jelmer / xandikos

A CalDAV/CardDAV server backed by Git
https://www.xandikos.org/
GNU General Public License v3.0
410 stars 42 forks source link

fails to create resource which include %23 in the URL #253

Closed jelmer closed 10 months ago

jelmer commented 1 year ago

From Matrix:

WhyNotHugo: Xandikos seems to fail to create resource which include %23 in the URL. WhyNotHugo: %23 is an escaped #. WhyNotHugo: Obviously it's an edge case, but that's exactly what I'm testing: the edge cases :P

WhyNotHugo commented 1 year ago

Including any of the following characters (properly URL-encoded) fails:

Colon (:)

If I create /user/calendars/sEbL3BXr75CCTQBj/weird-:-pyDagt.ics, when later listing the collection (via propfind) the full path for the result is weird-:-pyDagt.ics (e.g.: it is missing the leading components).

The relevant portion from the response is:

<ns0:href>weird-%3A-NT6O77.ics</ns0:href>

For reference, it should look something like:

<ns0:href>/user/calendars/A7S75aZPnkO4W6m4/Q1xU9zdrlQPN.ics</ns0:href>

Question mark (?)

The item /user/calendars/t0jI85Dinj6kSNuB/weird-?-FF6ZpK.ics is created fine and when listing the collection (via propfind) the item is returned with the correct URL.

However, when I fetch the actual resource (via a multiget REPORT), the href is truncated and the resource reported as not found:

<ns0:multistatus
    xmlns:ns0=\"DAV:\">
    <ns0:response>
        <ns0:href>/user/calendars/t0jI85Dinj6kSNuB/weird-</ns0:href>
        <ns0:status>HTTP/1.1 404 Not Found</ns0:status>
    </ns0:response>
</ns0:multistatus>

Pound (#)

Same behaviour as question mark. Creating works, item is listed as /user/calendars/JquLuc6ASpeE1Yw2/weird-#-pstQ8q.ics via propfind, but the multiget REPORT has a truncated href:

/user/calendars/JquLuc6ASpeE1Yw2/weird-

In this case the element is also reported as not found:

<ns0:multistatus
    xmlns:ns0=\"DAV:\">
    <ns0:response>
        <ns0:href>/user/calendars/JquLuc6ASpeE1Yw2/weird-</ns0:href>
        <ns0:status>HTTP/1.1 404 Not Found</ns0:status>
    </ns0:response>
</ns0:multistatus>