From 266c1fcb2d7b778c326880eb16b75bc9b6fd58f9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=B4me=20Chilliet?= Date: Tue, 14 Oct 2025 10:50:02 +0200 Subject: [PATCH 1/3] fix(dav): Restrict properties allowed object classes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Côme Chilliet --- apps/dav/lib/DAV/CustomPropertiesBackend.php | 21 +++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/apps/dav/lib/DAV/CustomPropertiesBackend.php b/apps/dav/lib/DAV/CustomPropertiesBackend.php index 0d20db6502e..a5a58afac92 100644 --- a/apps/dav/lib/DAV/CustomPropertiesBackend.php +++ b/apps/dav/lib/DAV/CustomPropertiesBackend.php @@ -550,6 +550,19 @@ class CustomPropertiesBackend implements BackendInterface { $valueType = self::PROPERTY_TYPE_HREF; $value = $value->getHref(); } else { + if (!is_object($value)) { + throw new DavException( + "Property \"$name\" has an invalid value of type " . gettype($value), + ); + } + if (!str_starts_with($value::class, 'Sabre\\DAV\\Xml\\Property\\') + && !str_starts_with($value::class, 'Sabre\\CalDAV\\Xml\\Property\\') + && !str_starts_with($value::class, 'Sabre\\CardDAV\\Xml\\Property\\') + && !str_starts_with($value::class, 'OCA\\DAV\\')) { + throw new DavException( + "Property \"$name\" has an invalid value of class " . $value::class, + ); + } $valueType = self::PROPERTY_TYPE_OBJECT; // serialize produces null character // these can not be properly stored in some databases and need to be replaced @@ -561,20 +574,22 @@ class CustomPropertiesBackend implements BackendInterface { /** * @return mixed|Complex|string */ - private function decodeValueFromDatabase(string $value, int $valueType) { + private function decodeValueFromDatabase(string $value, int $valueType): mixed { switch ($valueType) { case self::PROPERTY_TYPE_XML: return new Complex($value); case self::PROPERTY_TYPE_HREF: return new Href($value); case self::PROPERTY_TYPE_OBJECT: + if (!preg_match('/^O\:\d+\:\"(OCA\\\\DAV\\\\|Sabre\\\\(Cal|Card)?DAV\\\\Xml\\\\Property\\\\)/', $value)) { + throw new \LogicException('Found an object class serialized in DB that is not allowed'); + } // some databases can not handel null characters, these are custom encoded during serialization // this custom encoding needs to be first reversed before unserializing return unserialize(str_replace('\x00', chr(0), $value)); - case self::PROPERTY_TYPE_STRING: default: return $value; - } + }; } private function encodeDefaultCalendarUrl(Href $value): Href { From 8d216a7fdffe5fc576216499fbb20a457e125718 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=B4me=20Chilliet?= Date: Tue, 14 Oct 2025 17:50:53 +0200 Subject: [PATCH 2/3] fix(dav): Allow arrays (of scalars) in property values MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Côme Chilliet --- apps/dav/lib/DAV/CustomPropertiesBackend.php | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/apps/dav/lib/DAV/CustomPropertiesBackend.php b/apps/dav/lib/DAV/CustomPropertiesBackend.php index a5a58afac92..649297c7688 100644 --- a/apps/dav/lib/DAV/CustomPropertiesBackend.php +++ b/apps/dav/lib/DAV/CustomPropertiesBackend.php @@ -550,7 +550,16 @@ class CustomPropertiesBackend implements BackendInterface { $valueType = self::PROPERTY_TYPE_HREF; $value = $value->getHref(); } else { - if (!is_object($value)) { + if (is_array($value)) { + // For array only allow scalar values + foreach ($value as $item) { + if (!is_scalar($item)) { + throw new DavException( + "Property \"$name\" has an invalid value of array containing " . gettype($value), + ); + } + } + } elseif (!is_object($value)) { throw new DavException( "Property \"$name\" has an invalid value of type " . gettype($value), ); @@ -581,6 +590,10 @@ class CustomPropertiesBackend implements BackendInterface { case self::PROPERTY_TYPE_HREF: return new Href($value); case self::PROPERTY_TYPE_OBJECT: + if (preg_match('/^a:/', $value)) { + // Array, unserialize only scalar values + return unserialize(str_replace('\x00', chr(0), $value), ['allowed_classes' => false]); + } if (!preg_match('/^O\:\d+\:\"(OCA\\\\DAV\\\\|Sabre\\\\(Cal|Card)?DAV\\\\Xml\\\\Property\\\\)/', $value)) { throw new \LogicException('Found an object class serialized in DB that is not allowed'); } From 696a238d32194632f4bc28d89fe4e4b64310c358 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=B4me=20Chilliet?= Date: Thu, 16 Oct 2025 09:32:23 +0200 Subject: [PATCH 3/3] fix(dav): Allow array of array of scalars, and fix error message MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Côme Chilliet --- apps/dav/lib/DAV/CustomPropertiesBackend.php | 37 ++++++++++++-------- 1 file changed, 22 insertions(+), 15 deletions(-) diff --git a/apps/dav/lib/DAV/CustomPropertiesBackend.php b/apps/dav/lib/DAV/CustomPropertiesBackend.php index 649297c7688..3afa53dfe68 100644 --- a/apps/dav/lib/DAV/CustomPropertiesBackend.php +++ b/apps/dav/lib/DAV/CustomPropertiesBackend.php @@ -516,6 +516,18 @@ class CustomPropertiesBackend implements BackendInterface { return $path; } + private static function checkIsArrayOfScalar(string $name, array $array): void { + foreach ($array as $item) { + if (is_array($item)) { + self::checkIsArrayOfScalar($name, $item); + } elseif ($item !== null && !is_scalar($item)) { + throw new DavException( + "Property \"$name\" has an invalid value of array containing " . gettype($item), + ); + } + } + } + /** * @throws ParseException If parsing a \Sabre\DAV\Xml\Property\Complex value fails * @throws DavException If the property value is invalid @@ -552,25 +564,20 @@ class CustomPropertiesBackend implements BackendInterface { } else { if (is_array($value)) { // For array only allow scalar values - foreach ($value as $item) { - if (!is_scalar($item)) { - throw new DavException( - "Property \"$name\" has an invalid value of array containing " . gettype($value), - ); - } - } + self::checkIsArrayOfScalar($name, $value); } elseif (!is_object($value)) { throw new DavException( "Property \"$name\" has an invalid value of type " . gettype($value), ); - } - if (!str_starts_with($value::class, 'Sabre\\DAV\\Xml\\Property\\') - && !str_starts_with($value::class, 'Sabre\\CalDAV\\Xml\\Property\\') - && !str_starts_with($value::class, 'Sabre\\CardDAV\\Xml\\Property\\') - && !str_starts_with($value::class, 'OCA\\DAV\\')) { - throw new DavException( - "Property \"$name\" has an invalid value of class " . $value::class, - ); + } else { + if (!str_starts_with($value::class, 'Sabre\\DAV\\Xml\\Property\\') + && !str_starts_with($value::class, 'Sabre\\CalDAV\\Xml\\Property\\') + && !str_starts_with($value::class, 'Sabre\\CardDAV\\Xml\\Property\\') + && !str_starts_with($value::class, 'OCA\\DAV\\')) { + throw new DavException( + "Property \"$name\" has an invalid value of class " . $value::class, + ); + } } $valueType = self::PROPERTY_TYPE_OBJECT; // serialize produces null character