owncloud / owncloud/ocis

PATCH request for TUS upload with wrong checksum gives incorrect response

Open
#1,755 13 comments 0 reactions 1 assignee Claimed by @kobergj View on GitHub
Priority:p2-high Type:Bug Type:Discussion
Dominant language
Go
Stars
2.1k
Forks
274
Avg merge
2d 1h
Merged PRs (30d)
103

Description

## Describe the bug

According to the TUS checksum extension description in https://tus.io/protocols/resumable-upload.html#checksum when a `PATCH` request is send with an `Upload-Checksum` header depending on the result the server may respond with one of the following status code:
1.` 400 Bad Request ` if the checksum algorithm is not supported by the server
2. `460 Checksum Mismatch` if the checksums mismatch
3. `204 No Content` if the checksums match and the processing of the data succeeded
But when we send `PATCH` request with wrong checksum then instead of `460 Checksum Mismatch` we get `204 No Content`

## Steps to reproduce

Steps to reproduce the behavior:

1. Create a base64 encoding of a file name
- `echo -n "textFile.txt" | base64` (example dGV4dEZpbGUudHh0)
2. As user Einstein send a `POST` request to create resource which will give a resource location url.
```
curl -k -X POST -u einstein:relativity https://localhost:9200/remote.php/dav/files/Einstein/ -H 'Tus-Resumable: 1.0.0' -H 'Upload-Length: 5' -H 'Upload-Metadata: filename dGV4dEZpbGUudHh0' -v
```
3. User Einstein send `PATCH` request to upload data to the location url along with a wrong checkum
For example: correct sha1sum for '12345' is `8cb2237d0679ca88db6464eac60da96345513964` but we are sending wrong value i.e. `01b307acba4f54f55aafc33bb06bbbf6ca803e9a`:
```
curl -k -X PATCH -u einstein:relativity -H 'Content-Type: application/offset+octet-stream' -H 'Tus-Resumable: 1.0.0' -H 'Upload-Offset: 0' -H'Upload-Checksum:sha1 01b307acba4f54f55aafc33bb06bbbf6ca803e9a' -d '12345' -v
```

## Expected behavior
```
HTTP/1.1 460 Checksum Mismatch
Tus-Resumable: 1.0.0
Upload-Offset: 5
```

## Actual behavior
```
HTTP/1.1 204 No content
Tus-Resumable: 1.0.0
Upload-Offset: 5
```
While doing `PROPFIND` it can be seen that the file `textFile.txt` has been created and it gives the correct checksum and ignores the incorrect checksum send during `PATCH` request.
```
curl -X PROPFIND -u einstein:relativity https://localhost:9200/remote.php/webdav -k | xmllint --format -
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1676 100 1676 0 0 27032 0 --:--:-- --:--:-- --:--:-- 27032


/remote.php/webdav/


MTI4NGQyMzgtYWE5Mi00MmNlLWJkYzQtMGIwMDAwMDA5MTU3OjA2OTRjZjY4LWYxOGUtNDY1ZC1hMzlkLTEzNWFkM2RkMjg3ZA==
MTI4NGQyMzgtYWE5Mi00MmNlLWJkYzQtMGIwMDAwMDA5MTU3OjA2OTRjZjY4LWYxOGUtNDY1ZC1hMzlkLTEzNWFkM2RkMjg3ZA==
"7bdfa13e5b7a5a4cdd27fb7550617b10"
DNVCKR



5
Thu, 04 Mar 2021 06:38:01 GMT
0

HTTP/1.1 200 OK



/remote.php/webdav/textFile.txt


MTI4NGQyMzgtYWE5Mi00MmNlLWJkYzQtMGIwMDAwMDA5MTU3Ojg2NzI2NzA5LTNlOTQtNDcxZS04YTAyLTAzOTdlMzdjYzdhYw==
MTI4NGQyMzgtYWE5Mi00MmNlLWJkYzQtMGIwMDAwMDA5MTU3Ojg2NzI2NzA5LTNlOTQtNDcxZS04YTAyLTAzOTdlMzdjYzdhYw==
"a5cf632982d978b971264c7edddb2738"
DNVWR

5
text/plain; charset=utf-8
Thu, 04 Mar 2021 06:38:01 GMT

SHA1:8cb2237d0679ca88db6464eac60da96345513964 MD5:827ccb0eea8a706c4c34a16891f84e7b ADLER32:02f80100

0

HTTP/1.1 200 OK

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.