owncloud / owncloud/ocis

Problematic encoding of WebDAV URLS

Open
#9,992 0 comments 0 reactions 0 assignees View on GitHub
Type:Bug
Dominant language
Go
Stars
2.1k
Forks
274
Avg merge
2d 1h
Merged PRs (30d)
103

Description

## Describe the bug
Multiple WebDAV clients have problems using the way the WebDAV URL of folders is encoded in the OCIS Web user interface. When I use the copied URL with e.g., the cadaver webdav client or as a sync-location for my password manager Enpass, they both fail to open that URL.

Currently the URL looks like this:
`https://192.168.1.23:9200/dav/spaces/de6602fa-3c8d-4055-884b-02106220a256%244c510ada-c86b-4815-8820-42cdf82c3d51/New%20folder` with the dollar sign in the middle encoded as `%24`, which does not work. Replacing the `%24` with the actual `$` character makes it work for both clients.

My guess is, that the encoded URL does not match the actual data returned the XML response. Using curl to call PROPFIND on the URL
```console
AUTH="$(echo -ne "einstein:relativity" | base64 --wrap 0)"
curl --insecure -H "Authorization: Basic $AUTH" -XPROPFIND \
'https://192.168.1.23:9200/dav/spaces/de6602fa-3c8d-4055-884b-02106220a256%244c510ada-c86b-4815-8820-42cdf82c3d51/New%20folder' \
| xmllint --format -
```
gives this output:
```xml


/dav/spaces/de6602fa-3c8d-4055-884b-02106220a256$4c510ada-c86b-4815-8820-42cdf82c3d51/New%20folder/


de6602fa-3c8d-4055-884b-02106220a256$4c510ada-c86b-4815-8820-42cdf82c3d51!2192ff68-b3c1-4e12-a4dd-72f31601eef6
de6602fa-3c8d-4055-884b-02106220a256$4c510ada-c86b-4815-8820-42cdf82c3d51!2192ff68-b3c1-4e12-a4dd-72f31601eef6
de6602fa-3c8d-4055-884b-02106220a256$4c510ada-c86b-4815-8820-42cdf82c3d51
de6602fa-3c8d-4055-884b-02106220a256$4c510ada-c86b-4815-8820-42cdf82c3d51!4c510ada-c86b-4815-8820-42cdf82c3d51
New folder
New folder
"92f6c870a2689b9bf8669916252e8895"
RDNVCKZP



0
Fri, 06 Sep 2024 13:20:36 GMT

0

HTTP/1.1 200 OK






HTTP/1.1 404 Not Found

```
You can see, that in the XML response the `%24` is decoded while the `%20` is not. My guess is that the WebDAV clients can't handle the `%24`/`$` mismatch.

## Steps to reproduce
1. Set up OCIS with Demo Users
2. run OCIS with PROXY_ENABLE_BASIC_AUTH=true
3. create a folder "New Folder" in the Web Interface for user einstein
4. copy the WebDAV URL for the "New Folder"
5. try to access the folder using cadaver for example: `cadaver 'https://192.168.1.23/dav/spaces/5d5f37f9-0ecf-4717-a677-840bf5fcb234%2492945bd5-00d5-4784-80f4-48b92d0ce702/New%20folder'`

## Expected behavior
The user interface should show the URL as it is used within the WebDAV protocol:
`https://192.168.1.23:9200/dav/spaces/de6602fa-3c8d-4055-884b-02106220a256$4c510ada-c86b-4815-8820-42cdf82c3d51/New%20folder`

Which allows cadaver to open it:
```
> cadaver 'https://192.168.1.23:9200/dav/spaces/de6602fa-3c8d-4055-884b-02106220a256$4c510ada-c86b-4815-8820-42cdf82c3d51/New%20folder'
[certificate warning removed]
Authentication required for 192.168.1.23:9200 on server `192.168.1.23':
Username: einstein
Password:
dav:/dav/spaces/de6602fa-3c8d-4055-884b-02106220a256$4c510ada-c86b-4815-8820-42cdf82c3d51/New folder/>
```
My password manager also works with this URL.

## Actual behavior
Currently shown URL: `https://192.168.1.23:9200/dav/spaces/de6602fa-3c8d-4055-884b-02106220a256%244c510ada-c86b-4815-8820-42cdf82c3d51/New%20folder` (`$` encoded as `%24`)

Cadaver gives this error after entering the password:
```
> cadaver 'https://192.168.1.23:9200/dav/spaces/de6602fa-3c8d-4055-884b-02106220a256%244c510ada-c86b-4815-8820-42cdf82c3d51/New%20folder'
[certificate warning removed]
Authentication required for 192.168.1.23:9200 on server `192.168.1.23':
Username: einstein
Password:
Could not access /dav/spaces/de6602fa-3c8d-4055-884b-02106220a256%244c510ada-c86b-4815-8820-42cdf82c3d51/New%20folder/ (not WebDAV-enabled?):
Did not find a collection resource.
Connection to `192.168.1.23' closed.
```

## Setup
Please describe how you started the server and provide a list of relevant environment variables or configuration files.


Running OCIS in a docker container

```console
docker run --rm -it --mount type=bind,source=$PWD/ocis/ocis-config,target=/etc/ocis -e IDM_CREATE_DEMO_USERS=true owncloud/ocis init
docker run --name ocis_runtime --rm -it -p 9200:9200 --mount type=bind,source=$PWD/ocis/ocis-config,target=/etc/ocis --mount type=bind,source=$PWD/ocis/ocis-data,target=/var/lib/ocis -e OCIS_LOG_LEVEL=info -e OCIS_INSECURE=true -e PROXY_HTTP_ADDR=0.0.0.0:9200 -e PROXY_TLS=true -e OCIS_URL=https://192.168.1.23:9200 -e PROXY_ENABLE_BASIC_AUTH=true -e WEBDAV_LOG_LEVEL=DEBUG -e OCIS_LOG_PRETTY=true -e IDM_CREATE_DEMO_USERS=true owncloud/ocis
```

## Additional context
I don't know if this is somehow related to #4676

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.