From ce77dae043aecfe55a675cbbec6b98702f14e31a Mon Sep 17 00:00:00 2001
From: Andrew McMillan <andrew@morphoss.com>
Date: Fri, 7 Oct 2011 08:27:02 +0200
Subject: [PATCH] Fail more gracefully on crap encoding input.

---
 inc/CalDAVRequest.php                         |  86 +++---
 .../0546-iCLoud-PUT-encoded-fail.result       |  11 +
 .../0546-iCLoud-PUT-encoded-fail.test         |  14 +
 testing/tests/regression-suite/utf8-test.data | 278 ++++++++++++++++++
 4 files changed, 348 insertions(+), 41 deletions(-)
 create mode 100644 testing/tests/regression-suite/0546-iCLoud-PUT-encoded-fail.result
 create mode 100644 testing/tests/regression-suite/0546-iCLoud-PUT-encoded-fail.test
 create mode 100644 testing/tests/regression-suite/utf8-test.data

diff --git a/inc/CalDAVRequest.php b/inc/CalDAVRequest.php
index 1eecbec0..3eedab18 100644
--- a/inc/CalDAVRequest.php
+++ b/inc/CalDAVRequest.php
@@ -114,28 +114,60 @@ class CalDAVRequest
     $this->options = $options;
     if ( !isset($this->options['allow_by_email']) ) $this->options['allow_by_email'] = false;
 
+    /**
+    * Our path is /<script name>/<user name>/<user controlled> if it ends in
+    * a trailing '/' then it is referring to a DAV 'collection' but otherwise
+    * it is referring to a DAV data item.
+    *
+    * Permissions are controlled as follows:
+    *  1. if there is no <user name> component, the request has read privileges
+    *  2. if the requester is an admin, the request has read/write priviliges
+    *  3. if there is a <user name> component which matches the logged on user
+    *     then the request has read/write privileges
+    *  4. otherwise we query the defined relationships between users and use
+    *     the minimum privileges returned from that analysis.
+    */
+    $this->path = (isset($_SERVER['PATH_INFO']) ? $_SERVER['PATH_INFO'] : "/");
+    $this->path = rawurldecode($this->path);
+
+    /** Allow a request for .../calendar.ics to translate into the calendar URL */
+    if ( preg_match( '#^(/[^/]+/[^/]+).ics$#', $this->path, $matches ) ) {
+      $this->path = $matches[1]. '/';
+    }
+
+    // dbg_error_log( "caldav", "Sanitising path '%s'", $this->path );
+    $bad_chars_regex = '/[\\^\\[\\(\\\\]/';
+    if ( preg_match( $bad_chars_regex, $this->path ) ) {
+      $this->DoResponse( 400, translate("The calendar path contains illegal characters.") );
+    }
+    if ( strstr($this->path,'//') ) $this->path = preg_replace( '#//+#', '/', $this->path);
+
     if ( !isset($c->raw_post) ) $c->raw_post = file_get_contents( 'php://input');
     if ( isset($_SERVER['HTTP_CONTENT_ENCODING']) ) {
-      @dbg_error_log('caldav', 'Content-Encoding: %s', $_SERVER['HTTP_CONTENT_ENCODING'] );
-      switch( $_SERVER['HTTP_CONTENT_ENCODING'] ) {
+      $encoding = $_SERVER['HTTP_CONTENT_ENCODING'];
+      @dbg_error_log('caldav', 'Content-Encoding: %s', $encoding );
+      $encoding = preg_replace('{[^a-z0-9-]}i','',$encoding);
+      if ( ! ini_get('open_basedir') && (isset($c->dbg['ALL']) || isset($c->dbg['caldav'])) ) {
+        $fh = fopen('/tmp/encoded_data.'.$encoding,'w');
+        if ( $fh ) {
+          fwrite($fh,$c->raw_post);
+          fclose($fh);
+        }
+      }
+      switch( $encoding ) {
         case 'gzip':
-          $this->raw_post = gzdecode($c->raw_post);
+          $this->raw_post = @gzdecode($c->raw_post);
           break;
         case 'deflate':
-          $this->raw_post = gzinflate($c->raw_post);
+          $this->raw_post = @gzinflate($c->raw_post);
           break;
         case 'compress':
-          $this->raw_post = gzuncompress($c->raw_post);
+          $this->raw_post = @gzuncompress($c->raw_post);
           break;
         default:
-          if ( ! ini_get('open_basedir') && (isset($c->dbg['ALL']) || isset($c->dbg['caldav'])) ) {
-            $fh = fopen('/tmp/raw_post','w');
-            if ( $fh ) {
-              fwrite($fh,$request->raw_post);
-              fclose($fh);
-            }
-          }
-          $this->PreconditionFailed(402, 'content-encoding', 'This server does not presently support content encoded with "%s"', $_SERVER['HTTP_CONTENT_ENCODING']);
+      }
+      if ( empty($this->raw_post) && !empty($c->raw_post) ) {
+        $this->PreconditionFailed(415, 'content-encoding', sprintf('Unable to decode "%s" content encoding.', $_SERVER['HTTP_CONTENT_ENCODING']));
       }
       $c->raw_post = $this->raw_post;
     }
@@ -244,34 +276,6 @@ class CalDAVRequest
       if ( ! isset($this->timeout) || $this->timeout == 0 ) $this->timeout = (isset($c->default_lock_timeout) ? $c->default_lock_timeout : 900);
     }
 
-    /**
-    * Our path is /<script name>/<user name>/<user controlled> if it ends in
-    * a trailing '/' then it is referring to a DAV 'collection' but otherwise
-    * it is referring to a DAV data item.
-    *
-    * Permissions are controlled as follows:
-    *  1. if there is no <user name> component, the request has read privileges
-    *  2. if the requester is an admin, the request has read/write priviliges
-    *  3. if there is a <user name> component which matches the logged on user
-    *     then the request has read/write privileges
-    *  4. otherwise we query the defined relationships between users and use
-    *     the minimum privileges returned from that analysis.
-    */
-    $this->path = (isset($_SERVER['PATH_INFO']) ? $_SERVER['PATH_INFO'] : "/");
-    $this->path = rawurldecode($this->path);
-
-    /** Allow a request for .../calendar.ics to translate into the calendar URL */
-    if ( preg_match( '#^(/[^/]+/[^/]+).ics$#', $this->path, $matches ) ) {
-      $this->path = $matches[1]. '/';
-    }
-
-    // dbg_error_log( "caldav", "Sanitising path '%s'", $this->path );
-    $bad_chars_regex = '/[\\^\\[\\(\\\\]/';
-    if ( preg_match( $bad_chars_regex, $this->path ) ) {
-      $this->DoResponse( 400, translate("The calendar path contains illegal characters.") );
-    }
-    if ( strstr($this->path,'//') ) $this->path = preg_replace( '#//+#', '/', $this->path);
-
     $this->principal = new Principal('path',$this->path);
 
     /**
diff --git a/testing/tests/regression-suite/0546-iCLoud-PUT-encoded-fail.result b/testing/tests/regression-suite/0546-iCLoud-PUT-encoded-fail.result
new file mode 100644
index 00000000..73d03c75
--- /dev/null
+++ b/testing/tests/regression-suite/0546-iCLoud-PUT-encoded-fail.result
@@ -0,0 +1,11 @@
+HTTP/1.1 415 Unsupported Media Type
+Date: Dow, 01 Jan 2000 00:00:00 GMT
+DAV: 1, 2, 3, access-control, calendar-access, calendar-schedule
+DAV: extended-mkcol, calendar-proxy, bind, addressbook, calendar-auto-schedule
+Content-Length: 135
+Content-Type: text/xml; charset="utf-8"
+
+<?xml version="1.0" encoding="utf-8" ?>
+<error xmlns="DAV:">
+  <content-encoding/>Unable to decode "deflate" content encoding.
+</error>
\ No newline at end of file
diff --git a/testing/tests/regression-suite/0546-iCLoud-PUT-encoded-fail.test b/testing/tests/regression-suite/0546-iCLoud-PUT-encoded-fail.test
new file mode 100644
index 00000000..76071893
--- /dev/null
+++ b/testing/tests/regression-suite/0546-iCLoud-PUT-encoded-fail.test
@@ -0,0 +1,14 @@
+#
+# Testing with a process similar to iCal4
+#
+TYPE=PUT
+URL=http://regression.host/caldav.php/user1/home/0546-deflate-PUT.ics
+HEAD
+
+HEADER=DAVKit/4.0 (729); CalendarStore/4.0 (965); iCal/4.0 (1362); Mac OS X/10.6.1 (10B504)
+HEADER=Content-Type: text/calendar
+HEADER=Content-Encoding: deflate
+
+#
+#
+DATA=0544-gzip-PUT
diff --git a/testing/tests/regression-suite/utf8-test.data b/testing/tests/regression-suite/utf8-test.data
new file mode 100644
index 00000000..2470dc43
--- /dev/null
+++ b/testing/tests/regression-suite/utf8-test.data
@@ -0,0 +1,278 @@
+BEGIN:VCALENDAR
+VERSION:2.0
+PRODID:-//RSB//FreeMiCal//EN
+BEGIN:VEVENT
+SUMMARY:Aüa Aaaaaa aaa Aaaaa aaa Aaaaaaaaa-Aaaaüa aaaaaaa aa. Aaaaaaaa
+DTSTART;VALUE=DATE:20071111
+DTEND;VALUE=DATE:20071112
+DTSTAMP:20070613T112658
+DESCRIPTION:Aaaaa Aaaa aa 11.11.11 aaaaaaaaa/aaäaßaaa\n\n
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaa1111 - aaaaaaaaaaa aaaaaaaaaaa aaa aaaaaa
+DTSTART;VALUE=DATE:20070915
+DTEND;VALUE=DATE:20070916
+DTSTAMP:20070613T112658
+LOCATION:Aaaaaa/Aaa
+DESCRIPTION:Aaaaaaaaaa aa 11.11.1111 aaa aaaaaaa@a-aaaaaaa.aa\nAaaaaaa
+ aaaaaaaa üaaa aaaaaaa@aaaaaaaa.aa\n\n
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:AAA'11
+DTSTART;VALUE=DATE:20070824
+DTEND;VALUE=DATE:20070825
+DTSTAMP:20070613T112658
+LOCATION:Aaa Aöaaa, Aaaaaaaaa
+DESCRIPTION:aaaa://aaa.aaa11.aa/\n\n
+CATEGORIES:Aaaaaaa Aaaaaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaaa Aaaaaaaaaaaaaaäa
+DTSTART:20070820T090000
+DTEND:20070820T151500
+DTSTAMP:20070613T112659
+CATEGORIES:Aaaaaaaaaäa Aaaaaaaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaa Aaaaaaaaaaaaaa
+DTSTART;VALUE=DATE:20070713
+DTEND;VALUE=DATE:20070714
+DTSTAMP:20070613T112659
+CATEGORIES:Aaaaaaaaaäa Aaaaaaaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaaa aaa Aaaaa
+DTSTART:20070710T093000
+DTEND:20070710T120000
+DTSTAMP:20070613T112659
+CATEGORIES:Aaaaaaaaaäa Aaaaaaaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaa Aaaaaaa
+DTSTART;VALUE=DATE:20070630
+DTEND;VALUE=DATE:20070701
+DTSTAMP:20070613T112659
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaa Aaaaaaaaaaaaa
+DTSTART;VALUE=DATE:20070629
+DTEND;VALUE=DATE:20070630
+DTSTAMP:20070613T112659
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaa Aaaaaaaaaaaa
+DTSTART:20070628T193000
+DTEND:20070628T223000
+DTSTAMP:20070613T112659
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaa aaaaa aa Aaaaaaaaa, aa Aaaaa+Aaaa aa aaa Aaaaa
+DTSTART;VALUE=DATE:20070628
+DTEND;VALUE=DATE:20070629
+DTSTAMP:20070613T112659
+DESCRIPTION:-A.A. Aaaaaaaöaaaaaa aaa Aaaaaaaaa Aaaaaaaaa (aaaaaa)\n-\n
+ \n
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaaaaaaa
+DTSTART:20070627T154500
+DTEND:20070627T234500
+DTSTAMP:20070613T112659
+LOCATION:Aaaaaaaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaaaaaa aaa AaaaAaaaaa-Aaaaaaa
+DTSTART;VALUE=DATE:20070616
+DTEND;VALUE=DATE:20070617
+DTSTAMP:20070613T112700
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaa Aaaaaa
+DTSTART;VALUE=DATE:20070615
+DTEND;VALUE=DATE:20070618
+DTSTAMP:20070613T112700
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaa aa aaa Aüaaaa aaa Aaa aaa Aaaa
+DTSTART;VALUE=DATE:20070614
+DTEND;VALUE=DATE:20070622
+DTSTAMP:20070613T112700
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaaaaa
+DTSTART:20070613T180000
+DTEND:20070613T203000
+DTSTAMP:20070613T112700
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaaaaa aaa Aaaa
+DTSTART:20070613T100000
+DTEND:20070613T111000
+DTSTAMP:20070613T112700
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaaaaa
+DTSTART:20070612T180000
+DTEND:20070612T200000
+DTSTAMP:20070613T112700
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:AaaAaa11-Aaaaaaaaaaäaaaaaaaaa
+DTSTART:20070612T180000
+DTEND:20070612T210000
+DTSTAMP:20070613T112700
+CATEGORIES:Aaaaaaaaaäa Aaaaaaaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaaa aaa AaaAaa-Aaaaaaa
+DTSTART:20070612T180000
+DTEND:20070612T183000
+DTSTAMP:20070613T112701
+LOCATION:AaaAaa-Aaaa aaa Aaaaaaaaa
+CATEGORIES:Aaaaaaaaaäa Aaaaaaaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaa Aaaaa Aaaaaa aaaaaaaaa
+DTSTART:20070612T160000
+DTEND:20070612T172000
+DTSTAMP:20070613T112701
+LOCATION:Aaa Aaaaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaaa aaa Aaaaa aa Aaaaaaaaaaaaaaa
+DTSTART:20070612T110000
+DTEND:20070612T115000
+DTSTAMP:20070613T112701
+CATEGORIES:Aaaaaaaaaäa Aaaaaaaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaa aaaaaaaaaaaa
+DTSTART:20070614T100000
+DTEND:20070614T110000
+DTSTAMP:20070613T112701
+CATEGORIES:Aaaaaäaaaaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:AA/Aaaaaa Aa Aaaaaaa 1.1.1 aaaaaaaaaa (Aaaaa Aaaa Aaaaa)
+DTSTART:20070611T180000
+DTEND:20070611T181500
+DTSTAMP:20070613T112702
+CATEGORIES:Aaaaaa Aaaaaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Üaaaa aaaaaaaaa aaa
+DTSTART:20070611T160000
+DTEND:20070611T180000
+DTSTAMP:20070613T112702
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaa aöaaaaaa aaaaaaaa
+DTSTART:20070611T140000
+DTEND:20070611T180000
+DTSTAMP:20070613T112702
+DESCRIPTION:Aaaaaaaa Aaaaaa Aaaaaa\nA-Aaaaa aaaaaaaaaa\nAa Aaaaaa aaaa
+ aaa\nAa Aaaaaaa-Aaaa-Aaaaa aaaaaaaaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaa aaa Aaaa aaa Aaaaa
+DTSTART:20070611T131500
+DTEND:20070611T134500
+DTSTAMP:20070613T112702
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aa Aaaaaaaaaaa Aaaa Aaaaaaa aa. Aaaaaa aaaaaaaaa Aaaaaaaaaaaaa
+ a
+DTSTART:20101124T133000
+DTEND:20101124T140000
+DTSTAMP:20101123T221234
+LOCATION:A1.111
+DESCRIPTION:Aaaaaaaaaaaaaaaaaa\nAaaaaaaaaaaaa, aaaa aa aaaa aa aaa Aaa
+ aaaaaaaaaaaaa aaaaaaa, aüaa Aaaaäaaaaa Aaa\n\nAaa Aaaaaaa, aaaa Aaaaaa
+  aäaaaaaa Aaaaa Aaaaaaaaaaa\n\nAaaaaaaa aaa A-Aaaa aa Aaaaaa Aaaaa  AA
+ AAAAAAA "aaaaaa:aaaaaaa@aaaa.aaa-aaaaaaaaa.aa" aaaaaaa@aaaa.aaa-aaaaaa
+ aaa.aa aaaa aaa aaa Aaaaaaa
+CLASS:PRIVATE
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaaa aaa Aaaaaaäaaaaaaaa Aaaaaaa
+DTSTART:20110106T140000
+DTEND:20110106T150000
+DTSTAMP:20101207T215936
+LOCATION:Aaaaaaaaaäa Aaaaaaaaa - A1.111
+DESCRIPTION:Aaa Aaaaaa aaaaaa aaaa aaa aaaaa aaaaaaaaaa: \n* Aaaaaaaaa
+ aaaaa aaa Aaaaaaa aaa Aaaaaaaaaa - Aaaaa aaa Aaaaaaaaa, Aaaaaaaaaaa aa
+ aäß aaa Aaäaaaaaaaaaaaaaaaaaa \n* Aaaaa aaa Aaaaaaaaa aaa Aaaaaaaaaaaa
+  aaa Aaäaaaaaa aaa Aaaaaaaaaaaaaaaa - Aaaaaaaaaaaaaaaaößaa, Aaaaaaaaaa
+ aaaaaa aaa aaaßaa Aaaaaaaaaaaaaaa \n* A-Aaaaaaaa-Aaaaaaaaa aaa Aaaaaaa
+ aaa, Aaaaaaaaaa Aaaaaaaaaaaaaaaaa aaa aaaAA-Aaaaaaaaa, Aaaaaaaaaaaaaaa
+ aa Aaaaaa \n* Aaaaaaaaaaaaa aaa Aaaaaaaaaaaaaaaa aaa 11.11.1111 aaa Aa
+ aaaa aaa aaa Aaaaaaaaa Aaaaaaaaaaaaaa - Aaaaaaaaa Aaaaa, Aaaaaaa Aaaaa
+ aaa \n* Aaaaaaaaaaaaaa aüa Aaaaaaaaaaaaäaaa
+CATEGORIES:AAAA 1111/1111
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaaaaaaa Aaaa
+DTSTART:20110108T140000
+DTEND:20110109T000000
+DTSTAMP:20101230T124751
+LOCATION:Aaaaaaa
+DESCRIPTION:Aaa aaa aa aaa 1 Aaaaaaa aaaaaa aaaaaa (aaaaaa)\n- aaaaaa 
+ aaaaaaaaaa, aaaaaaa aaaaaaaa\n- aaaa aaaaaa aaaaaaa\n- aaa aaaaaaaa aa
+  aaa aäaaaaaa aaaa aaaaaaaaaa\n- aa aaaaaa aaaaaaaa aaaa aa aaaa aaaa.
+  aaaaaaaaa, aaaaaaaa aaaaaa aaa aa
+BEGIN:VALARM
+TRIGGER:-PT4320M
+DESCRIPTION:Aaaaa: Aaaaaaaaaaa Aaaa
+ACTION:DISPLAY
+END:VALARM
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaa - Aaa Aaaaaaa (aaa Aaaaaa aaa Aaaaaa)
+DTSTART:20101228T201500
+DTEND:20101228T211500
+DTSTAMP:20101230T145020
+LOCATION:Aaaa Aaaaaaaa
+CATEGORIES:Aaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaaa aaaaaaa
+DTSTART:20110104T190000
+DTEND:20110104T200000
+DTSTAMP:20110101T134833
+CLASS:PRIVATE
+BEGIN:VALARM
+TRIGGER:-PT15M
+DESCRIPTION:Aaaaa: Aaaaaaa aaaaaaa
+ACTION:DISPLAY
+END:VALARM
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:AA/Aaaaa Aüa aaaaaa Aaaaaaaa aaaaaaaaaaaa
+DTSTART:20101230T140000
+DTEND:20101230T143000
+DTSTAMP:20110101T134922
+CATEGORIES:Aaaaaa Aaaaaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:AA/Aaaaa Aaaaaaaaaaaaa aaa Aaa
+DTSTART:20101231T112000
+DTEND:20101231T140500
+DTSTAMP:20110101T135020
+DESCRIPTION:Aaaaaaaaaaa aaa Aaaaaäaaa aaaa Aaaaa aaaaaaaaaaaa aaa aaaa
+ äaa\nA-Aaaa-Aaaaaaaa aaa Aaaa Aaaaaaaa aaa aaa aaaa aaa Aaaa Aaaaüaaa 
+ üaaaaaaaaa\nAaaaaaa aaa Aaaaaaaaaaaaaaaaa aa aaa Aaaaaaaa aaaa Aaaaaaa
+ aa aaa A-Aaaaa aaaaaaaaaa\nAaa Aaaa Aaaaaaaa aaaaaaaaaa aaa Aaaaaaaaa 
+ aaaaaaaaa\nAaaaaaaaaaaaaaaa Aaaaaaaa
+CATEGORIES:Aaaaaa Aaaaaaa
+END:VEVENT
+BEGIN:VEVENT
+SUMMARY:Aaaaaaa aaa aaa AAA, Aaaaa Aaaaaaaa aaa Aaaa aa aaa Aaaaaaa aa
+ a Aaaaaaaaaaaaaaaaaaaaaaaaa aaa Aaaaaaaaaa aaa Aaaaaaaaaa aa aaaaaaaaa
+ a
+DTSTART:20110111T140000
+DTEND:20110111T160000
+DTSTAMP:20110111T220245
+LOCATION:Aaaaaaaaaäa Aaaaaaaaa - AAA, Aüaa aaa Aaaa Aaaaaa
+CATEGORIES:AAAA 1111/1111
+END:VEVENT
+END:VCALENDAR