\Connector\\Sabre\\Directory",
       "type": "->",
       "args": [
         "Nextcloud_Server_Administration_Manual.pdf",
         "/share me/Nextcloud_Server_Administration_Manual.pdf",
         [
           "OCA\\DAV\\Connector\\Sabre\\File"
         ]
       ]
     },
     {
       "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/CorePlugin.php",
       "line": 659,
       "function": "copy",
       "class": "Sabre\\DAV\\Tree",
       "type": "->",
       "args": [
         "files/bob/share me/Nextcloud_Server_Administration_Manual.pdf",
         "files/bob/share me/asdf/Nextcloud_Server_Administration_Manual.pdf"
       ]
     },
     {
       "file": "/var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php",
       "line": 89,
       "function": "httpCopy",
       "class": "Sabre\\DAV\\CorePlugin",
       "type": "->",
       "args": [
         [
           "Sabre\\HTTP\\Request"
         ],
         [
           "Sabre\\HTTP\\Response"
         ]
       ]
     },
     {
       "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php",
       "line": 472,
       "function": "emit",
       "class": "Sabre\\DAV\\Server",
       "type": "->",
       "args": [
         "method:COPY",
         [
           [
             "Sabre\\HTTP\\Request"
           ],
           [
             "Sabre\\HTTP\\Response"
           ]
         ]
       ]
     },
     {
       "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php",
       "line": 253,
       "function": "invokeMethod",
       "class": "Sabre\\DAV\\Server",
       "type": "->",
       "args": [
         [
           "Sabre\\HTTP\\Request"
         ],
         [
           "Sabre\\HTTP\\Response"
         ]
       ]
     },
     {
       "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php",
       "line": 321,
       "function": "start",
       "class": "Sabre\\DAV\\Server",
       "type": "->",
       "args": []
     },
     {
       "file": "/var/www/html/apps/dav/lib/Server.php",
       "line": 370,
       "function": "exec",
       "class": "Sabre\\DAV\\Server",
       "type": "->",
       "args": []
     },
     {
       "file": "/var/www/html/apps/dav/appinfo/v2/remote.php",
       "line": 35,
       "function": "exec",
       "class": "OCA\\DAV\\Server",
       "type": "->",
       "args": []
     },
     {
       "file": "/var/www/html/remote.php",
       "line": 172,
       "args": [
         "/var/www/html/apps/dav/appinfo/v2/remote.php"
       ],
       "function": "require_once"
     }
   ],
   "File": "/var/www/html/apps-writable/files_accesscontrol/lib/StorageWrapper.php",
   "Line": 59,
   "message": "OCA\\FilesAccessControl\\StorageWrapper::checkFileAccess(): Argument #1 ($path) must be of type string, null given, called in /var/www/html/apps-writable/files_accesscontrol/lib/StorageWrapper.php on line 153",
   "exception": {
     "xdebug_message": "<tr>... (cut out for brevity) "
   },
   "CustomMessage": "OCA\\FilesAccessControl\\StorageWrapper::checkFileAccess(): Argument #1 ($path) must be of type string, null given, called in /var/www/html/apps-writable/files_accesscontrol/lib/StorageWrapper.php on line 153"
 }
}

Browser log

XHRCOPY
https://nextcloud.local/remote.php/dav/files/bob/share me/Nextcloud_Server_Administration_Manual.pdf
[HTTP/2 500  404ms]

	
COPY
	https://nextcloud.local/remote.php/dav/files/bob/share%20me/Nextcloud_Server_Administration_Manual.pdf
Status
500
VersionHTTP/2
Übertragen914 B (379 B Größe)
Referrer Policyno-referrer
DNS-AuflösungSystem

    	
    cache-control
    	no-store, no-cache, must-revalidate
    content-length
    	379
    content-security-policy
    	default-src 'none';
    content-type
    	application/xml; charset=utf-8
    date
    	Thu, 07 Dec 2023 12:05:54 GMT
    expires
    	Thu, 19 Nov 1981 08:52:00 GMT
    pragma
    	no-cache
    referrer-policy
    	no-referrer
    server
    	nginx
    x-content-type-options
    	nosniff
    X-Firefox-Spdy
    	h2
    x-frame-options
    	SAMEORIGIN
    x-permitted-cross-domain-policies
    	none
    x-powered-by
    	PHP/8.2.13
    x-robots-tag
    	noindex, nofollow
    x-xss-protection
    	1; mode=block
    	
    Accept
    	application/json, text/plain, */*
    Accept-Encoding
    	gzip, deflate, br
    Accept-Language
    	de,en-US;q=0.7,en;q=0.3
    Connection
    	keep-alive
    Cookie
    	__Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true; nc_sameSiteCookielax=true; nc_sameSiteCookiestrict=true; ocnjm01q296s=3ce07cd2e8c0bb46f342b9ccf964be04; oc_sessionPassphrase=2iSkoSqdYbdE9SjSyfgs7rf5HYzjlI5U4vxp3ld0w0OXCLhg%2BrMber2vHO3URC3fd%2FzBgHf5tmB%2BxvK2G6bDj9wgG8X0NHA%2BZPpJqAmee5vfR3m78uM2RJeg7YZBBvLN; nc_username=bob; nc_token=pvFJ9ZoIa0Rw8mWtqQ6z7mhRrme3pmWz; nc_session_id=3ce07cd2e8c0bb46f342b9ccf964be04
    Destination
    	https://nextcloud.local/remote.php/dav/files/bob/share%20me/asdfqwre/Nextcloud_Server_Administration_Manual.pdf
    Host
    	nextcloud.local
    Origin
    	https://nextcloud.local
    Overwrite
    	F
    requesttoken
    	sMncEdmVYP1/0kcPncJa0oRuuOjcgmYP4DyjEEIg1hw=:/oOZf7TFKYcK5AZq1oYvlOUa27Cs8wg8sFTxQDto5lg=
    Sec-Fetch-Dest
    	empty
    Sec-Fetch-Mode
    	cors
    Sec-Fetch-Site
    	same-origin
    TE
    	trailers
    User-Agent
    	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0
    X-Requested-With
    	XMLHttpRequest

[max-nextcloud]

This part of the trace seems most interesting:

{
  "file": "/var/www/html/lib/private/Files/Cache/Wrapper/CacheWrapper.php",
  "line": 95,
  "function": "formatCacheEntry",
  "class": "OCA\\Files_Sharing\\Cache",
  "type": "->",
  "args": [
    [
      true,
      1,
      null
    ]
  ]
}

https://github.com/nextcloud/server/blob/0697900bf254a2c9073806657843bbd3bd117771/lib/private/Files/Cache/Wrapper/CacheWrapper.php#L92-L98 is the code in question:

	public function get($file) {
		$result = $this->getCache()->get($file);
		if ($result) {
			$result = $this->formatCacheEntry($result);
		}
		return $result;
	}

The argument to formatCacheEntry does not look like a cache entry to me on first sight.

[come-nc]

$result is from ICache::get which should return ICacheEntry|false

[nickvergessen]

So this is a normal copy?
Then we should try to add an integration test for that and see if that fails here

[max-nextcloud]

So this is a normal copy? Then we should try to add an integration test for that and see if that fails here

It's a normal copy inside a shared folder with server side encryption turned on.
I'm not sure if we can test that in an integration test.

[max-nextcloud]

$result is from ICache::get which should return ICacheEntry|false

This is what $result looks like:

Seems to be some encrypted cache entry. I have set a breakpoint in that function and observed this result several times when it did not trigger any exception.

[come-nc]

Findings from a test session:

• ICache::get sometimes return an array instead of ICacheEntry for partial entries, not sure if wrapping this partial entry in a CacheEntry object should happen or not.
• OC\Files\Storage\Wrapper\Encryption::copyBetweenStorage calls its own method updateEncryptedVersion on line 850, expecting to update an existing filecache entry, but actually the fopen call do not insert any cache entry, so this method inserts a partial entry.
• OCA\Files_Sharing\Cache::formatCacheEntry uses $entry['path'] as a string without checking if it’s null. It’s assigning it to the result of a call to getJailedPath I think, and maybe it does not expect that to be null?

@icewind1991 Removing the call to updateEncryptedVersion seems to fix copy, but it might break other usecase, I do not understand enough to say. Comments in OC\Files\Storage\Wrapper\Encryption::copyBetweenStorage seem to suggest that is was expected of the call to fopen to insert a line in filecache, is it something that happened before and was changed since?

This issue have been reproduced on 25 as well so it’s not a recent problem.

[icewind1991]

Adding a check to updateEncryptedVersion to only update if the cache entry is "real" seems like the easiest fix to me