Sanitize binary bits. Binary for Post-Quantum decryption

So i am on the way to release a nice plugin, but there is a problem, that’s in reality not a problem due to how filenames are managed server side, anyway, do you know another way to workaround this?

There is NO way to pass the correct content if it is passed using the common WP ways.

I installed the validator plugin to check, but really this cannot be solved in different way, and as said it is anyway absolutely safe, so to you it will be ok?

PS it is anyway OK also because all the encryption and decryption processes happen into the Browser.

The server never see real data and anyone that could download the file, will not do too much with, without owning the ML-KEM 1024 Private key

public function get_encrypted_content( $request ) {
    $filename = sanitize_file_name($request->get_param('file'));
    $token    = sanitize_text_field($request->get_param('key'));
    $saved_token = get_option( 'w3token_' . $filename );

    if ( $saved_token && $saved_token === $token ) {
        $upload_dir = wp_upload_dir();
        $file_path  = $upload_dir['basedir'] . '/w3mypgp_vault/' . $filename;

// Could be used js fetch on frontend but why? It is not reliable      
// return new WP_REST_Response( array( 'success' => true, 'message' => $filename ), 200 );

    if ( file_exists($file_path) ) {


            header('Content-Type: application/octet-stream');
            header('Content-Length: ' . filesize($file_path));

            if (ob_get_level()) ob_end_clean();


/*  // THIS DO NOT WILL WORK

require_once ABSPATH . 'wp-admin/includes/file.php';

  if ( WP_Filesystem() && file_exists($file_path) ) {
    global $wp_filesystem;

            header('Content-Type: application/octet-stream');
            header('Content-Length: ' . filesize($file_path));

            if (ob_get_level()) ob_end_clean();

    // NOTE: wp_kses_post corrupt bits and make it fail the decryption
    // wp_kses_post cannot be used

    // $content = $wp_filesystem->get_contents( $file_path );
    // echo wp_kses_post( $content ); # fail
    // echo $content; # Ok. but maybe not safe

  }*/

  /* This way works and it's safe. The file path is the one stored and cannot be otherwise

     Input Validation: Since we used sanitize_file_name, a hacker cannot request ../../wp-config.php. They can only request files inside our vault.
     Token Check: the code already checks if the $token matches. Only someone with the correct link can trigger the stream.

     Conclusion: Don't try to sanitize the binary bits. The output is a binary ciphertext for Post-Quantum decryption (ML-KEM); sanitizing the output would corrupt the cryptographic integrity.
  */

    $fp = fopen($file_path, 'rb');
    fpassthru($fp);
    fclose($fp);

    // readfile also works
    // Dump the file bits to the network stream
   //  readfile($file_path);

    // SELF-DESTRUCT
    // unlink($file_path);
    // delete_option('w3token_' . $filename);

   // STOP HERE. Do not let WordPress send out any more data.
    exit;
  }

    // Only if the file/token is wrong return a standard error
    return new WP_Error('fail', 'Invalid link.', array('status' => 404));
}
}

• This topic was modified 1 month ago by axew3.
• This topic was modified 1 month ago by axew3.