caldav-adapter 8.2.9 → 8.2.10

package/common/parse-body.js

@@ -17,6 +17,10 @@ module.exports = async function (ctx) {
   if (ctx.request.type.includes('xml')) {
     try {
       ctx.request.xml = new DOMParser().parseFromString(ctx.request.body);
+      // Ensure we have a valid document, otherwise set to null
+      if (!ctx.request.xml || typeof ctx.request.xml !== 'object') {
+        ctx.request.xml = null;
+      }
     } catch (err) {
       if (ctx.logger) ctx.logger.warn(err);
       else if (ctx?.app?.emit) ctx.app.emit('error', err, ctx);

package/common/xml.js

@@ -21,6 +21,11 @@ module.exports.nsLookup = nsLookup;
 const select = xpath.useNamespaces(namespaces);
 
 function get(path, doc) {
+  // Validate that doc is a proper XML document
+  if (!doc || typeof doc !== 'object') {
+    throw new Error('Invalid XML document: document is null or not an object');
+  }
+
   return select(path, doc);
 }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "caldav-adapter",
   "description": "CalDAV server for Node.js and Koa. Modernized and maintained for Forward Email.",
-  "version": "8.2.9",
+  "version": "8.2.10",
   "author": "Sanders DeNardi and Forward Email LLC",
   "contributors": [
     "Sanders DeNardi <sedenardi@gmail.com> (http://www.sandersdenardi.com/)",

package/routes/principal/principal.js

@@ -13,6 +13,7 @@ module.exports = function (options) {
   const log = winston({ ...options, label: 'principal' });
   const methods = {
     propfind: routePropfind(options),
+    get: routePropfind(options), // Handle GET same as PROPFIND for redirected requests
     // report: reportReport(opts)
     //
     // TODO: proppatch
@@ -26,7 +27,7 @@ module.exports = function (options) {
     const method = ctx.method.toLowerCase();
 
     if (method === 'options') {
-      setOptions(ctx, ['OPTIONS', 'PROPFIND']);
+      setOptions(ctx, ['OPTIONS', 'PROPFIND', 'GET']);
       return;
     }
 

package/routes/principal/propfind.js

@@ -11,6 +11,11 @@ const commonTags = require('../../common/tags');
 module.exports = function (options) {
   const tags = commonTags(options);
   return async function (ctx) {
+    // Validate XML document before processing
+    if (!ctx.request.xml) {
+      ctx.throw(400, 'Invalid or missing XML in PROPFIND request');
+    }
+
     const { children } = xml.getWithChildren(
       '/D:propfind/D:prop',
       ctx.request.xml