Community-edition: Services don't get deleted properly (security issue)

[ghost]

Steps to reproduce

1. Create a service
2. Delete service from configuration
3. (for windows) look in %APPDATA%RamboxPartitions for service

Expected behavior

If a service is deleted, it should be deleted for good.

Actual behavior

The deleted service does not become deleted on disk.
If you delete a service and re-create the same service, you could instantly access it because e.g. cookies aren't deleted (worked with tweetdeck for example).
This is a potential security issue!

ENVIRONMENT

• Rambox: v0.5.3
• OS: Windows 10 Pro Version 1607 Build 14393.576
• Arch: x64

[timorunge]

You've the same behaviour on macOS Sierra 10.12.4 (16E195) under "~/Library/Application Support/Rambox/Partitions".

• Version: 0.5.3
• Platform: darwin (x64)
• Electron: 1.4.15
• Chromium: 53.0.2785.143
• Node: 6.5.0

[ghost]

@timorunge thx!

Oh, by the way, "clear local storage" won't delete those either.

[saenzramiro]

I will take a look on this, it's an important issue. Thanks guys.

[saenzramiro]

Seems like Electron doesn't have the ability to remove that folder, instead you can clear all the data inside it like cache, local storage, history, etc.

We can improve the folder deletion in a future release.

[ghost]

Is there a way to know which folder belongs to which (configured) service? For example, I have a bunch of custom_* services, but I don't know which one is the correct one. Also, I have two gmail_* folders, but only one configured in Rambox itself.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[MurzNN]

Problem is still here!

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale[bot]]

This issue has been automatically closed since there has not been any recent activity. Please open a new issue for related bugs.

[MurzNN]

It is not fixed! Please reopen!

[hussong]

Can confirm that the issue persists from another angle.

Did a little cleanup before migrating to a new machine and noticed 2 GB worth of data stored in .config/Rambox/Partitions.

Going via

• Help > Tools > Clear Cache
• Help > Tools > Clear Local Storage

as suggested in https://github.com/ramboxapp/community-edition/issues/982

leaves me with all previously set up services gone and still 2 GB of data sitting around in .config/Rambox/Partitions :-(

Using
Version: 0.6.3
Platform: linux (x64)
Electron: 2.0.14
Chromium: 61.0.3163.100
Node: 8.9.3

[Corchoneitor]

Hi.

I was working on this issue but it seems out of my reach. I keep getting "Resource busy or locked" when I try to remove the just-removed service's partition folder. Looks like Rambox process is still "using" those files after removing the service.
Also tryed to update electron to v5 to see if they made any improvements with "clear" methods of session. Several errors occurred in Rambox, so I withdrawed that. If someone wants to follow this aproach, be my guest.

I created "delete-partition-folder" branch. See e7046484a0dc0e1bd63d0b2fa1c33919725aeb14 where I added the fse.remove() method (which should delete directories and files recursively).

If anyone has any idea on how to fix this, we'll apreciate it. Feel free to commit to this branch and/or make a PR.

Bye.

[maxerbox]

Remind me to check it, I will if I have the time.
I had planned a while ago to add encryption on those partitions, and implement partition deletion,.

[miky2k]

Ok we are still waiting....