fix(webdav): escape LIKE patterns, check dstDir is dir, bound PROPFIND body

Signed-off-by: Lythen <[email protected]>

Author: devLythen

server/webdav/file.go

@@ -55,11 +55,13 @@ func moveFiles(ctx context.Context, src, dst string, overwrite bool) (status int
 	if !common.CanWrite(user, srcMeta, srcDir) || !common.CanWrite(user, dstMeta, dstDir) {
 		return http.StatusForbidden, nil
 	}
-	if _, err = fs.Get(ctx, dstDir, &fs.GetArgs{}); err != nil {
+	if dstDirInfo, err := fs.Get(ctx, dstDir, &fs.GetArgs{}); err != nil {
 		if errs.IsObjectNotFound(err) {
 			return http.StatusConflict, err
 		}
 		return http.StatusMethodNotAllowed, err
+	} else if !dstDirInfo.IsDir() {
+		return http.StatusConflict, nil
 	}
 	dstExisted := false
 	if _, err = fs.Get(ctx, dst, &fs.GetArgs{}); err == nil {
@@ -119,11 +121,13 @@ func copyFiles(ctx context.Context, src, dst string, overwrite bool) (status int
 	if !common.CanWrite(user, dstMeta, dstDir) {
 		return http.StatusForbidden, nil
 	}
-	if _, err = fs.Get(ctx, dstDir, &fs.GetArgs{}); err != nil {
+	if dstDirInfo, err := fs.Get(ctx, dstDir, &fs.GetArgs{}); err != nil {
 		if errs.IsObjectNotFound(err) {
 			return http.StatusConflict, err
 		}
 		return http.StatusMethodNotAllowed, err
+	} else if !dstDirInfo.IsDir() {
+		return http.StatusConflict, nil
 	}
 	dstExisted := false
 	if _, err = fs.Get(ctx, dst, &fs.GetArgs{}); err == nil {

server/webdav/prop.go

@@ -352,24 +352,22 @@ func moveDeadProps(src, dst string) error {
 		return errors.New("webdav property database is not initialized")
 	}
 	return database.Transaction(func(tx *gorm.DB) error {
+		escaped := strings.ReplaceAll(strings.ReplaceAll(src, "%", "\\%"), "_", "\\_")
+		if err := tx.Where("path = ? OR path LIKE ? ESCAPE '\\'", src, escaped+"/%").Delete(&model.WebDAVProperty{}).Error; err != nil {
+			return err
+		}
 		var rows []model.WebDAVProperty
-		if err := tx.Where("path = ? OR path LIKE ?", src, src+"/%").Find(&rows).Error; err != nil {
+		if err := tx.Where("path = ? OR path LIKE ? ESCAPE '\\'", src, escaped+"/%").Find(&rows).Error; err != nil {
 			return err
 		}
 		for _, row := range rows {
 			newPath := dst + strings.TrimPrefix(row.Path, src)
-			if err := tx.Where("path = ? AND namespace = ? AND name = ?", newPath, row.Namespace, row.Name).Delete(&model.WebDAVProperty{}).Error; err != nil {
-				return err
-			}
 			copy := row
 			copy.ID = 0
 			copy.Path = newPath
 			if err := tx.Create(&copy).Error; err != nil {
 				return err
 			}
-			if err := tx.Delete(&row).Error; err != nil {
-				return err
-			}
 		}
 		return nil
 	})

server/webdav/xml.go

@@ -178,13 +178,20 @@ type propfind struct {
 }
 
 func readPropfind(r io.Reader) (pf propfind, status int, err error) {
-	body, err := io.ReadAll(r)
+	// 64KB is more than enough for a well-formed PROPFIND body.
+	const maxBody = 64 << 10
+	body, err := io.ReadAll(io.LimitReader(r, maxBody))
 	if err != nil {
 		return propfind{}, http.StatusBadRequest, err
 	}
+	// If the limit was reached, the body was too large.
+	if len(body) >= maxBody {
+		// Drain any remaining bytes so the connection stays usable.
+		_, _ = io.Copy(io.Discard, r)
+		return propfind{}, http.StatusRequestEntityTooLarge, nil
+	}
 	if len(body) == 0 {
 		// An empty body means to propfind allprop.
-		// http://www.webdav.org/specs/rfc4918.html#METHOD_PROPFIND
 		return propfind{Allprop: new(struct{})}, 0, nil
 	}
 	if hasEmptyNamespacePrefix(body) {