Fixes to the RFC 5789 PATCH implementation found by review of the
rfc-5789-http-patch branch:
- nextcloud/webdav_handler.rs::handle_patch now enforces storage quota
before committing, matching the plain WebDAV surface (was a quota
bypass via the NextCloud endpoint).
- The plain surface's If-Match/If-None-Match comparison reused a
hand-rolled single-value strong compare that mishandled weak (W/)
validators and multi-value lists. Moved the correct RFC 7232 helpers
(already used by the NC surface) into the shared handler file so both
surfaces use one conformant implementation.
- NC handle_patch resolved the target file via get_file_by_path, which
performs no authorization check, before any permission-gated call —
for a full-file-range patch this could leak size/ETag via 412/416
responses to a caller without Read on that file. Added the same
explicit authz.require(Read, ...) the plain surface already has.
- ingest_range_patch_to_cas capped the whole spliced stream (prefix +
edit + suffix) against direct_put_max_bytes, so PATCH became
permanently unusable on any file at or above that size regardless of
edit size. The cap now only bounds the edit itself.
- NC handle_patch had no active-lock guard, so a LOCK taken via
/webdav/ didn't protect the same file reached through
/remote.php/dav/. Now shares enforce_native_lock with the plain
surface.
- Added a re-check of the file's ETag immediately before the write on
both surfaces, narrowing (not eliminating — that would need
compare-and-swap support in the write path) the window in which two
concurrent PATCHes to disjoint ranges could silently clobber each
other.
- NC handle_patch returned 404 for a PATCH on a directory instead of
409 like the plain surface; now checks folder existence first.
- The Content-Length-vs-X-Update-Range span check only fired when
Content-Length was present, so a chunked-transfer body could silently
diverge from the declared span. ingest_range_patch_to_cas now counts
actual body bytes and validates against the declared span
regardless, discarding the ingested blob on mismatch.
M.Schmidt
c390a781bb