caldav-adapter 8.3.1 → 8.3.3

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "caldav-adapter",
   "description": "CalDAV server for Node.js and Koa. Modernized and maintained for Forward Email.",
-  "version": "8.3.1",
+  "version": "8.3.3",
   "author": "Sanders DeNardi and Forward Email LLC",
   "contributors": [
     "Sanders DeNardi <sedenardi@gmail.com> (http://www.sandersdenardi.com/)",

package/routes/calendar/calendar/report.js

@@ -18,6 +18,24 @@ module.exports = function (options) {
     'sync-collection': sync(options)
   };
   const exec = async function (ctx, calendar) {
+    //
+    // Check if XML was parsed successfully
+    // Per RFC 4918 Section 8.2: "If a server receives XML that is not
+    // well-formed, then the server MUST reject the entire request with
+    // a 400 (Bad Request)."
+    //
+    // ctx.request.xml can be null if:
+    // 1. The XML body is empty
+    // 2. The XML body is malformed and fails to parse
+    // 3. The Content-Type is incorrect
+    //
+    if (!ctx.request.xml || !ctx.request.xml.documentElement) {
+      log.debug('report rejected: invalid or empty XML body');
+      ctx.status = 400;
+      ctx.body = 'Bad Request: invalid or missing XML body';
+      return;
+    }
+
     const rootTag = ctx.request.xml.documentElement.localName;
     const rootAction = rootActions[rootTag];
     log.debug(`report ${rootAction ? 'hit' : 'miss'}: ${rootTag}`);

package/routes/calendar/calendar.js

@@ -65,16 +65,25 @@ module.exports = function (options) {
         return;
       }
 
-      if (typeof calMethods[method].exec === 'function') {
-        setMultistatusResponse(ctx);
-        ctx.body = await calMethods[method].exec(ctx, calendar);
-      } else if (typeof calMethods[method] === 'function') {
-        setMultistatusResponse(ctx);
-        ctx.body = await calMethods[method](ctx, calendar);
-      } else {
-        log.warn(`method handler not found: ${method}`);
-        setMissingMethod(ctx);
-        ctx.body = notFound(ctx.url);
+      try {
+        if (typeof calMethods[method].exec === 'function') {
+          setMultistatusResponse(ctx);
+          ctx.body = await calMethods[method].exec(ctx, calendar);
+        } else if (typeof calMethods[method] === 'function') {
+          setMultistatusResponse(ctx);
+          ctx.body = await calMethods[method](ctx, calendar);
+        } else {
+          log.warn(`method handler not found: ${method}`);
+          setMissingMethod(ctx);
+          ctx.body = notFound(ctx.url);
+        }
+      } catch (err) {
+        err.isCodeBug = true;
+        err.calendarId = calendarId;
+        err.principalId = ctx.state.params.principalId;
+        err.method = method;
+        log.error('calendar method error', err);
+        throw err;
       }
     } else {
       if (method === 'options') {
@@ -89,16 +98,24 @@ module.exports = function (options) {
         return;
       }
 
-      if (typeof userMethods[method].exec === 'function') {
-        setMultistatusResponse(ctx);
-        ctx.body = await userMethods[method].exec(ctx);
-      } else if (typeof userMethods[method] === 'function') {
-        setMultistatusResponse(ctx);
-        ctx.body = await userMethods[method](ctx);
-      } else {
-        log.warn(`method handler not found: ${method}`);
-        setMissingMethod(ctx);
-        ctx.body = notFound(ctx.url);
+      try {
+        if (typeof userMethods[method].exec === 'function') {
+          setMultistatusResponse(ctx);
+          ctx.body = await userMethods[method].exec(ctx);
+        } else if (typeof userMethods[method] === 'function') {
+          setMultistatusResponse(ctx);
+          ctx.body = await userMethods[method](ctx);
+        } else {
+          log.warn(`method handler not found: ${method}`);
+          setMissingMethod(ctx);
+          ctx.body = notFound(ctx.url);
+        }
+      } catch (err) {
+        err.isCodeBug = true;
+        err.principalId = ctx.state.params.principalId;
+        err.method = method;
+        log.error('user method error', err);
+        throw err;
       }
     }
   };