Fail more gracefully on crap encoding input.

This commit is contained in:
Andrew McMillan 2011-10-07 08:27:02 +02:00
parent 5b921b3884
commit ce77dae043
4 changed files with 348 additions and 41 deletions

View File

@ -114,28 +114,60 @@ class CalDAVRequest
$this->options = $options;
if ( !isset($this->options['allow_by_email']) ) $this->options['allow_by_email'] = false;
/**
* Our path is /<script name>/<user name>/<user controlled> if it ends in
* a trailing '/' then it is referring to a DAV 'collection' but otherwise
* it is referring to a DAV data item.
*
* Permissions are controlled as follows:
* 1. if there is no <user name> component, the request has read privileges
* 2. if the requester is an admin, the request has read/write priviliges
* 3. if there is a <user name> component which matches the logged on user
* then the request has read/write privileges
* 4. otherwise we query the defined relationships between users and use
* the minimum privileges returned from that analysis.
*/
$this->path = (isset($_SERVER['PATH_INFO']) ? $_SERVER['PATH_INFO'] : "/");
$this->path = rawurldecode($this->path);
/** Allow a request for .../calendar.ics to translate into the calendar URL */
if ( preg_match( '#^(/[^/]+/[^/]+).ics$#', $this->path, $matches ) ) {
$this->path = $matches[1]. '/';
}
// dbg_error_log( "caldav", "Sanitising path '%s'", $this->path );
$bad_chars_regex = '/[\\^\\[\\(\\\\]/';
if ( preg_match( $bad_chars_regex, $this->path ) ) {
$this->DoResponse( 400, translate("The calendar path contains illegal characters.") );
}
if ( strstr($this->path,'//') ) $this->path = preg_replace( '#//+#', '/', $this->path);
if ( !isset($c->raw_post) ) $c->raw_post = file_get_contents( 'php://input');
if ( isset($_SERVER['HTTP_CONTENT_ENCODING']) ) {
@dbg_error_log('caldav', 'Content-Encoding: %s', $_SERVER['HTTP_CONTENT_ENCODING'] );
switch( $_SERVER['HTTP_CONTENT_ENCODING'] ) {
$encoding = $_SERVER['HTTP_CONTENT_ENCODING'];
@dbg_error_log('caldav', 'Content-Encoding: %s', $encoding );
$encoding = preg_replace('{[^a-z0-9-]}i','',$encoding);
if ( ! ini_get('open_basedir') && (isset($c->dbg['ALL']) || isset($c->dbg['caldav'])) ) {
$fh = fopen('/tmp/encoded_data.'.$encoding,'w');
if ( $fh ) {
fwrite($fh,$c->raw_post);
fclose($fh);
}
}
switch( $encoding ) {
case 'gzip':
$this->raw_post = gzdecode($c->raw_post);
$this->raw_post = @gzdecode($c->raw_post);
break;
case 'deflate':
$this->raw_post = gzinflate($c->raw_post);
$this->raw_post = @gzinflate($c->raw_post);
break;
case 'compress':
$this->raw_post = gzuncompress($c->raw_post);
$this->raw_post = @gzuncompress($c->raw_post);
break;
default:
if ( ! ini_get('open_basedir') && (isset($c->dbg['ALL']) || isset($c->dbg['caldav'])) ) {
$fh = fopen('/tmp/raw_post','w');
if ( $fh ) {
fwrite($fh,$request->raw_post);
fclose($fh);
}
}
$this->PreconditionFailed(402, 'content-encoding', 'This server does not presently support content encoded with "%s"', $_SERVER['HTTP_CONTENT_ENCODING']);
}
if ( empty($this->raw_post) && !empty($c->raw_post) ) {
$this->PreconditionFailed(415, 'content-encoding', sprintf('Unable to decode "%s" content encoding.', $_SERVER['HTTP_CONTENT_ENCODING']));
}
$c->raw_post = $this->raw_post;
}
@ -244,34 +276,6 @@ class CalDAVRequest
if ( ! isset($this->timeout) || $this->timeout == 0 ) $this->timeout = (isset($c->default_lock_timeout) ? $c->default_lock_timeout : 900);
}
/**
* Our path is /<script name>/<user name>/<user controlled> if it ends in
* a trailing '/' then it is referring to a DAV 'collection' but otherwise
* it is referring to a DAV data item.
*
* Permissions are controlled as follows:
* 1. if there is no <user name> component, the request has read privileges
* 2. if the requester is an admin, the request has read/write priviliges
* 3. if there is a <user name> component which matches the logged on user
* then the request has read/write privileges
* 4. otherwise we query the defined relationships between users and use
* the minimum privileges returned from that analysis.
*/
$this->path = (isset($_SERVER['PATH_INFO']) ? $_SERVER['PATH_INFO'] : "/");
$this->path = rawurldecode($this->path);
/** Allow a request for .../calendar.ics to translate into the calendar URL */
if ( preg_match( '#^(/[^/]+/[^/]+).ics$#', $this->path, $matches ) ) {
$this->path = $matches[1]. '/';
}
// dbg_error_log( "caldav", "Sanitising path '%s'", $this->path );
$bad_chars_regex = '/[\\^\\[\\(\\\\]/';
if ( preg_match( $bad_chars_regex, $this->path ) ) {
$this->DoResponse( 400, translate("The calendar path contains illegal characters.") );
}
if ( strstr($this->path,'//') ) $this->path = preg_replace( '#//+#', '/', $this->path);
$this->principal = new Principal('path',$this->path);
/**

View File

@ -0,0 +1,11 @@
HTTP/1.1 415 Unsupported Media Type
Date: Dow, 01 Jan 2000 00:00:00 GMT
DAV: 1, 2, 3, access-control, calendar-access, calendar-schedule
DAV: extended-mkcol, calendar-proxy, bind, addressbook, calendar-auto-schedule
Content-Length: 135
Content-Type: text/xml; charset="utf-8"
<?xml version="1.0" encoding="utf-8" ?>
<error xmlns="DAV:">
<content-encoding/>Unable to decode "deflate" content encoding.
</error>

View File

@ -0,0 +1,14 @@
#
# Testing with a process similar to iCal4
#
TYPE=PUT
URL=http://regression.host/caldav.php/user1/home/0546-deflate-PUT.ics
HEAD
HEADER=DAVKit/4.0 (729); CalendarStore/4.0 (965); iCal/4.0 (1362); Mac OS X/10.6.1 (10B504)
HEADER=Content-Type: text/calendar
HEADER=Content-Encoding: deflate
#
#
DATA=0544-gzip-PUT

View File

@ -0,0 +1,278 @@
BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//RSB//FreeMiCal//EN
BEGIN:VEVENT
SUMMARY:Aüa Aaaaaa aaa Aaaaa aaa Aaaaaaaaa-Aaaaüa aaaaaaa aa. Aaaaaaaa
DTSTART;VALUE=DATE:20071111
DTEND;VALUE=DATE:20071112
DTSTAMP:20070613T112658
DESCRIPTION:Aaaaa Aaaa aa 11.11.11 aaaaaaaaa/aaäaßaaa\n\n
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaa1111 - aaaaaaaaaaa aaaaaaaaaaa aaa aaaaaa
DTSTART;VALUE=DATE:20070915
DTEND;VALUE=DATE:20070916
DTSTAMP:20070613T112658
LOCATION:Aaaaaa/Aaa
DESCRIPTION:Aaaaaaaaaa aa 11.11.1111 aaa aaaaaaa@a-aaaaaaa.aa\nAaaaaaa
aaaaaaaa üaaa aaaaaaa@aaaaaaaa.aa\n\n
END:VEVENT
BEGIN:VEVENT
SUMMARY:AAA'11
DTSTART;VALUE=DATE:20070824
DTEND;VALUE=DATE:20070825
DTSTAMP:20070613T112658
LOCATION:Aaa Aöaaa, Aaaaaaaaa
DESCRIPTION:aaaa://aaa.aaa11.aa/\n\n
CATEGORIES:Aaaaaaa Aaaaaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaaa Aaaaaaaaaaaaaaäa
DTSTART:20070820T090000
DTEND:20070820T151500
DTSTAMP:20070613T112659
CATEGORIES:Aaaaaaaaaäa Aaaaaaaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaa Aaaaaaaaaaaaaa
DTSTART;VALUE=DATE:20070713
DTEND;VALUE=DATE:20070714
DTSTAMP:20070613T112659
CATEGORIES:Aaaaaaaaaäa Aaaaaaaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaaa aaa Aaaaa
DTSTART:20070710T093000
DTEND:20070710T120000
DTSTAMP:20070613T112659
CATEGORIES:Aaaaaaaaaäa Aaaaaaaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaa Aaaaaaa
DTSTART;VALUE=DATE:20070630
DTEND;VALUE=DATE:20070701
DTSTAMP:20070613T112659
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaa Aaaaaaaaaaaaa
DTSTART;VALUE=DATE:20070629
DTEND;VALUE=DATE:20070630
DTSTAMP:20070613T112659
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaa Aaaaaaaaaaaa
DTSTART:20070628T193000
DTEND:20070628T223000
DTSTAMP:20070613T112659
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaa aaaaa aa Aaaaaaaaa, aa Aaaaa+Aaaa aa aaa Aaaaa
DTSTART;VALUE=DATE:20070628
DTEND;VALUE=DATE:20070629
DTSTAMP:20070613T112659
DESCRIPTION:-A.A. Aaaaaaaöaaaaaa aaa Aaaaaaaaa Aaaaaaaaa (aaaaaa)\n-\n
\n
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaaaaaaa
DTSTART:20070627T154500
DTEND:20070627T234500
DTSTAMP:20070613T112659
LOCATION:Aaaaaaaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaaaaaa aaa AaaaAaaaaa-Aaaaaaa
DTSTART;VALUE=DATE:20070616
DTEND;VALUE=DATE:20070617
DTSTAMP:20070613T112700
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaa Aaaaaa
DTSTART;VALUE=DATE:20070615
DTEND;VALUE=DATE:20070618
DTSTAMP:20070613T112700
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaa aa aaa Aüaaaa aaa Aaa aaa Aaaa
DTSTART;VALUE=DATE:20070614
DTEND;VALUE=DATE:20070622
DTSTAMP:20070613T112700
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaaaaa
DTSTART:20070613T180000
DTEND:20070613T203000
DTSTAMP:20070613T112700
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaaaaa aaa Aaaa
DTSTART:20070613T100000
DTEND:20070613T111000
DTSTAMP:20070613T112700
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaaaaa
DTSTART:20070612T180000
DTEND:20070612T200000
DTSTAMP:20070613T112700
END:VEVENT
BEGIN:VEVENT
SUMMARY:AaaAaa11-Aaaaaaaaaaäaaaaaaaaa
DTSTART:20070612T180000
DTEND:20070612T210000
DTSTAMP:20070613T112700
CATEGORIES:Aaaaaaaaaäa Aaaaaaaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaaa aaa AaaAaa-Aaaaaaa
DTSTART:20070612T180000
DTEND:20070612T183000
DTSTAMP:20070613T112701
LOCATION:AaaAaa-Aaaa aaa Aaaaaaaaa
CATEGORIES:Aaaaaaaaaäa Aaaaaaaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaa Aaaaa Aaaaaa aaaaaaaaa
DTSTART:20070612T160000
DTEND:20070612T172000
DTSTAMP:20070613T112701
LOCATION:Aaa Aaaaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaaa aaa Aaaaa aa Aaaaaaaaaaaaaaa
DTSTART:20070612T110000
DTEND:20070612T115000
DTSTAMP:20070613T112701
CATEGORIES:Aaaaaaaaaäa Aaaaaaaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaa aaaaaaaaaaaa
DTSTART:20070614T100000
DTEND:20070614T110000
DTSTAMP:20070613T112701
CATEGORIES:Aaaaaäaaaaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:AA/Aaaaaa Aa Aaaaaaa 1.1.1 aaaaaaaaaa (Aaaaa Aaaa Aaaaa)
DTSTART:20070611T180000
DTEND:20070611T181500
DTSTAMP:20070613T112702
CATEGORIES:Aaaaaa Aaaaaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:Üaaaa aaaaaaaaa aaa
DTSTART:20070611T160000
DTEND:20070611T180000
DTSTAMP:20070613T112702
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaa aöaaaaaa aaaaaaaa
DTSTART:20070611T140000
DTEND:20070611T180000
DTSTAMP:20070613T112702
DESCRIPTION:Aaaaaaaa Aaaaaa Aaaaaa\nA-Aaaaa aaaaaaaaaa\nAa Aaaaaa aaaa
aaa\nAa Aaaaaaa-Aaaa-Aaaaa aaaaaaaaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaa aaa Aaaa aaa Aaaaa
DTSTART:20070611T131500
DTEND:20070611T134500
DTSTAMP:20070613T112702
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aa Aaaaaaaaaaa Aaaa Aaaaaaa aa. Aaaaaa aaaaaaaaa Aaaaaaaaaaaaa
a
DTSTART:20101124T133000
DTEND:20101124T140000
DTSTAMP:20101123T221234
LOCATION:A1.111
DESCRIPTION:Aaaaaaaaaaaaaaaaaa\nAaaaaaaaaaaaa, aaaa aa aaaa aa aaa Aaa
aaaaaaaaaaaaa aaaaaaa, aüaa Aaaaäaaaaa Aaa\n\nAaa Aaaaaaa, aaaa Aaaaaa
aäaaaaaa Aaaaa Aaaaaaaaaaa\n\nAaaaaaaa aaa A-Aaaa aa Aaaaaa Aaaaa AA
AAAAAAA "aaaaaa:aaaaaaa@aaaa.aaa-aaaaaaaaa.aa" aaaaaaa@aaaa.aaa-aaaaaa
aaa.aa aaaa aaa aaa Aaaaaaa
CLASS:PRIVATE
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaaa aaa Aaaaaaäaaaaaaaa Aaaaaaa
DTSTART:20110106T140000
DTEND:20110106T150000
DTSTAMP:20101207T215936
LOCATION:Aaaaaaaaaäa Aaaaaaaaa - A1.111
DESCRIPTION:Aaa Aaaaaa aaaaaa aaaa aaa aaaaa aaaaaaaaaa: \n* Aaaaaaaaa
aaaaa aaa Aaaaaaa aaa Aaaaaaaaaa - Aaaaa aaa Aaaaaaaaa, Aaaaaaaaaaa aa
aäß aaa Aaäaaaaaaaaaaaaaaaaaa \n* Aaaaa aaa Aaaaaaaaa aaa Aaaaaaaaaaaa
aaa Aaäaaaaaa aaa Aaaaaaaaaaaaaaaa - Aaaaaaaaaaaaaaaaößaa, Aaaaaaaaaa
aaaaaa aaa aaaßaa Aaaaaaaaaaaaaaa \n* A-Aaaaaaaa-Aaaaaaaaa aaa Aaaaaaa
aaa, Aaaaaaaaaa Aaaaaaaaaaaaaaaaa aaa aaaAA-Aaaaaaaaa, Aaaaaaaaaaaaaaa
aa Aaaaaa \n* Aaaaaaaaaaaaa aaa Aaaaaaaaaaaaaaaa aaa 11.11.1111 aaa Aa
aaaa aaa aaa Aaaaaaaaa Aaaaaaaaaaaaaa - Aaaaaaaaa Aaaaa, Aaaaaaa Aaaaa
aaa \n* Aaaaaaaaaaaaaa aüa Aaaaaaaaaaaaäaaa
CATEGORIES:AAAA 1111/1111
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaaaaaaa Aaaa
DTSTART:20110108T140000
DTEND:20110109T000000
DTSTAMP:20101230T124751
LOCATION:Aaaaaaa
DESCRIPTION:Aaa aaa aa aaa 1 Aaaaaaa aaaaaa aaaaaa (aaaaaa)\n- aaaaaa
aaaaaaaaaa, aaaaaaa aaaaaaaa\n- aaaa aaaaaa aaaaaaa\n- aaa aaaaaaaa aa
aaa aäaaaaaa aaaa aaaaaaaaaa\n- aa aaaaaa aaaaaaaa aaaa aa aaaa aaaa.
aaaaaaaaa, aaaaaaaa aaaaaa aaa aa
BEGIN:VALARM
TRIGGER:-PT4320M
DESCRIPTION:Aaaaa: Aaaaaaaaaaa Aaaa
ACTION:DISPLAY
END:VALARM
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaa - Aaa Aaaaaaa (aaa Aaaaaa aaa Aaaaaa)
DTSTART:20101228T201500
DTEND:20101228T211500
DTSTAMP:20101230T145020
LOCATION:Aaaa Aaaaaaaa
CATEGORIES:Aaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaaa aaaaaaa
DTSTART:20110104T190000
DTEND:20110104T200000
DTSTAMP:20110101T134833
CLASS:PRIVATE
BEGIN:VALARM
TRIGGER:-PT15M
DESCRIPTION:Aaaaa: Aaaaaaa aaaaaaa
ACTION:DISPLAY
END:VALARM
END:VEVENT
BEGIN:VEVENT
SUMMARY:AA/Aaaaa Aüa aaaaaa Aaaaaaaa aaaaaaaaaaaa
DTSTART:20101230T140000
DTEND:20101230T143000
DTSTAMP:20110101T134922
CATEGORIES:Aaaaaa Aaaaaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:AA/Aaaaa Aaaaaaaaaaaaa aaa Aaa
DTSTART:20101231T112000
DTEND:20101231T140500
DTSTAMP:20110101T135020
DESCRIPTION:Aaaaaaaaaaa aaa Aaaaaäaaa aaaa Aaaaa aaaaaaaaaaaa aaa aaaa
äaa\nA-Aaaa-Aaaaaaaa aaa Aaaa Aaaaaaaa aaa aaa aaaa aaa Aaaa Aaaaüaaa
üaaaaaaaaa\nAaaaaaa aaa Aaaaaaaaaaaaaaaaa aa aaa Aaaaaaaa aaaa Aaaaaaa
aa aaa A-Aaaaa aaaaaaaaaa\nAaa Aaaa Aaaaaaaa aaaaaaaaaa aaa Aaaaaaaaa
aaaaaaaaa\nAaaaaaaaaaaaaaaa Aaaaaaaa
CATEGORIES:Aaaaaa Aaaaaaa
END:VEVENT
BEGIN:VEVENT
SUMMARY:Aaaaaaa aaa aaa AAA, Aaaaa Aaaaaaaa aaa Aaaa aa aaa Aaaaaaa aa
a Aaaaaaaaaaaaaaaaaaaaaaaaa aaa Aaaaaaaaaa aaa Aaaaaaaaaa aa aaaaaaaaa
a
DTSTART:20110111T140000
DTEND:20110111T160000
DTSTAMP:20110111T220245
LOCATION:Aaaaaaaaaäa Aaaaaaaaa - AAA, Aüaa aaa Aaaa Aaaaaa
CATEGORIES:AAAA 1111/1111
END:VEVENT
END:VCALENDAR