Kozea / Radicale

A simple CalDAV (calendar) and CardDAV (contact) server.
https://radicale.org
GNU General Public License v3.0
3.23k stars 423 forks source link

invitation from an airline is causing parser error #1492

Open pbiering opened 2 months ago

pbiering commented 2 months ago

Found (anonymized)

May 17 13:54:54 server radicale[902]: [902/Thread-511] [WARNING] Bad PUT request on '/user/events/BF5D3690-0000-0000-0000-00000000.ics': At line 79: Failed to parse line: X-APPLE-END-LOCATION;VALUE=URI;X-ADDRESS="Airport Location, Address, Country";X-APPLE-MAPKIT-HANDLE=BASE64encodedSOMETHING=;X-TITLE=Airport \"Location\":geo:1.23456,1.23456

it failed here:

vobject_items = radicale_item.read_components(content or "")

for better diagnostics where a PUT request failed, I've extended the code by 61fef9c9df4efafb50fd297caeae67f7351b6568

da4089 commented 2 months ago

Creating a test file containing just the quoted line, I can reproduce a parser error:

(venv37) > python dat2.py
Traceback (most recent call last):
  File "dat2.py", line 14, in <module>
    for vo in vobjs:
  File "/Users/d/work/personal/vobject/vobject/base.py", line 1101, in readComponents
    vline = textLineToContentLine(line, n)
  File "/Users/d/work/personal/vobject/vobject/base.py", line 925, in textLineToContentLine
    return ContentLine(*parseLine(text, n), **{'encoded': True,
  File "/Users/d/work/personal/vobject/vobject/base.py", line 813, in parseLine
    raise ParseError("Failed to parse line: {0!s}".format(line), lineNumber)
vobject.base.ParseError: At line 1: Failed to parse line: X-APPLE-END-LOCATION;VALUE=URI;X-ADDRESS="Airport Location, Address, Country";X-APPLE-MAPKIT-HANDLE=BASE64encodedSOMETHING=;X-TITLE=Airport \"Location\":geo:1.23456,1.23456
(venv37) >
da4089 commented 2 months ago

Testing with that, the problem is the backslash-quoted double-quote characters in the X-TITLE parameter.

From the spec, section 3.2: Property parameter values MUST NOT contain the DQUOTE character.

If you have the complete iCalendar file data (like, from the email attachment?) it'd be great to look at it in more detail, and ideally file an upstream bug against whatever software was used to create this event.

I'll have a look at vObject's parser in some more detail, and see if it'd be reasonable to accept backslash-quoted double-quotes within a parameter value.

pbiering commented 1 month ago

@da4089 : was able now to catch the whole ICS content and run the validator with result:

Property parameter values must not contain the DQUOTE (") character. near line # 24Reference: 3.2. Property Parameters

Source is a content provided by airline through "Add to Apple Wallet". The "pkpass" file contains a pass.json - but the iPhone is doing some additional magic here, because the shown geolocation data is not the one provided in the pass.json and the airport name neither.

Looks for me that iPhone is looking up by reference somewhere and the content is returned. Once double quote is replaced by single quote the upload works well on a test system.

 X-APPLE-STRUCTURED-LOCATION;VALUE=URI;X-ADDRESS=Αεροδρόμιο Θεσσαλονίκης 
- \"Μακεδονία\" 551 03 Thessaloniki Greece;X-TITLE=Thessaloniki Internatio
+ \'Μακεδονία\' 551 03 Thessaloniki Greece;X-TITLE=Thessaloniki Internatio
  nal Airport:geo:40.520833,22.972222

Question is now where to report and whether a "broken client" workaround should be implemented in "radicale" or "vobject" for such cases.

pbiering commented 1 month ago

Filed a feedback to Apple now: FB13813258