Merge pull request #62806 from nextcloud/sftp-key-remove-password

fix: clear key password after loading key

Author: susnux

apps/files_external/lib/Lib/Auth/PublicKey/RSA.php

@@ -14,6 +14,7 @@
 use OCP\IConfig;
 use OCP\IL10N;
 use OCP\IUser;
+use phpseclib3\Crypt\PublicKeyLoader;
 use phpseclib3\Crypt\RSA as RSACrypt;
 
 /**
@@ -46,15 +47,19 @@ public function __construct(
 	#[\Override]
 	public function manipulateStorageConfig(StorageConfig &$storage, ?IUser $user = null) {
 		try {
-			$auth = RSACrypt::loadPrivateKey(
+			$auth = PublicKeyLoader::load(
 				$storage->getBackendOption('private_key'),
 				$this->config->getSystemValue('secret', '')
 			);
 		} catch (\Throwable) {
 			// Add fallback routine for a time where secret was not enforced to be exists
-			$auth = RSACrypt::loadPrivateKey($storage->getBackendOption('private_key'));
+			$auth = PublicKeyLoader::load($storage->getBackendOption('private_key'));
 		}
 
+		if (!$auth instanceof RSACrypt\PrivateKey) {
+			throw new \RuntimeException('Loaded key is not a private key');
+		}
+		$auth = $auth->withPassword('');
 		$storage->setBackendOption('public_key_auth', $auth);
 	}
 

apps/files_external/lib/Lib/Auth/PublicKey/RSAPrivateKey.php

@@ -13,6 +13,7 @@
 use OCP\IConfig;
 use OCP\IL10N;
 use OCP\IUser;
+use phpseclib3\Crypt\PublicKeyLoader;
 use phpseclib3\Crypt\RSA;
 use phpseclib3\Exception\NoKeyLoadedException;
 
@@ -46,17 +47,23 @@ public function __construct(
 	public function manipulateStorageConfig(StorageConfig &$storage, ?IUser $user = null) {
 
 		try {
-			$auth = RSA\PrivateKey::loadPrivateKey(
+			$auth = PublicKeyLoader::load(
 				$storage->getBackendOption('private_key'),
 				$this->config->getSystemValue('secret', ''),
 			);
 		} catch (NoKeyLoadedException) {
 			// Add fallback routine for a time where secret was not enforced to be exists
-			$auth = RSA\PrivateKey::loadPrivateKey(
+			$auth = PublicKeyLoader::load(
 				$storage->getBackendOption('private_key'),
 				'',
 			);
 		}
+
+		if (!$auth instanceof RSA\PrivateKey) {
+			throw new \RuntimeException('Loaded key is not a private key');
+		}
+
+		$auth = $auth->withPassword('');
 		$storage->setBackendOption('public_key_auth', $auth);
 	}
 }