From 18fc5a4fc01f65367fec970f4e4cf2679ee64adb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rn=20Friedrich=20Dreyer?= Date: Wed, 7 Jul 2021 15:02:59 +0200 Subject: [PATCH] be defensive about wrongly quoted etags MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jörn Friedrich Dreyer --- changelog/unreleased/more-robust-etag-handling.md | 5 +++++ internal/http/services/owncloud/ocdav/propfind.go | 12 ++++++++++-- 2 files changed, 15 insertions(+), 2 deletions(-) create mode 100644 changelog/unreleased/more-robust-etag-handling.md diff --git a/changelog/unreleased/more-robust-etag-handling.md b/changelog/unreleased/more-robust-etag-handling.md new file mode 100644 index 0000000000..9d54d176e4 --- /dev/null +++ b/changelog/unreleased/more-robust-etag-handling.md @@ -0,0 +1,5 @@ +Enhancement: Be defensive about wrongly quoted etags + +When ocdav renders etags it will now try to correct them to the definition as *quoted strings* which do not contain `"`. This prevents double or triple quoted etags on the webdav api. + +https://github.com/cs3org/reva/pull/1870 diff --git a/internal/http/services/owncloud/ocdav/propfind.go b/internal/http/services/owncloud/ocdav/propfind.go index 6b2a9e8fd2..75fa6f726d 100644 --- a/internal/http/services/owncloud/ocdav/propfind.go +++ b/internal/http/services/owncloud/ocdav/propfind.go @@ -419,7 +419,7 @@ func (s *svc) mdToPropResponse(ctx context.Context, pf *propfindXML, md *provide // etags must be enclosed in double quotes and cannot contain them. // See https://tools.ietf.org/html/rfc7232#section-2.3 for details // TODO(jfd) handle weak tags that start with 'W/' - propstatOK.Prop = append(propstatOK.Prop, s.newProp("d:getetag", md.Etag)) + propstatOK.Prop = append(propstatOK.Prop, s.newProp("d:getetag", quoteEtag(md.Etag))) } if md.PermissionSet != nil { @@ -712,7 +712,7 @@ func (s *svc) mdToPropResponse(ctx context.Context, pf *propfindXML, md *provide switch pf.Prop[i].Local { case "getetag": // both if md.Etag != "" { - propstatOK.Prop = append(propstatOK.Prop, s.newProp("d:getetag", md.Etag)) + propstatOK.Prop = append(propstatOK.Prop, s.newProp("d:getetag", quoteEtag(md.Etag))) } else { propstatNotFound.Prop = append(propstatNotFound.Prop, s.newProp("d:getetag", "")) } @@ -816,6 +816,14 @@ func (s *svc) mdToPropResponse(ctx context.Context, pf *propfindXML, md *provide return &response, nil } +// be defensive about wrong encoded etags +func quoteEtag(etag string) string { + if strings.HasPrefix(etag, "W/") { + return `W/"` + strings.Trim(etag[2:], `"`) + `"` + } + return `"` + strings.Trim(etag, `"`) + `"` +} + // a file is only yours if you are the owner func isCurrentUserOwner(ctx context.Context, owner *userv1beta1.UserId) bool { contextUser, ok := ctxuser.ContextGetUser(ctx)