fix(security): add polkit auth check to getFileSize D-Bus method

[wangrong1069]

根因分析

LogViewerService::getFileSize D-Bus 方法以 root 权限运行，但缺少 polkit 认证检查，任意本地用户可通过系统总线获取任意 root 可读文件的精确大小信息，造成信息泄露。

关键证据：

• logViewerService/logviewerservice.cpp:802 — getFileSize 方法入口无 checkAuth(s_Action_View) 调用
• 同类 10 个公共 D-Bus 槽方法中，唯独 getFileSize 缺少认证检查
• 紧邻的 isFileExist（:790）和 getLineCount（:607）均正确执行了 checkAuth

修复方案

在 getFileSize 方法入口添加 checkAuth(s_Action_View) 认证检查，认证失败时返回 0，与同类方法 isFileExist、getLineCount 的模式一致。

改动安全评估

低风险。仅添加 early return 认证检查，不改变函数签名，不影响已授权调用者的行为。所有引用点为声明或 D-Bus 适配器转发层，无直接业务调用者会因修复而行为变化。

Summary by Sourcery

Bug Fixes:

• Guard the getFileSize D-Bus method with a polkit-based view authorization check, returning 0 when the caller is not authorized.

[sourcery-ai]

Sorry @wangrong1069, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Adds a missing polkit authorization check to the LogViewerService::getFileSize D-Bus method to align it with other privileged file-inspection methods and prevent unauthenticated users from querying root-readable file sizes.

Sequence diagram for polkit auth in LogViewerService_getFileSize

sequenceDiagram
    actor Client
    participant DBus
    participant LogViewerService
    participant Polkit

    Client->>DBus: getFileSize(filePath)
    DBus->>LogViewerService: getFileSize(filePath)
    LogViewerService->>LogViewerService: checkAuth(s_Action_View)
    alt [checkAuth passes]
        LogViewerService->>LogViewerService: QFileInfo(filePath)
        LogViewerService->>DBus: return fileSize
        DBus->>Client: fileSize
    else [checkAuth fails]
        LogViewerService->>DBus: return 0
        DBus->>Client: 0
    end

Loading

File-Level Changes

Change	Details	Files
Enforce polkit authorization for the privileged getFileSize D-Bus method and return 0 on authorization failure, matching existing patterns in neighboring methods.	Insert a checkAuth(s_Action_View) call at the start of getFileSize to gate access behind polkit authorization. Add an early return of 0 when authorization fails to avoid exposing file size information to unauthorized callers. Keep the existing QFileInfo-based size calculation and return path unchanged for authorized callers.	logViewerService/logviewerservice.cpp

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[wangrong1069]

/retest

[deepin-ci-robot]

@wangrong1069: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
github-pr-review-ci	037f326	link	true	/test github-pr-review-ci

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[lzwind]

/retest

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: lzwind, wangrong1069

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[deepin-ci-robot]

deepin pr auto review

★ 总体评分：100分

■ 【总体评价】

代码成功修复了未授权文件大小信息泄露的权限绕过漏洞
逻辑严密且无任何安全缺陷，满分通过

■ 【详细分析】

• 1.语法逻辑（完全正确）✓
  在LogViewerService::getFileSize函数入口处增加了if (!checkAuth(s_Action_View))拦截，语法无误，提前返回逻辑正确，未破坏原有QFileInfo判断分支。
  建议：无需修改。

• 2.代码质量（良好）✓
  修复代码精简，符合Qt和C++编码规范，与原有的qCDebug日志配合自然，未引入冗余代码。
  建议：无需修改。

• 3.代码性能（无性能问题）✓
  新增的checkAuth调用为轻量级权限校验，开销极小，不影响整体文件读取性能。
  建议：无需修改。

• 4.代码安全（存在0个安全漏洞）✓
  漏洞对比统计：新增漏洞 0 个，减少漏洞 0 个，持平 0 个
  本次提交通过增加checkAuth(s_Action_View)权限校验，有效阻断了未授权调用获取文件大小的攻击面，彻底修复了原有的权限绕过问题。
  建议：保持当前安全拦截逻辑，确保checkAuth内部实现严格校验调用者身份。

■ 【改进建议代码示例】

quint64 LogViewerService::getFileSize(const QString &filePath)
{
    qCDebug(logService) << "Getting file size for:" << filePath;
    
    // 增加权限校验，未授权时直接返回 0，防止信息泄露
    if (!checkAuth(s_Action_View)) {
        return 0;
    }

    QFileInfo fi(filePath);
    if (fi.exists())
        return static_cast<quint64>(fi.size());
        
    return 0;
}