Reduce time information leakage of file uploads and file downloads

[evilaliv3]

The proposed fix together with the existing implementation performed for ticket #301 should be enough to avoid complete leakage of the file upload date.

Fixes #3304

[heartsucker]

Would it be possible to add an additional check to this that when we unzip and read the file back, we can check it's attribute to ensure that the time is actually set to 0?

[codecov-io]

Codecov Report

Merging #3305 into develop will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff            @@
##           develop    #3305   +/-   ##
========================================
  Coverage    85.76%   85.76%           
========================================
  Files           34       34           
  Lines         2157     2157           
  Branches       238      238           
========================================
  Hits          1850     1850           
  Misses         250      250           
  Partials        57       57

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 670c8ba...785ec32. Read the comment docs.

[evilaliv3]

Yep @heartsucker, i agree.

Maybe a full retesting of the zip archive for both the single file and the bulk archive

[emkll]

Thanks @evilaliv3 for the fix! Changes look good to me. I can confirm this strips the compression time on the submission's gzip archive.

On develop:

$ file 1-iridescent_cheapskate-doc.gz
1-iridescent_cheapskate-doc.gz: gzip compressed data, was "file.txt", last modified: Mon Apr 30 14:01:02 2018, max compression

On this branch:

securedrop$ file 1-infectious_carpentry-doc.gz
1-infectious_carpentry-doc.gz: gzip compressed data, was "file.txt", max compression

I agree with @heartsucker that adding a test to ensure the time is properly stripped is a good idea, but will defer to @redshiftzero on if this is required for merge.

[redshiftzero]

Let's merge this and then add additional testing - both changes should get backported into 0.7.0

[emkll]

I've created #3329 to implement at a later time. Thanks @evilaliv3 !