emersion / emersion/go-webdav

caldav: PROPFIND with allprop returns many properties which should not be returned

Open
#178 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
497
Forks
108
PR merge metrics
No merged PRs in 30d

Description

It appears that many properties which should not be returned according to RFC 4791 are returned in an allprop request.

These properties "SHOULD NOT" be returned according to RFC 4791:
- `supported-calendar-data`
- `supported-calendar-component-set`
- `max-resource-size`
- `calendar-description`

I am not sure whether `current-user-principal` should be returned in allprop. But it seems it should not since https://datatracker.ietf.org/doc/html/rfc4918#section-14.2 states that only properties defined in RFC4918 should be returned.

Additionally the `calendar-data` "prop" should never be returned in a PROPFIND request; see https://datatracker.ietf.org/doc/html/rfc4791#section-9.6 which states:
```
Note: The CALDAV:calendar-data XML element is specified in requests
and responses inside the DAV:prop XML element as if it were a
WebDAV property. However, the CALDAV:calendar-data XML element is
not a WebDAV property and, as such, is not returned in PROPFIND
responses, nor used in PROPPATCH requests.
```

Here is what happens using a MWE of this library.

client sends PROPFIND with request body:
```text/xml

```

server responds with:
```text/xml


/caldav/calendars/default/









default
1048576

/caldav/





default description

HTTP/1.1 200 OK



/caldav/calendars/default/c12141ed-eb26-48d6-ac79-43a859e53012.ics



/caldav/

text/calendar
BEGIN:VCALENDAR
PRODID:DAVx5/4.4.5-ose ical4j/3.2.19 (org.fossify.calendar)
VERSION:2.0
BEGIN:VEVENT
DESCRIPTION:description
DTEND;TZID=Europe/Paris:20250113T160000
DTSTAMP:20250111T221820Z
DTSTART;TZID=Europe/Paris:20250113T150000
STATUS:CONFIRMED
SUMMARY:summary
UID:c12141ed-eb26-48d6-ac79-43a859e53012
BEGIN:VALARM
ACTION:DISPLAY
DESCRIPTION:alarm description
TRIGGER:-PT30M
END:VALARM
END:VEVENT
BEGIN:VTIMEZONE
TZID:Europe/Paris
BEGIN:STANDARD
DTSTART:19961027T030000
RRULE:FREQ=YEARLY;BYMONTH=10;BYDAY=-1SU
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:19810329T020000
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=-1SU
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
END:VCALENDAR

"1819c3541e3431a5359"


HTTP/1.1 200 OK

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.