From ad0fca4abdcd7768e52b05519a585fcb9e23e808 Mon Sep 17 00:00:00 2001 From: Anna Larch Date: Wed, 6 Jul 2022 19:16:38 +0200 Subject: [PATCH 1/2] Check calendar URI length before creation Signed-off-by: Anna Larch --- apps/dav/lib/CalDAV/CalDavBackend.php | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/apps/dav/lib/CalDAV/CalDavBackend.php b/apps/dav/lib/CalDAV/CalDavBackend.php index b2a902a3b225f..76b04636f3a4e 100644 --- a/apps/dav/lib/CalDAV/CalDavBackend.php +++ b/apps/dav/lib/CalDAV/CalDavBackend.php @@ -63,6 +63,7 @@ use OCA\DAV\Events\SubscriptionCreatedEvent; use OCA\DAV\Events\SubscriptionDeletedEvent; use OCA\DAV\Events\SubscriptionUpdatedEvent; +use OCP\Calendar\Exceptions\CalendarException; use OCP\DB\QueryBuilder\IQueryBuilder; use OCP\EventDispatcher\IEventDispatcher; use OCP\IConfig; @@ -793,8 +794,14 @@ public function getSubscriptionById($subscriptionId) { * @param string $calendarUri * @param array $properties * @return int + * + * @throws CalendarException */ public function createCalendar($principalUri, $calendarUri, array $properties) { + if (strlen($calendarUri) > 255) { + throw new CalendarException('URI too long. Calendar not created'); + } + $values = [ 'principaluri' => $this->convertPrincipal($principalUri, true), 'uri' => $calendarUri, From 992e05ecba26e6bb760de25a8c7e6e3ec75b6731 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Fri, 26 Aug 2022 13:58:18 +0200 Subject: [PATCH 2/2] Check address book URI length before creation Signed-off-by: Joas Schilling --- apps/dav/lib/CardDAV/CardDavBackend.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apps/dav/lib/CardDAV/CardDavBackend.php b/apps/dav/lib/CardDAV/CardDavBackend.php index 1c1754ff752f3..ebbf44376f57f 100644 --- a/apps/dav/lib/CardDAV/CardDavBackend.php +++ b/apps/dav/lib/CardDAV/CardDavBackend.php @@ -416,6 +416,10 @@ public function updateAddressBook($addressBookId, \Sabre\DAV\PropPatch $propPatc * @throws BadRequest */ public function createAddressBook($principalUri, $url, array $properties) { + if (strlen($url) > 255) { + throw new BadRequest('URI too long. Address book not created'); + } + $values = [ 'displayname' => null, 'description' => null,