Acknowledge malware/spam warnings from GCD #447
Conversation
If Google thinks that a file is malware or spam (which can happen spuriously to blobs of encrypted data), it will prevent the initial download and return an error with reason "cannotDownloadAbusiveFile". The API expects a program to prompt the user in this case and then, optionally, let them bypass it. Ideally duplicacy should prompt, but this patch just logs a warning. When I printed `err.(*googleapi.Error)`, its `Errors` field was empty, hence the sketchy string matching. It's possible that I did something wrong, though.
|
This should be a command line switch in my opinion to leave it to the user whether they want to download potentially dangerous content. |
|
Do you still keep the chunk that caused the error? If so do you mind sharing the file with me so I can reproduce the error myself? |
|
@gilbertchen Sure thing. I made it public under the assumption that the chunk is encrypted and doesn't leak any information on its own, but let me know if that's not the case and I'll lock it down: https://drive.google.com/file/d/1BAn6XfBFWTjmH5Vjn7OgW25pOo-GKuzZ/view |
|
@s4y , I tried to download the file out of curiosity, but ...
Have you tried uploading the file to www.virustotal.com to see what the various antivirus programs say? |
|
I was able to download the file by creating a copy in Google Drive and then downloading the copy. virustotal.com results: https://www.virustotal.com/#/file/a99631f46c2e2458cc0b6c309dcc8bac64ada55422e676f172b78d49ee5e8b91/detection |
|
And, just to make sure, the file does look like the expected Duplicacy encrypted noise, right? |
|
@s4y yes, that chunk file is encrypted by a randomly generated key stored in your |
|
Thank you for the fix. The string matching is fine as it looks like the Google Drive library code doesn't unmarshal the body before returning the error. |
If Google thinks that a file is malware or spam (which can happen
spuriously to blobs of encrypted data), it will prevent the initial
download and return an error with reason "cannotDownloadAbusiveFile".
The API expects a program to prompt the user in this case and then,
optionally, let them bypass it.
Ideally duplicacy should prompt, but this patch just logs a warning.
When I printed
err.(*googleapi.Error), itsErrorsfield was empty,hence the sketchy string matching. It's possible that I did something
wrong, though.
Fixes issue #443.