@remit/calendar-service 0.0.5 → 0.0.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/calendar-service",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "iCalendar (RFC 5545) parsing, projection and recurrence expansion over the calendar store",
   "type": "module",
   "main": "src/index.ts",

package/src/feed.test.ts

@@ -49,6 +49,10 @@ const object = (
 		updatedAt,
 	}) as CalendarObjectItem;
 
+/** Content lines as a subscriber reads them, with RFC 5545 3.1 folding undone. */
+const unfolded = (icalData: string): string =>
+	icalData.replace(/\r\n[ \t]/g, "");
+
 describe("a feed token", () => {
 	it("is base64url over the declared number of random bytes", () => {
 		const minted = mintCalendarFeedToken();
@@ -122,6 +126,49 @@ describe("the calendar a feed serves", () => {
 		assert.match(feed.icalData, /SUMMARY:Stand-up/);
 	});
 
+	it("escapes the separators a name may carry", () => {
+		const feed = buildCalendarFeed(
+			collection({ displayName: "Work, Home; C:\\shared" }),
+			[],
+		);
+
+		assert.match(
+			unfolded(feed.icalData),
+			/X-WR-CALNAME:Work\\, Home\\; C:\\\\shared\r\n/,
+		);
+	});
+
+	it("cannot be made to smuggle a component through its name", () => {
+		const feed = buildCalendarFeed(
+			collection({
+				displayName:
+					"Work\r\nBEGIN:VEVENT\r\nUID:injected\r\nDTSTART:20250101T000000Z\r\nSUMMARY:pwned\r\nEND:VEVENT",
+			}),
+			[
+				object(
+					"a.ics",
+					singleEvent("SUMMARY:Stand-up", "DTSTART:20260907T090000Z"),
+				),
+			],
+		);
+		const served = unfolded(feed.icalData);
+
+		assert.equal(served.match(/^BEGIN:VEVENT\r\n/gm)?.length, 1);
+		assert.doesNotMatch(served, /^UID:injected/m);
+		assert.doesNotMatch(served, /^SUMMARY:pwned/m);
+		assert.match(served, /X-WR-CALNAME:Work\\nBEGIN:VEVENT\\nUID:injected/);
+	});
+
+	it("leaves no bare carriage return in what it serves", () => {
+		const feed = buildCalendarFeed(
+			collection({ displayName: "Work\rHome" }),
+			[],
+		);
+
+		assert.match(unfolded(feed.icalData), /X-WR-CALNAME:Work\\nHome\r\n/);
+		assert.doesNotMatch(feed.icalData, /\r(?!\n)/);
+	});
+
 	it("carries the collection's zone so a client reads floating times the same way", () => {
 		const feed = buildCalendarFeed(
 			collection({ timezone: "Europe/Amsterdam" }),

package/src/feed.ts

@@ -80,6 +80,24 @@ export const redactCalendarFeedPath = (path: string): string =>
 		? path
 		: `${CALENDAR_FEED_PATH_PREFIX}<redacted>${CALENDAR_FEED_PATH_SUFFIX}`;
 
+/**
+ * A TEXT value as RFC 5545 3.3.11 writes one.
+ *
+ * ical.js escapes TEXT only for the properties in its design set, and no `X-`
+ * property is in it, so a value goes out verbatim: a comma or a semicolon
+ * reads back as a value list, and a line break as the start of a whole
+ * component the subscriber never had. TEXT has no encoding for a control
+ * character, so one is dropped rather than served.
+ */
+const escapeIcalText = (value: string): string =>
+	value
+		.replace(/\\/g, "\\\\")
+		.replace(/;/g, "\\;")
+		.replace(/,/g, "\\,")
+		.replace(/\r\n|\r|\n/g, "\\n")
+		// biome-ignore lint/suspicious/noControlCharactersInRegex: RFC 5545 TEXT excludes CONTROL.
+		.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "");
+
 /** The bytes a feed serves, and what a conditional request needs to skip them. */
 export interface CalendarFeed {
 	icalData: string;
@@ -106,9 +124,15 @@ export const buildCalendarFeed = (
 	feed.updatePropertyWithValue("prodid", CALENDAR_PRODID);
 	feed.updatePropertyWithValue("version", "2.0");
 	feed.updatePropertyWithValue("calscale", "GREGORIAN");
-	feed.updatePropertyWithValue("x-wr-calname", collection.displayName);
+	feed.updatePropertyWithValue(
+		"x-wr-calname",
+		escapeIcalText(collection.displayName),
+	);
 	if (collection.timezone !== "") {
-		feed.updatePropertyWithValue("x-wr-timezone", collection.timezone);
+		feed.updatePropertyWithValue(
+			"x-wr-timezone",
+			escapeIcalText(collection.timezone),
+		);
 	}
 
 	const zonesSeen = new Set<string>();