async-caldav 1.2.0 → 1.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e23cfa0fc31bf66c4994ae8f4d8926c7bdafe3218e6fe6bfd528c8506953d090
-  data.tar.gz: 657db45a19ee2ef645d50c9ebfaa4c4884dbcd3438d0952fd13c78b9bdac42e4
+  metadata.gz: a322d3a753a3dbee66ebd1afa1e1d8d7c195b96a243c45e0593cbf4a1c64d93c
+  data.tar.gz: 377c6989fdc81a44d0e6999dbb012b633f1899e08b7cd33330d318f58c5e9aa0
 SHA512:
-  metadata.gz: 4ec7a0a7735fe520949cbda2fe9bc67b8deed47e08496fbd8e1a3d3ae1624be342373fd6d614693b494964ec3f8f5c2e1bbad619d2e9dbd9feca64d978a50fa1
-  data.tar.gz: ebc1e849267dc0cf28493e2530e54c7195e46e8db9526b9f1e9308cb55f172cd0b2738488c9162365f4096d09f349422d4d49b0e12c96ce98136f1c29a9c173f
+  metadata.gz: da4e219d79c691636fa2c6f13ca1f9f7a77bdee9e68005671494288c523115c14db068d585071bac19cd1f6c79b6723e186cbf81a185718225f4447c8b41a67d
+  data.tar.gz: b189f9332228946eb7da0ca7a5d23f28bbea5634ca1463661683c4b16328264ca15489a7f43f0c4bcd37737f6192c6c8dff9129d100dcec2c1a69ac99302fece

data/lib/async/caldav/client/addressbook.rb

@@ -2,6 +2,7 @@
 
 require "bundler/setup"
 require "scampi"
+require "builder"
 
 module Async
   module Caldav
@@ -16,22 +17,13 @@ module Async
         end
 
         def contacts(filter: nil)
-          body = if filter
-            <<~XML
-              <?xml version="1.0" encoding="UTF-8"?>
-              <cr:addressbook-query xmlns:d="DAV:" xmlns:cr="urn:ietf:params:xml:ns:carddav">
-                <d:prop><d:getetag/><cr:address-data/></d:prop>
-                #{filter}
-              </cr:addressbook-query>
-            XML
-          else
-            <<~XML
-              <?xml version="1.0" encoding="UTF-8"?>
-              <cr:addressbook-query xmlns:d="DAV:" xmlns:cr="urn:ietf:params:xml:ns:carddav">
-                <d:prop><d:getetag/><cr:address-data/></d:prop>
-              </cr:addressbook-query>
-            XML
+          x = Builder::XmlMarkup.new
+          x.instruct! :xml, version: "1.0", encoding: "UTF-8"
+          x.tag!("cr:addressbook-query", "xmlns:d" => "DAV:", "xmlns:cr" => "urn:ietf:params:xml:ns:carddav") do
+            x.tag!("d:prop") { x.tag!("d:getetag"); x.tag!("cr:address-data") }
+            x << filter if filter
           end
+          body = x.target!
 
           status, _, resp_body = @client.request('REPORT', @path, body: body, headers: { 'Content-Type' => 'text/xml' })
           raise Error, "REPORT failed: #{status}" unless status == 207
@@ -95,17 +87,17 @@ module Async
         end
 
         def proppatch(displayname: nil)
-          props = []
-          props << "<d:displayname>#{Protocol::Caldav::Xml.escape(displayname)}</d:displayname>" if displayname
-
-          body = <<~XML
-            <?xml version="1.0" encoding="UTF-8"?>
-            <d:propertyupdate xmlns:d="DAV:">
-              <d:set><d:prop>#{props.join}</d:prop></d:set>
-            </d:propertyupdate>
-          XML
+          x = Builder::XmlMarkup.new
+          x.instruct! :xml, version: "1.0", encoding: "UTF-8"
+          x.tag!("d:propertyupdate", "xmlns:d" => "DAV:") do
+            x.tag!("d:set") do
+              x.tag!("d:prop") do
+                x.tag!("d:displayname", displayname) if displayname
+              end
+            end
+          end
 
-          status, = @client.request('PROPPATCH', @path, body: body, headers: { 'Content-Type' => 'text/xml' })
+          status, = @client.request('PROPPATCH', @path, body: x.target!, headers: { 'Content-Type' => 'text/xml' })
           raise Error, "PROPPATCH failed: #{status}" unless status == 207
 
           @displayname = displayname if displayname

data/lib/async/caldav/client/calendar.rb

@@ -2,6 +2,7 @@
 
 require "bundler/setup"
 require "scampi"
+require "builder"
 
 module Async
   module Caldav
@@ -19,22 +20,13 @@ module Async
         end
 
         def events(filter: nil)
-          body = if filter
-            <<~XML
-              <?xml version="1.0" encoding="UTF-8"?>
-              <c:calendar-query xmlns:d="DAV:" xmlns:c="urn:ietf:params:xml:ns:caldav">
-                <d:prop><d:getetag/><c:calendar-data/></d:prop>
-                #{filter}
-              </c:calendar-query>
-            XML
-          else
-            <<~XML
-              <?xml version="1.0" encoding="UTF-8"?>
-              <c:calendar-query xmlns:d="DAV:" xmlns:c="urn:ietf:params:xml:ns:caldav">
-                <d:prop><d:getetag/><c:calendar-data/></d:prop>
-              </c:calendar-query>
-            XML
+          x = Builder::XmlMarkup.new
+          x.instruct! :xml, version: "1.0", encoding: "UTF-8"
+          x.tag!("c:calendar-query", "xmlns:d" => "DAV:", "xmlns:c" => "urn:ietf:params:xml:ns:caldav") do
+            x.tag!("d:prop") { x.tag!("d:getetag"); x.tag!("c:calendar-data") }
+            x << filter if filter
           end
+          body = x.target!
 
           status, _, resp_body = @client.request('REPORT', @path, body: body, headers: { 'Content-Type' => 'text/xml' })
           raise Error, "REPORT failed: #{status}" unless status == 207
@@ -104,19 +96,19 @@ module Async
         end
 
         def proppatch(displayname: nil, description: nil, color: nil)
-          props = []
-          props << "<d:displayname>#{Protocol::Caldav::Xml.escape(displayname)}</d:displayname>" if displayname
-          props << "<c:calendar-description>#{Protocol::Caldav::Xml.escape(description)}</c:calendar-description>" if description
-          props << "<x:calendar-color>#{Protocol::Caldav::Xml.escape(color)}</x:calendar-color>" if color
-
-          body = <<~XML
-            <?xml version="1.0" encoding="UTF-8"?>
-            <d:propertyupdate xmlns:d="DAV:" xmlns:c="urn:ietf:params:xml:ns:caldav" xmlns:x="http://apple.com/ns/ical/">
-              <d:set><d:prop>#{props.join}</d:prop></d:set>
-            </d:propertyupdate>
-          XML
-
-          status, = @client.request('PROPPATCH', @path, body: body, headers: { 'Content-Type' => 'text/xml' })
+          x = Builder::XmlMarkup.new
+          x.instruct! :xml, version: "1.0", encoding: "UTF-8"
+          x.tag!("d:propertyupdate", "xmlns:d" => "DAV:", "xmlns:c" => "urn:ietf:params:xml:ns:caldav", "xmlns:x" => "http://apple.com/ns/ical/") do
+            x.tag!("d:set") do
+              x.tag!("d:prop") do
+                x.tag!("d:displayname", displayname) if displayname
+                x.tag!("c:calendar-description", description) if description
+                x.tag!("x:calendar-color", color) if color
+              end
+            end
+          end
+
+          status, = @client.request('PROPPATCH', @path, body: x.target!, headers: { 'Content-Type' => 'text/xml' })
           raise Error, "PROPPATCH failed: #{status}" unless status == 207
 
           @displayname = displayname if displayname
@@ -126,14 +118,17 @@ module Async
         end
 
         def sync(token: nil)
-          token_xml = token ? "<d:sync-token>#{token}</d:sync-token>" : "<d:sync-token/>"
-          body = <<~XML
-            <?xml version="1.0" encoding="UTF-8"?>
-            <d:sync-collection xmlns:d="DAV:">
-              <d:prop><d:getetag/></d:prop>
-              #{token_xml}
-            </d:sync-collection>
-          XML
+          x = Builder::XmlMarkup.new
+          x.instruct! :xml, version: "1.0", encoding: "UTF-8"
+          x.tag!("d:sync-collection", "xmlns:d" => "DAV:") do
+            x.tag!("d:prop") { x.tag!("d:getetag") }
+            if token
+              x.tag!("d:sync-token", token)
+            else
+              x.tag!("d:sync-token")
+            end
+          end
+          body = x.target!
 
           status, _, resp_body = @client.request('REPORT', @path, body: body, headers: { 'Content-Type' => 'text/xml' })
 

data/lib/async/caldav/client.rb

@@ -82,18 +82,18 @@ module Async
 
       def create_calendar(name, displayname: nil, description: nil, color: nil)
         path = "/calendars/#{@user}/#{name}/"
-        props = []
-        props << "<d:displayname>#{Protocol::Caldav::Xml.escape(displayname || name)}</d:displayname>" if displayname || name
-        props << "<c:calendar-description>#{Protocol::Caldav::Xml.escape(description)}</c:calendar-description>" if description
-
-        body = <<~XML
-          <?xml version="1.0" encoding="UTF-8"?>
-          <c:mkcalendar xmlns:d="DAV:" xmlns:c="urn:ietf:params:xml:ns:caldav">
-            <d:set><d:prop>#{props.join}</d:prop></d:set>
-          </c:mkcalendar>
-        XML
-
-        status, = request('MKCALENDAR', path, body: body, headers: { 'Content-Type' => 'text/xml' })
+        x = Builder::XmlMarkup.new
+        x.instruct! :xml, version: "1.0", encoding: "UTF-8"
+        x.tag!("c:mkcalendar", "xmlns:d" => "DAV:", "xmlns:c" => "urn:ietf:params:xml:ns:caldav") do
+          x.tag!("d:set") do
+            x.tag!("d:prop") do
+              x.tag!("d:displayname", displayname || name) if displayname || name
+              x.tag!("c:calendar-description", description) if description
+            end
+          end
+        end
+
+        status, = request('MKCALENDAR', path, body: x.target!, headers: { 'Content-Type' => 'text/xml' })
         raise Error, "MKCALENDAR failed: #{status}" unless status == 201
 
         Calendar.new(self, path, displayname: displayname || name, description: description, color: color)
@@ -101,17 +101,18 @@ module Async
 
       def create_addressbook(name, displayname: nil)
         path = "/addressbooks/#{@user}/#{name}/"
-        body = <<~XML
-          <?xml version="1.0" encoding="UTF-8"?>
-          <d:mkcol xmlns:d="DAV:" xmlns:cr="urn:ietf:params:xml:ns:carddav">
-            <d:set><d:prop>
-              <d:resourcetype><d:collection/><cr:addressbook/></d:resourcetype>
-              <d:displayname>#{Protocol::Caldav::Xml.escape(displayname || name)}</d:displayname>
-            </d:prop></d:set>
-          </d:mkcol>
-        XML
-
-        status, = request('MKCOL', path, body: body, headers: { 'Content-Type' => 'text/xml' })
+        x = Builder::XmlMarkup.new
+        x.instruct! :xml, version: "1.0", encoding: "UTF-8"
+        x.tag!("d:mkcol", "xmlns:d" => "DAV:", "xmlns:cr" => "urn:ietf:params:xml:ns:carddav") do
+          x.tag!("d:set") do
+            x.tag!("d:prop") do
+              x.tag!("d:resourcetype") { x.tag!("d:collection"); x.tag!("cr:addressbook") }
+              x.tag!("d:displayname", displayname || name)
+            end
+          end
+        end
+
+        status, = request('MKCOL', path, body: x.target!, headers: { 'Content-Type' => 'text/xml' })
         raise Error, "MKCOL failed: #{status}" unless status == 201
 
         Addressbook.new(self, path, displayname: displayname || name)

data/lib/async/caldav/handlers/propfind.rb

@@ -13,6 +13,7 @@ module Async
         def call(path:, storage:, user:, headers: {}, body: nil, **)
           depth = headers['depth'] || '1'
           propname = body&.include?('propname')
+          build = propname ? :build_propname : :build_propfind
 
           col_path = path.ensure_trailing_slash
           collection = storage.get_collection(col_path.to_s)
@@ -23,97 +24,86 @@ module Async
             return [404, { 'content-type' => 'text/plain' }, ['Not Found']]
           end
 
-          responses = []
-
-          if collection
-            col = Protocol::Caldav::Collection.new(
-              path: col_path,
-              type: collection[:type],
-              displayname: collection[:displayname],
-              description: collection[:description],
-              color: collection[:color],
-              props: collection[:props]
-            )
-            responses << (propname ? col.to_propname_xml : col.to_propfind_xml)
-
-            if depth != '0'
-              # Child collections
-              storage.list_collections(col_path.to_s).each do |child_path, child_data|
-                child_p = Protocol::Caldav::Path.new(child_path, storage_class: storage)
-                child_col = Protocol::Caldav::Collection.new(
-                  path: child_p,
-                  type: child_data[:type],
-                  displayname: child_data[:displayname],
-                  description: child_data[:description],
-                  color: child_data[:color],
-                  props: child_data[:props]
-                )
-                responses << (propname ? child_col.to_propname_xml : child_col.to_propfind_xml)
+          xml = Protocol::Caldav::Multistatus.new.to_xml do |x|
+            if collection
+              col = Protocol::Caldav::Collection.new(
+                path: col_path,
+                type: collection[:type],
+                displayname: collection[:displayname],
+                description: collection[:description],
+                color: collection[:color],
+                props: collection[:props]
+              )
+              col.send(build, x)
+
+              if depth != '0'
+                storage.list_collections(col_path.to_s).each do |child_path, child_data|
+                  child_p = Protocol::Caldav::Path.new(child_path, storage_class: storage)
+                  child_col = Protocol::Caldav::Collection.new(
+                    path: child_p,
+                    type: child_data[:type],
+                    displayname: child_data[:displayname],
+                    description: child_data[:description],
+                    color: child_data[:color],
+                    props: child_data[:props]
+                  )
+                  child_col.send(build, x)
+                end
+
+                storage.list_items(col_path.to_s).each do |item_path, data|
+                  item_p = Protocol::Caldav::Path.new(item_path, storage_class: storage)
+                  item = Protocol::Caldav::Item.new(
+                    path: item_p,
+                    body: data[:body],
+                    content_type: data[:content_type],
+                    etag: data[:etag]
+                  )
+                  item.send(build, x)
+                end
               end
-
-              # Child items
-              storage.list_items(col_path.to_s).each do |item_path, data|
-                item_p = Protocol::Caldav::Path.new(item_path, storage_class: storage)
-                item = Protocol::Caldav::Item.new(
-                  path: item_p,
-                  body: data[:body],
-                  content_type: data[:content_type],
-                  etag: data[:etag]
-                )
-                responses << (propname ? item.to_propname_xml : item.to_propfind_xml)
-              end
-            end
-          elsif item_data
-            item = Protocol::Caldav::Item.new(
-              path: path,
-              body: item_data[:body],
-              content_type: item_data[:content_type],
-              etag: item_data[:etag]
-            )
-            responses << (propname ? item.to_propname_xml : item.to_propfind_xml)
-          else
-            # Shallow path with no collection — return basic discovery info
-            responses << build_discovery_xml(path, user)
-
-            # Still list child collections/items for depth=1
-            if depth != '0'
-              storage.list_collections(col_path.to_s).each do |child_path, child_data|
-                child_p = Protocol::Caldav::Path.new(child_path, storage_class: storage)
-                child_col = Protocol::Caldav::Collection.new(
-                  path: child_p,
-                  type: child_data[:type],
-                  displayname: child_data[:displayname],
-                  description: child_data[:description],
-                  color: child_data[:color],
-                  props: child_data[:props]
-                )
-                responses << (propname ? child_col.to_propname_xml : child_col.to_propfind_xml)
+            elsif item_data
+              item = Protocol::Caldav::Item.new(
+                path: path,
+                body: item_data[:body],
+                content_type: item_data[:content_type],
+                etag: item_data[:etag]
+              )
+              item.send(build, x)
+            else
+              build_discovery(x, path, user)
+
+              if depth != '0'
+                storage.list_collections(col_path.to_s).each do |child_path, child_data|
+                  child_p = Protocol::Caldav::Path.new(child_path, storage_class: storage)
+                  child_col = Protocol::Caldav::Collection.new(
+                    path: child_p,
+                    type: child_data[:type],
+                    displayname: child_data[:displayname],
+                    description: child_data[:description],
+                    color: child_data[:color],
+                    props: child_data[:props]
+                  )
+                  child_col.send(build, x)
+                end
               end
             end
           end
 
-          xml = Protocol::Caldav::Multistatus.new(responses).to_xml
           [207, Protocol::Caldav::Constants::DAV_HEADERS, [xml]]
         end
 
-        def build_discovery_xml(path, user)
-          <<~XML
-            <d:response>
-              <d:href>#{Protocol::Caldav::Xml.escape(path.to_s)}</d:href>
-              <d:propstat>
-                <d:prop>
-                  <d:resourcetype><d:collection/></d:resourcetype>
-                  <d:current-user-principal><d:href>/#{user}/</d:href></d:current-user-principal>
-                  <c:calendar-home-set><d:href>/calendars/#{user}/</d:href></c:calendar-home-set>
-                  <cr:addressbook-home-set><d:href>/addressbooks/#{user}/</d:href></cr:addressbook-home-set>
-                </d:prop>
-                <d:status>HTTP/1.1 200 OK</d:status>
-              </d:propstat>
-            </d:response>
-          XML
+        def build_discovery(xml, path, user)
+          Protocol::Caldav::XmlBuilder.response(xml, href: path.to_s) do
+            Protocol::Caldav::XmlBuilder.propstat_ok(xml) do
+              xml.tag!("d:resourcetype") { xml.tag!("d:collection") }
+              xml.tag!("d:current-user-principal") { xml.tag!("d:href", "/#{user}/") }
+              xml.tag!("c:calendar-home-set") { xml.tag!("d:href", "/calendars/#{user}/") }
+              xml.tag!("cr:addressbook-home-set") { xml.tag!("d:href", "/addressbooks/#{user}/") }
+            end
+          end
         end
 
-        private_class_method :build_discovery_xml
+        private_class_method :build_discovery
       end
     end
   end

data/lib/async/caldav/handlers/proppatch.rb

@@ -37,17 +37,14 @@ module Async
 
           storage.update_collection(col_path.to_s, updates)
 
-          response_xml = <<~XML
-            <d:response>
-              <d:href>#{Protocol::Caldav::Xml.escape(col_path.to_s)}</d:href>
-              <d:propstat>
-                <d:prop/>
-                <d:status>HTTP/1.1 200 OK</d:status>
-              </d:propstat>
-            </d:response>
-          XML
-
-          xml = Protocol::Caldav::Multistatus.new([response_xml]).to_xml
+          xml = Protocol::Caldav::Multistatus.new.to_xml do |x|
+            Protocol::Caldav::XmlBuilder.response(x, href: col_path.to_s) do
+              x.tag!("d:propstat") do
+                x.tag!("d:prop")
+                x.tag!("d:status", "HTTP/1.1 200 OK")
+              end
+            end
+          end
           [207, Protocol::Caldav::Constants::DAV_HEADERS, [xml]]
         end
       end

data/lib/async/caldav/handlers/report.rb

@@ -43,45 +43,46 @@ module Async
             items = multi.select { |_, data| data }
           end
 
-          responses = items.filter_map do |item_path, data|
-            next unless data
-
-            # Apply filter
-            if filter
-              if resource_type == :addressbook
-                card = Protocol::Caldav::Vcard::Parser.parse(data[:body])
-                next unless card && Protocol::Caldav::Filter::Match.addressbook?(filter, card)
-              else
-                component = Protocol::Caldav::Ical::Parser.parse(data[:body])
-                next unless component && Protocol::Caldav::Filter::Match.calendar?(filter, component)
+          xml = Protocol::Caldav::Multistatus.new.to_xml do |x|
+            items.each do |item_path, data|
+              next unless data
+
+              # Apply filter
+              if filter
+                if resource_type == :addressbook
+                  card = Protocol::Caldav::Vcard::Parser.parse(data[:body])
+                  next unless card && Protocol::Caldav::Filter::Match.addressbook?(filter, card)
+                else
+                  component = Protocol::Caldav::Ical::Parser.parse(data[:body])
+                  next unless component && Protocol::Caldav::Filter::Match.calendar?(filter, component)
+                end
               end
-            end
 
-            item_body = data[:body]
-
-            # Apply expand if requested (calendar items only)
-            if expand_range && resource_type != :addressbook
-              component = Protocol::Caldav::Ical::Parser.parse(item_body)
-              if component
-                item_body = Protocol::Caldav::Ical::Expand.expand(
-                  component,
-                  range_start: expand_range[:start],
-                  range_end: expand_range[:end]
-                )
+              item_body = data[:body]
+
+              # Apply expand if requested (calendar items only)
+              if expand_range && resource_type != :addressbook
+                component = Protocol::Caldav::Ical::Parser.parse(item_body)
+                if component
+                  item_body = Protocol::Caldav::Ical::Expand.expand(
+                    component,
+                    range_start: expand_range[:start],
+                    range_end: expand_range[:end]
+                  )
+                end
               end
-            end
 
-            item_p = Protocol::Caldav::Path.new(item_path, storage_class: storage)
-            item = Protocol::Caldav::Item.new(
-              path: item_p,
-              body: item_body,
-              content_type: data[:content_type],
-              etag: data[:etag]
-            )
-            item.to_report_xml(data_tag: data_tag)
+              item_p = Protocol::Caldav::Path.new(item_path, storage_class: storage)
+              item = Protocol::Caldav::Item.new(
+                path: item_p,
+                body: item_body,
+                content_type: data[:content_type],
+                etag: data[:etag]
+              )
+              item.build_report(x, data_tag: data_tag)
+            end
           end
 
-          xml = Protocol::Caldav::Multistatus.new(responses).to_xml
           [207, Protocol::Caldav::Constants::DAV_HEADERS, [xml]]
         end
 
@@ -97,67 +98,48 @@ module Async
             # Incremental sync
             result = storage.sync_changes(col_path, old_token)
             unless result
-              # Invalid token
-              error_xml = <<~XML
-                <?xml version="1.0" encoding="UTF-8"?>
-                <d:error xmlns:d="DAV:">
-                  <d:valid-sync-token/>
-                </d:error>
-              XML
-              return [403, { 'content-type' => 'application/xml' }, [error_xml]]
+              error_xml = Builder::XmlMarkup.new
+              error_xml.instruct! :xml, version: "1.0", encoding: "UTF-8"
+              error_xml.tag!("d:error", "xmlns:d" => "DAV:") do
+                error_xml.tag!("d:valid-sync-token")
+              end
+              return [403, { 'content-type' => 'application/xml' }, [error_xml.target!]]
             end
 
             new_token, changes = result
-            responses = changes.map do |item_path, status|
-              if status == :deleted
-                <<~XML
-                  <d:response>
-                    <d:href>#{Protocol::Caldav::Xml.escape(item_path)}</d:href>
-                    <d:status>HTTP/1.1 404 Not Found</d:status>
-                  </d:response>
-                XML
-              else
-                etag = storage.etag(item_path)
-                <<~XML
-                  <d:response>
-                    <d:href>#{Protocol::Caldav::Xml.escape(item_path)}</d:href>
-                    <d:propstat>
-                      <d:prop>
-                        <d:getetag>#{Protocol::Caldav::Xml.escape(etag)}</d:getetag>
-                      </d:prop>
-                      <d:status>HTTP/1.1 200 OK</d:status>
-                    </d:propstat>
-                  </d:response>
-                XML
+            xml = Protocol::Caldav::XmlBuilder.multistatus do |x|
+              changes.each do |item_path, status|
+                if status == :deleted
+                  Protocol::Caldav::XmlBuilder.response(x, href: item_path) do
+                    x.tag!("d:status", "HTTP/1.1 404 Not Found")
+                  end
+                else
+                  etag = storage.etag(item_path)
+                  Protocol::Caldav::XmlBuilder.response(x, href: item_path) do
+                    Protocol::Caldav::XmlBuilder.propstat_ok(x) do
+                      x.tag!("d:getetag", etag)
+                    end
+                  end
+                end
               end
+              x.tag!("d:sync-token", new_token)
             end
           else
             # Initial sync — return all items
             new_token = storage.snapshot_sync(col_path)
             items = storage.list_items(col_path)
-            responses = items.map do |item_path, data|
-              <<~XML
-                <d:response>
-                  <d:href>#{Protocol::Caldav::Xml.escape(item_path)}</d:href>
-                  <d:propstat>
-                    <d:prop>
-                      <d:getetag>#{Protocol::Caldav::Xml.escape(data[:etag])}</d:getetag>
-                    </d:prop>
-                    <d:status>HTTP/1.1 200 OK</d:status>
-                  </d:propstat>
-                </d:response>
-              XML
+            xml = Protocol::Caldav::XmlBuilder.multistatus do |x|
+              items.each do |item_path, data|
+                Protocol::Caldav::XmlBuilder.response(x, href: item_path) do
+                  Protocol::Caldav::XmlBuilder.propstat_ok(x) do
+                    x.tag!("d:getetag", data[:etag])
+                  end
+                end
+              end
+              x.tag!("d:sync-token", new_token)
             end
           end
 
-          xml = <<~XML
-            <?xml version="1.0" encoding="UTF-8"?>
-            <d:multistatus xmlns:d="DAV:" xmlns:c="urn:ietf:params:xml:ns:caldav" xmlns:cr="urn:ietf:params:xml:ns:carddav" xmlns:cs="http://calendarserver.org/ns/" xmlns:x="http://apple.com/ns/ical/">
-            #{responses.join}
-            <d:sync-token>#{Protocol::Caldav::Xml.escape(new_token)}</d:sync-token>
-            </d:multistatus>
-          XML
-
           [207, Protocol::Caldav::Constants::DAV_HEADERS, [xml]]
         end
 

data/lib/async/caldav/storage/filesystem.rb

@@ -14,6 +14,8 @@ module Async
           @root = root
           @sync_snapshots = {}
           FileUtils.mkdir_p(@root)
+          @root_normalized = ::File.expand_path(@root)
+          @root_with_separator = @root_normalized.end_with?(::File::SEPARATOR) ? @root_normalized : "#{@root_normalized}#{::File::SEPARATOR}"
         end
 
         # --- Collections ---
@@ -39,9 +41,9 @@ module Async
         end
 
         def delete_collection(path)
-          dir = full_path(path)
-          if File.directory?(dir)
-            FileUtils.rm_rf(dir)
+          s = stat(path)
+          if s && s.directory?
+            FileUtils.rm_rf(full_path(path))
             true
           else
             false
@@ -89,13 +91,15 @@ module Async
         # --- Items ---
 
         def get_item(path)
-          file = full_path(path)
-          return nil unless File.file?(file)
-
-          body = File.read(file)
-          content_type = guess_content_type(path)
-          etag = Protocol::Caldav::ETag.compute(body)
-          { body: body, content_type: content_type, etag: etag }
+          s = stat(path)
+          if s && s.file?
+            body = File.read(full_path(path))
+            content_type = guess_content_type(path)
+            etag = Protocol::Caldav::ETag.compute(body)
+            { body: body, content_type: content_type, etag: etag }
+          else
+            nil
+          end
         end
 
         def put_item(path, body, content_type)
@@ -109,9 +113,9 @@ module Async
         end
 
         def delete_item(path)
-          file = full_path(path)
-          if File.file?(file)
-            File.delete(file)
+          s = stat(path)
+          if s && s.file?
+            File.delete(full_path(path))
             true
           else
             false
@@ -136,13 +140,15 @@ module Async
         end
 
         def move_item(from_path, to_path)
-          src = full_path(from_path)
-          dst = full_path(to_path)
-          return nil unless File.file?(src)
-
-          FileUtils.mkdir_p(File.dirname(dst))
-          FileUtils.mv(src, dst)
-          get_item(to_path)
+          s = stat(from_path)
+          if s && s.file?
+            dst = full_path(to_path)
+            FileUtils.mkdir_p(File.dirname(dst))
+            FileUtils.mv(full_path(from_path), dst)
+            get_item(to_path)
+          else
+            nil
+          end
         end
 
         def get_multi(paths)
@@ -152,8 +158,11 @@ module Async
         # --- General ---
 
         def exists?(path)
-          fp = full_path(path)
-          File.exist?(fp) || collection_exists?(path)
+          if stat(path)
+            true
+          else
+            collection_exists?(path)
+          end
         end
 
         def etag(path)
@@ -208,7 +217,26 @@ module Async
         private
 
         def full_path(path)
-          File.join(@root, path)
+          if valid_path?(path)
+            expanded = ::File.expand_path(::File.join(@root, path))
+            if expanded == @root_normalized || expanded.start_with?(@root_with_separator)
+              expanded
+            else
+              raise ArgumentError, "path escapes root: #{path.inspect}"
+            end
+          else
+            raise ArgumentError, "invalid path: #{path.inspect}"
+          end
+        end
+
+        def valid_path?(path)
+          path.is_a?(String) && path.valid_encoding? && !path.include?("\0")
+        end
+
+        def stat(path)
+          ::File.stat(full_path(path))
+        rescue Errno::ENOENT, Errno::ELOOP
+          nil
         end
 
         def guess_content_type(path)
@@ -361,6 +389,21 @@ test do
       end
     end
 
+    it "rejects path traversal attempts" do
+      Dir.mktmpdir do |dir|
+        s = Async::Caldav::Storage::Filesystem.new(dir)
+        lambda { s.get_item("/../../etc/passwd") }.should.raise ArgumentError
+        lambda { s.put_item("/cal/../../escape.ics", "x", "text/calendar") }.should.raise ArgumentError
+      end
+    end
+
+    it "rejects NUL byte in path" do
+      Dir.mktmpdir do |dir|
+        s = Async::Caldav::Storage::Filesystem.new(dir)
+        lambda { s.get_item("/cal\0/x.ics") }.should.raise ArgumentError
+      end
+    end
+
     it "same body produces same etag across backends" do
       body = "BEGIN:VCALENDAR\r\nEND:VCALENDAR"
       mock = Async::Caldav::Storage::Mock.new

data/lib/async/caldav/version.rb

@@ -2,6 +2,6 @@
 
 module Async
   module Caldav
-    VERSION = "1.2.0"
+    VERSION = "1.2.2"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: async-caldav
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.2
 platform: ruby
 authors:
 - Nathan K