'One-time downloads' not guaranteed

[dillonstreator]

One-time downloads is not guaranteed. There is a race condition in the Redis database implementation.

yopass/pkg/server/redis.go

Lines 28 to 46 in dcef755

	func (r *Redis) Get(key string) (yopass.Secret, error) {
	var s yopass.Secret
	v, err := r.client.Get(key).Result()
	if err != nil {
	return s, err
	}
	if err := json.Unmarshal([]byte(v), &s); err != nil {
	return s, err
	}
	if s.OneTime {
	_, err := r.Delete(key)
	if err != nil {
	return s, err
	}
	}
	return s, nil
	}

There is no lock between the get and delete operation which means that multiple clients can retrieve the secret value. Additionally, the clients don't even need to know the password/key for retrieval and could brute force or just 'harvest now decrypt later' the secret (this is not trivial to solve but could store a hash of the decryption key on the server which puts the 'zero-knowledge' into a bit more of a gray-area). This is a bit more concerning if there is no rate limiting applied #8 due to brute forcing the id.