v0.6.1: Harden remote clipboard file transfers

Remote clipboard file downloads now validate every server response against both the requested chunk size and the remaining advertised file size before writing data to disk. Oversized or inconsistent responses abort the transfer instead of being accepted.

Regression tests cover oversized responses as well as valid full-size and final short chunks. The application version and README badge are updated to 0.6.1.

Author: patrickdobler

Cargo.lock

@@ -7,7 +7,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.6.0"
+version = "0.6.1"
 edition = "2021"
 rust-version = "1.89"
 license = "AGPL-3.0-only"

Cargo.toml

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img alt="Version 0.6.0" src="https://img.shields.io/badge/version-0.6.0-2f81f7">
+  <img alt="Version 0.6.1" src="https://img.shields.io/badge/version-0.6.1-2f81f7">
   <a href="LICENSE"><img alt="GNU AGPL v3.0" src="https://img.shields.io/badge/license-AGPLv3-3da639"></a>
   <img alt="macOS 11 or newer" src="https://img.shields.io/badge/macOS-11%2B-black">
   <img alt="Rust 1.89 or newer" src="https://img.shields.io/badge/Rust-1.89%2B-b7410e">

README.md

@@ -248,8 +248,30 @@ struct RemoteClipboard {
     data_id: Option<u32>,
     jobs: std::collections::VecDeque<FetchJob>,
     next_stream_id: u32,
-    /// Outstanding request: (stream id, was a SIZE request).
-    outstanding: Option<(u32, bool)>,
+    /// Outstanding request: (stream id, was a SIZE request, requested bytes).
+    outstanding: Option<(u32, bool, u32)>,
+}
+
+/// Reject a server response that exceeds either the requested range or the
+/// remaining size advertised for the remote file.
+fn validate_remote_file_range(
+    requested_size: u32,
+    remaining_size: u64,
+    response_len: usize,
+) -> Result<(), String> {
+    let response_len = u64::try_from(response_len)
+        .map_err(|_| "remote file response length does not fit in u64".to_string())?;
+    if response_len > u64::from(requested_size) {
+        return Err(format!(
+            "remote returned {response_len} bytes for a {requested_size}-byte request"
+        ));
+    }
+    if response_len > remaining_size {
+        return Err(format!(
+            "remote returned {response_len} bytes with only {remaining_size} bytes remaining"
+        ));
+    }
+    Ok(())
 }
 
 /// Plan the entries for one pasted top-level item. Wire names containing
@@ -346,7 +368,7 @@ async fn advance_remote_fetch(
                 requested_size: requested,
                 data_id,
             };
-            remote.outstanding = Some((stream_id, was_size));
+            remote.outstanding = Some((stream_id, was_size, requested));
             return send_cliprdr(active_stage, out_tx, |c| c.request_file_contents(request)).await;
         }
 
@@ -404,7 +426,7 @@ async fn handle_remote_file_contents(
 ) -> Result<()> {
     use std::io::Write as _;
 
-    let Some((expected_id, was_size)) = remote.outstanding else {
+    let Some((expected_id, was_size, requested_size)) = remote.outstanding else {
         return Ok(()); // stale response after a failed/cancelled job
     };
     if stream_id != expected_id {
@@ -430,6 +452,11 @@ async fn handle_remote_file_contents(
             if bytes.is_empty() {
                 return Err("transfer ended early".to_string());
             }
+            validate_remote_file_range(
+                requested_size,
+                current.size.saturating_sub(current.offset),
+                bytes.len(),
+            )?;
             current
                 .file
                 .write_all(&bytes)
@@ -2275,7 +2302,8 @@ fn normalize_clipboard_to_crlf(text: &str) -> String {
 mod tests {
     use super::{
         build_config, mdns_fallback_hostname, normalize_clipboard_to_crlf, resolve_pending_command,
-        update_keys_down, InputEvent, PendingCommands, SessionCommand, SessionConfig,
+        update_keys_down, validate_remote_file_range, InputEvent, PendingCommands, SessionCommand,
+        SessionConfig,
     };
     use crate::profile::{AudioMode, AuthenticationMode, ClipboardMode, GraphicsMode};
     use ironrdp::pdu::rdp::client_info::CompressionType;
@@ -2319,6 +2347,18 @@ mod tests {
         );
     }
 
+    #[test]
+    fn remote_file_range_rejects_more_data_than_requested_or_remaining() {
+        assert!(validate_remote_file_range(1_048_576, 2_000_000, 1_048_577).is_err());
+        assert!(validate_remote_file_range(1_048_576, 12, 13).is_err());
+    }
+
+    #[test]
+    fn remote_file_range_accepts_full_and_short_final_chunks() {
+        assert!(validate_remote_file_range(1_048_576, 2_000_000, 1_048_576).is_ok());
+        assert!(validate_remote_file_range(1_048_576, 12, 12).is_ok());
+    }
+
     #[test]
     fn single_label_hosts_get_an_mdns_fallback() {
         assert_eq!(