[ocis]Creating folder with & character makes the UI act weird

[SwikritiT]

Steps to reproduce

1. As user einstein create a folder folder through API

curl -vk -X MKCOL -u einstein:relativity 'https://host.docker.internal:9200/dav/spaces/1284d238-aa92-42ce-bdc4-0b0000009157$4c510ada-c86b-4815-8820-42cdf82c3d51/folder'   

2. Login as einstein and see the folder in the webui

It is displayed
3. Now create a folder named new&folder through API

curl -vk -X MKCOL -u einstein:relativity 'https://host.docker.internal:9200/dav/spaces/1284d238-aa92-42ce-bdc4-0b0000009157$4c510ada-c86b-4815-8820-42cdf82c3d51/new&folder'

*   Trying 127.0.0.1:9200...
* TCP_NODELAY set
* Connected to host.docker.internal (127.0.0.1) port 9200 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: O=Acme Corp; CN=OCIS
*  start date: Aug 25 11:22:43 2022 GMT
*  expire date: Aug 25 11:22:43 2023 GMT
*  issuer: O=Acme Corp; CN=OCIS
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* Server auth using Basic with user 'einstein'
> MKCOL /dav/spaces/1284d238-aa92-42ce-bdc4-0b0000009157$4c510ada-c86b-4815-8820-42cdf82c3d51/new&folder HTTP/1.1
> Host: host.docker.internal:9200
> Authorization: Basic ZWluc3RlaW46cmVsYXRpdml0eQ==
> User-Agent: curl/7.68.0
> Accept: */*
> 
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Mark bundle as not supporting multiuse
< HTTP/1.1 201 Created
< Access-Control-Allow-Origin: *
< Content-Length: 0
< Content-Security-Policy: default-src 'none';
< Date: Thu, 25 Aug 2022 11:24:52 GMT
< X-Content-Type-Options: nosniff
< X-Download-Options: noopen
< X-Frame-Options: SAMEORIGIN
< X-Permitted-Cross-Domain-Policies: none
< X-Robots-Tag: none
< X-Xss-Protection: 1; mode=block
< 
* Connection #0 to host host.docker.internal left intact

The folder gets created
4. Now reload the UI . It shows Resource not found

5. Upon looking at the network it gives me, I created two folders but only one is in the response

6. But upon PROPFIND through curl it gives correct response

<d:multistatus xmlns:s="http://sabredav.org/ns" xmlns:d="DAV:" xmlns:oc="http://owncloud.org/ns"><d:response><d:href>/dav/spaces/1284d238-aa92-42ce-bdc4-0b0000009157$4c510ada-c86b-4815-8820-42cdf82c3d51/</d:href><d:propstat><d:prop><oc:id>1284d238-aa92-42ce-bdc4-0b0000009157$4c510ada-c86b-4815-8820-42cdf82c3d51!4c510ada-c86b-4815-8820-42cdf82c3d51</oc:id><oc:fileid>1284d238-aa92-42ce-bdc4-0b0000009157$4c510ada-c86b-4815-8820-42cdf82c3d51!4c510ada-c86b-4815-8820-42cdf82c3d51</oc:fileid><oc:spaceid>4c510ada-c86b-4815-8820-42cdf82c3d51</oc:spaceid><d:getetag>&#34;783124389e537b46d74b478dd5562393&#34;</d:getetag><oc:permissions>RDNVCK</oc:permissions><d:resourcetype><d:collection/></d:resourcetype><oc:size>0</oc:size><d:getlastmodified>Thu, 25 Aug 2022 11:24:52 GMT</d:getlastmodified><oc:favorite>0</oc:favorite></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response><d:response><d:href>/dav/spaces/1284d238-aa92-42ce-bdc4-0b0000009157$4c510ada-c86b-4815-8820-42cdf82c3d51/new&amp;folder/</d:href><d:propstat><d:prop><oc:id>1284d238-aa92-42ce-bdc4-0b0000009157$4c510ada-c86b-4815-8820-42cdf82c3d51!c9a2c990-b880-4a08-bb17-af98b0acaf4e</oc:id><oc:fileid>1284d238-aa92-42ce-bdc4-0b0000009157$4c510ada-c86b-4815-8820-42cdf82c3d51!c9a2c990-b880-4a08-bb17-af98b0acaf4e</oc:fileid><oc:spaceid>4c510ada-c86b-4815-8820-42cdf82c3d51</oc:spaceid><oc:name>new&folder</oc:name><d:getetag>&#34;4a96bec058d0e6a889b88a7a61c47f56&#34;</d:getetag><oc:permissions>RDNVCK</oc:permissions><d:resourcetype><d:collection/></d:resourcetype><oc:size>0</oc:size><d:getlastmodified>Thu, 25 Aug 2022 11:24:52 GMT</d:getlastmodified><oc:favorite>0</oc:favorite></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response><d:response><d:href>/dav/spaces/1284d238-aa92-42ce-bdc4-0b0000009157$4c510ada-c86b-4815-8820-42cdf82c3d51/folder/</d:href><d:propstat><d:prop><oc:id>1284d238-aa92-42ce-bdc4-0b0000009157$4c510ada-c86b-4815-8820-42cdf82c3d51!27456602-8058-4f32-946f-0a5c16e8b987</oc:id><oc:fileid>1284d238-aa92-42ce-bdc4-0b0000009157$4c510a* Connection #0 to host host.docker.internal left intact
da-c86b-4815-8820-42cdf82c3d51!27456602-8058-4f32-946f-0a5c16e8b987</oc:fileid><oc:spaceid>4c510ada-c86b-4815-8820-42cdf82c3d51</oc:spaceid><oc:name>folder</oc:name><d:getetag>&#34;06afb140ed2f2488c320691250127845&#34;</d:getetag><oc:permissions>RDNVCK</oc:permissions><d:resourcetype><d:collection/></d:resourcetype><oc:size>0</oc:size><d:getlastmodified>Thu, 25 Aug 2022 11:24:06 GMT</d:getlastmodified><oc:favorite>0</oc:favorite></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response></d:multistatus>%  

7. Upon trying to create folder with & from webui it gives following error message

Expected behaviour

The folder should be displayed

Actual behaviour

As explained in the steps

Both ocis and web are latest master

[kulmann]

Creating a folder with & in the name works with ownCloud 10 as a backend. So this has to be an oCIS backend issue... moving to ocis repo.

[SwikritiT]

Api test added in this PR : owncloud/core#40376
Id bump is being done here: #4613

[phil-davis]

The test scenarios added in core PR owncloud/core#40376 are passing on both oC10 and oCIS. So the API is working OK for those particular cases that have an & in the file or folder name.

$ curl -v -u harry:harry -X MKCOL 'http://172.17.0.1:8080/remote.php/webdav/new&folder'
*   Trying 172.17.0.1:8080...
* TCP_NODELAY set
* Connected to 172.17.0.1 (172.17.0.1) port 8080 (#0)
* Server auth using Basic with user 'harry'
> MKCOL /remote.php/webdav/new&folder HTTP/1.1
> Host: 172.17.0.1:8080
> Authorization: Basic aGFycnk6aGFycnk=
> User-Agent: curl/7.68.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 201 Created
< Host: 172.17.0.1:8080
< Date: Tue, 20 Sep 2022 08:06:20 GMT
< Connection: close

I guess curl does whatever it does with the & - IMO it sends it as-is, without trying to escape it.

curl -v -u harry:harry -X MKCOL 'http://172.17.0.1:8080/remote.php/dav/files/Harry/new&folder2'
*   Trying 172.17.0.1:8080...
* TCP_NODELAY set
* Connected to 172.17.0.1 (172.17.0.1) port 8080 (#0)
* Server auth using Basic with user 'harry'
> MKCOL /remote.php/dav/files/Harry/new&folder2 HTTP/1.1
> Host: 172.17.0.1:8080
> Authorization: Basic aGFycnk6aGFycnk=
> User-Agent: curl/7.68.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 201 Created
< Host: 172.17.0.1:8080
< Date: Tue, 20 Sep 2022 08:11:41 GMT
< Connection: close

It works on oC10 and oCIS with both ways of doing the webDAV MKCOL request.

I suppose that web is using a request to the personal space, which is different to the examples above?

[rhafer]

The test scenarios added in core PR owncloud/core#40376 are passing on both oC10 and oCIS. So the API is working OK for those particular cases that have an & in the file or folder name.

AFAIU the test suite only request the d:getetag and d:resourcetype properties with PROPFIND request that checks for the presence of the new folder.
The bug is however caused by the <oc:name> property that was introduced with cs3org/reva#3158. It needs proper escaping. Working on a fix ...