floccusaddon / floccusaddon/floccus

Race condition when acquiring lock for webdav based accounts

Open
#1,087 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
8.5k
Forks
327
Avg merge
3d 14h
Merged PRs (30d)
2

Description

### Which version of floccus are you using?

4.12.0

### Sync method

{"label"=>"WebDAV"}

### Which browser are you using?

Firefox 98.0.1

### Which version of Nextcloud Bookmarks are you using? (if relevant)

_No response_

### Which version of Nextcloud? (if relevant)

_No response_

### What kind of WebDAV server are you using? (if relevant)

Doesn't matter.

### Describe the Bug

A typical sync cycle looks like this in the logfile of a webdav server:
```
2022-03-22T12:36:01.904401Z ip1 bob 404 GET /bookmarks/bookmarks.xbel.lock
2022-03-22T12:36:02.057273Z ip1 bob 201 PUT /bookmarks/bookmarks.xbel.lock
2022-03-22T12:36:02.250949Z ip1 bob 200 GET /bookmarks/bookmarks.xbel
2022-03-22T12:36:06.100949Z ip1 bob 200 PUT /bookmarks/bookmarks.xbel
2022-03-22T12:36:06.791755Z ip1 bob 204 DELETE /bookmarks/bookmarks.xbel.lock
```
The first `GET` request for the `.lock` file seems too check if that account is currently locked and the following `PUT` seems to actually lock the account, it it was unlocked (404 response).
There is a race condition (here approx. 150ms). When a second client does the same `GET` for checking for the `.lock` file before the `PUT` for the `.lock` file of the first client both think nothing is locked and do the `.lock` file `PUT`. If both have changes, the slower one will win, as this `PUT` for the data request happens later and will overwrite the changes of the faster client.

To solve this the `GET` and `PUT` for the `.lock` file must be done atomically. WebDAV has the [`LOCK` method](https://datatracker.ietf.org/doc/html/rfc4918#section-9.10),) which, if used, should solve the issue, right?

### Expected Behavior

No race condition.

### To Reproduce

Didn't try to reproduce, just thought about it so far.

### Debug log provided

- [ ] I have provided a debug log file

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.