From 6d09a83adca18a4df1eb9b79e6699a15bfacd4f4 Mon Sep 17 00:00:00 2001 From: Dominik Schmidt Date: Mon, 7 Sep 2026 00:52:35 +0200 Subject: [PATCH] fix(graph): keep owner data out of public link responses The owner's favorite flag travelled as @libre.graph.meFollowing, the share root exposed its out-of-share parent id, and $select=@libre.graph.shareTypes disclosed collaborative grants; found by review. --- services/graph/pkg/service/v0/driveitems.go | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/services/graph/pkg/service/v0/driveitems.go b/services/graph/pkg/service/v0/driveitems.go index 2a140e55fa..fdf74964f9 100644 --- a/services/graph/pkg/service/v0/driveitems.go +++ b/services/graph/pkg/service/v0/driveitems.go @@ -87,8 +87,15 @@ func (g Graph) sanitizePublicDriveInfos(ctx context.Context, r *http.Request, in return err } for _, info := range infos { - if info != nil { - publicshare.FilterResourceInfo(info, shareRoot, grant) + if info == nil { + continue + } + publicshare.FilterResourceInfo(info, shareRoot, grant) + // the favorite flag is the owner's, not the visitor's + delete(info.GetArbitraryMetadata().GetMetadata(), _favoriteMetadataKey) + // the share root's parent lies outside the share + if utils.ResourceIDEqual(info.GetId(), shareRoot.GetId()) { + info.ParentId = nil } } return nil @@ -413,7 +420,7 @@ func (g Graph) GetDriveItem(w http.ResponseWriter, r *http.Request) { driveItem.Children = children } - if driveItemPropertySelected(r, _selectShareTypes) { + if driveItemPropertySelected(r, _selectShareTypes) && !publicDriveRequest(r) { infos := []*storageprovider.ResourceInfo{res.GetInfo()} driveItem.LibreGraphShareTypes = shareTypesOf(res.GetInfo(), g.listLinkShares(ctx, infos)) } @@ -473,7 +480,7 @@ func (g Graph) listDriveItemChildren(w http.ResponseWriter, r *http.Request, dri childrenRequest := &storageprovider.ListContainerRequest{ Ref: &storageprovider.Reference{ResourceId: driveItemID}, } - if driveItemPropertySelected(r, _selectShareTypes) { + if driveItemPropertySelected(r, _selectShareTypes) && !publicDriveRequest(r) { childrenRequest.FieldMask = shareTypesFieldMask } @@ -511,7 +518,8 @@ func (g Graph) listDriveItemChildren(w http.ResponseWriter, r *http.Request, dri return nil, false } - if driveItemPropertySelected(r, _selectShareTypes) { + // collaborative grants are not for public link visitors + if driveItemPropertySelected(r, _selectShareTypes) && !publicDriveRequest(r) { g.addShareTypes(r.Context(), files, res.GetInfos()) }