Mobile Chrome event update sends duplicate charset in Content-Type, triggering ModSecurity CRS 920530

Description

When saving an event from the Calendar web UI, the client sends a CalDAV PUT request for the event .ics resource with a duplicated charset parameter in the Content-Type header.

Observed sanitized request shape:

PUT /remote.php/dav/calendars/<user>/<calendar>/<uid>.ics
Content-Type: text/calendar; charset=UTF-8; component=vevent; charset=UTF-8

Because charset=UTF-8 appears twice, OWASP CRS / ModSecurity rule 920530 detects this as:

Multiple charsets detected in content type header

The WAF interrupts the request, so the event update fails. In the captured transaction the response status was 404 and transaction.is_interrupted was true.

Expected behavior

Calendar should send a valid Content-Type header with only one charset parameter, for example:

Content-Type: text/calendar; charset=UTF-8; component=vevent

or otherwise avoid duplicating charset when adding the VEVENT component parameter.

Actual behavior

Calendar sends:

Content-Type: text/calendar; charset=UTF-8; component=vevent; charset=UTF-8

This triggers OWASP CRS / ModSecurity rule 920530, causing the request to be blocked/interrupted.

Steps to reproduce

1. Open Nextcloud Calendar in Chrome on mobile.
2. Edit an existing calendar event.
3. Save the event.
4. Inspect the resulting PUT request to /remote.php/dav/calendars/<user>/<calendar>/<uid>.ics.
5. Observe that the Content-Type header contains charset=UTF-8 twice.
6. With ModSecurity and OWASP CRS enabled, observe rule 920530 blocking the request.

Sanitized ModSecurity details

Request method: PUT
Request URI: /remote.php/dav/calendars/<user>/<calendar>/<uid>.ics
Relevant header: Content-Type: text/calendar; charset=UTF-8; component=vevent; charset=UTF-8
Response status: 404
Interrupted: true

ModSecurity: ModSecurity v3.0.15 (Linux)
Connector: ModSecurity-nginx v1.0.4
OWASP CRS: 4.25.0
Rule ID: 920530
Rule file: REQUEST-920-PROTOCOL-ENFORCEMENT.conf
Rule message: Multiple charsets detected in content type header
Matched data: text/calendar; charset=utf-8; component=vevent; charset=utf-8
Rule tags: attack-protocol, paranoia-level/1, OWASP_CRS/PROTOCOL-ENFORCEMENT

Private domain, username, IP addresses, cookies, request token, session identifiers, ETag, Cloudflare request identifiers, and server identifiers have been removed.

Environment

• Nextcloud Server version: unknown
• Calendar app version: unknown
• Browser: Chrome mobile on Android
• Reverse proxy / WAF: ModSecurity with OWASP Core Rule Set enabled
• ModSecurity version: 3.0.15
• ModSecurity nginx connector: 1.0.4
• OWASP CRS version: 4.25.0

Related references

This may be related to previous Content-Type handling work in the CalDAV library:

• https://github.com/nextcloud/cdav-library/issues/539
• https://github.com/nextcloud/cdav-library/pull/540

Start by tracing the Calendar web UI's CalDAV PUT request for an event update and how its Content-Type header is assembled. Compare that handling with the related cdav-library issue #539 and pull request #540. Done means the request contains only one charset parameter and is no longer blocked by ModSecurity rule 920530.