bisync/dropbox: fail closed on listing collapse and cursor races

Refuse --delta-list without --check-access. Abort if a listing goes empty
or shrinks past --max-delete versus the prior snapshot (full relist and
local walk included). Persist cursor before listing so a crash cannot
pair a new listing with a stale cursor. Reconstruct delta remotes from
path_lower plus leaf casing; ListR probes a non-recursive list when the
recursive result is empty.

cmd/bisync/delta_list.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"path"
 	"path/filepath"
 	"strings"
 	"time"
@@ -17,6 +18,67 @@ var errDeltaTooManyDeletes = errors.New("delta list: too many deletes")
 // The in-memory listing must be left unchanged so the caller can full-relist.
 var errDeltaCursorReset = errors.New("delta list: cursor reset")
 
+// errDeltaListingEmptied is returned when a prior non-empty listing would be replaced by zero files.
+var errDeltaListingEmptied = errors.New("delta list: listing became empty while prior listing had files")
+
+// errDeltaListingCollapsed is returned when file count dropped beyond --max-delete.
+var errDeltaListingCollapsed = errors.New("delta list: listing shrank beyond --max-delete")
+
+func countListingFiles(ls *fileList) int {
+	if ls == nil {
+		return 0
+	}
+	n := 0
+	for _, name := range ls.list {
+		if !ls.isDir(name) {
+			n++
+		}
+	}
+	return n
+}
+
+func guardFileCount(oldC, newC int, opt deltaApplyOpts) error {
+	if opt.Force || oldC == 0 {
+		return nil
+	}
+	if newC == 0 {
+		return errDeltaListingEmptied
+	}
+	if opt.MaxDelete >= 0 {
+		dropped := oldC - newC
+		if dropped > 0 && float64(dropped)/float64(oldC) > float64(opt.MaxDelete)/100.0 {
+			return errDeltaListingCollapsed
+		}
+	}
+	return nil
+}
+
+func guardListingShrink(prior, next *fileList, opt deltaApplyOpts) error {
+	if prior == nil || next == nil {
+		return nil
+	}
+	return guardFileCount(countListingFiles(prior), countListingFiles(next), opt)
+}
+
+func caseDeltaRemote(ls *fileList, remote string) string {
+	parent := path.Dir(remote)
+	if parent == "." {
+		parent = ""
+	}
+	if parent == "" {
+		return remote
+	}
+	if ls.has(parent) {
+		return path.Join(parent, path.Base(remote))
+	}
+	for _, name := range ls.list {
+		if strings.EqualFold(name, parent) {
+			return path.Join(name, path.Base(remote))
+		}
+	}
+	return remote
+}
+
 type listingDelta struct {
 	Remote  string
 	Deleted bool
@@ -63,6 +125,20 @@ func applyListingDeltas(ls *fileList, deltas []listingDelta, opt deltaApplyOpts)
 	deletedFiles := 0
 
 	for _, d := range deltas {
+		if d.Deleted {
+			if ls.has(d.Remote) {
+				// keep
+			} else {
+				for _, name := range ls.list {
+					if strings.EqualFold(name, d.Remote) {
+						d.Remote = name
+						break
+					}
+				}
+			}
+		} else {
+			d.Remote = caseDeltaRemote(ls, d.Remote)
+		}
 		if d.Deleted {
 			// Dropbox DeletedMetadata: remove the path and all children.
 			prefix := d.Remote
@@ -114,13 +190,18 @@ func saveListingAndCursor(listing, cursor, root string, ls *fileList) error {
 		_ = os.Remove(tmpListing)
 		return err
 	}
-	if err := os.Rename(tmpListing, listing); err != nil {
+	// Cursor first: a crash here leaves old listing + new cursor (missed
+	// updates, not a mass-delete). Listing-first would leave a new listing
+	// with a stale cursor, which can look like deletes on the next run.
+	if err := os.Rename(tmpCursor, cursorPath(listing)); err != nil {
 		_ = os.Remove(tmpListing)
 		_ = os.Remove(tmpCursor)
 		return err
 	}
-	if err := os.Rename(tmpCursor, cursorPath(listing)); err != nil {
-		return fmt.Errorf("listing saved but cursor rename failed (next run will full-list): %w", err)
+	if err := os.Rename(tmpListing, listing); err != nil {
+		_ = os.Remove(tmpListing)
+		_ = os.Remove(cursorPath(listing))
+		return fmt.Errorf("cursor saved but listing rename failed (cursor removed to force full-list): %w", err)
 	}
 	return nil
 }

cmd/bisync/delta_list_run.go

@@ -43,6 +43,11 @@ func (b *bisyncRun) makeDeltaListing(ctx context.Context) (*fileList, *fileList,
 	} else {
 		fs.Infof(nil, "Path1 full listing (no USN/journal; local walk)")
 		err = b.listOneFs(ctx, true)
+		if err == nil {
+			if prior, lerr := b.loadListing(b.listing1); lerr == nil {
+				err = guardListingShrink(prior, b.march.ls1, deltaApplyOpts{MaxDelete: b.opt.MaxDelete, Force: b.opt.Force})
+			}
+		}
 	}
 	if err != nil {
 		b.handleErr("delta-list", "error listing Path1", err, true, true)
@@ -56,6 +61,11 @@ func (b *bisyncRun) makeDeltaListing(ctx context.Context) (*fileList, *fileList,
 	} else {
 		fs.Infof(nil, "Path2 full listing (no USN/journal; local walk)")
 		err = b.listOneFs(ctx, false)
+		if err == nil {
+			if prior, lerr := b.loadListing(b.listing2); lerr == nil {
+				err = guardListingShrink(prior, b.march.ls2, deltaApplyOpts{MaxDelete: b.opt.MaxDelete, Force: b.opt.Force})
+			}
+		}
 	}
 	if err != nil {
 		b.handleErr("delta-list", "error listing Path2", err, true, true)
@@ -97,15 +107,19 @@ func (b *bisyncRun) refreshDropboxListing(ctx context.Context, dbx *dropbox.Fs,
 		cursor = ""
 	}
 
+	var prior *fileList
 	if cursor != "" {
-		prior, err := b.loadListing(listing)
+		loaded, err := b.loadListing(listing)
 		if err != nil {
 			fs.Infof(nil, "No usable prior listing (%v); full Dropbox relist", err)
 			cursor = ""
 		} else {
-			ls = prior
+			ls = loaded
 			ls.hash = b.hashTypeForFs(f)
+			prior = loaded
 		}
+	} else if loaded, err := b.loadListing(listing); err == nil {
+		prior = loaded
 	}
 
 	newCursor, reset, changes, err := dbx.ListFolderDeltas(ctx, cursor)
@@ -152,13 +166,24 @@ func (b *bisyncRun) refreshDropboxListing(ctx context.Context, dbx *dropbox.Fs,
 		})
 	}
 
-	applyErr := applyListingDeltas(ls, deltas, deltaApplyOpts{
+	applyOpts := deltaApplyOpts{
 		MaxDelete: b.opt.MaxDelete,
 		Force:     b.opt.Force,
-	})
+	}
+	priorCount := 0
+	hadPrior := prior != nil
+	if hadPrior {
+		priorCount = countListingFiles(prior)
+	}
+	applyErr := applyListingDeltas(ls, deltas, applyOpts)
 	if applyErr != nil {
 		return nil, applyErr
 	}
+	if hadPrior {
+		if err := guardFileCount(priorCount, countListingFiles(ls), applyOpts); err != nil {
+			return nil, err
+		}
+	}
 
 	if b.opt.DryRun {
 		fs.Infof(nil, "dry-run: not saving Dropbox listing cursor")

cmd/bisync/delta_list_test.go

@@ -120,3 +120,12 @@ func TestLoadCursor_MissingIsEmpty(t *testing.T) {
 	_, err = os.Stat(cursorPath(listing))
 	assert.True(t, os.IsNotExist(err))
 }
+
+func TestGuardFileCount(t *testing.T) {
+	opt := deltaApplyOpts{MaxDelete: 50}
+	require.NoError(t, guardFileCount(0, 0, opt))
+	require.NoError(t, guardFileCount(100, 80, opt))
+	require.ErrorIs(t, guardFileCount(100, 0, opt), errDeltaListingEmptied)
+	require.ErrorIs(t, guardFileCount(100, 40, opt), errDeltaListingCollapsed)
+	require.NoError(t, guardFileCount(100, 0, deltaApplyOpts{MaxDelete: 50, Force: true}))
+}

cmd/bisync/operations.go

@@ -124,6 +124,10 @@ func Bisync(ctx context.Context, fs1, fs2 fs.Fs, optArg *Options) (err error) {
 		return err
 	}
 
+	if opt.DeltaList && !opt.CheckAccess && !opt.Force {
+		return fmt.Errorf("--delta-list requires --check-access (or --force to bypass)")
+	}
+
 	// Handle lock file
 	err = b.setLockFile()
 	if err != nil {