hfs 3.1.0-beta5 → 3.1.0-beta6

package/src/webdav.js

@@ -3,7 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.handledWebdav = handledWebdav;
+exports.webdav = void 0;
+exports.releaseWebdavLock = releaseWebdavLock;
 const consumers_1 = require("node:stream/consumers");
 const vfs_1 = require("./vfs");
 const cross_1 = require("./cross");
@@ -33,13 +34,26 @@ const LOCK_MAX_SECONDS = cross_1.DAY / 1000;
 const xmlParser = new fast_xml_parser_1.XMLParser({ ignoreAttributes: false, removeNSPrefix: true, trimValues: true });
 const canOverwrite = new Set();
 const locks = new Map();
-function isLocked(path, ctx) {
+function releaseWebdavLock(path) {
     const lock = locks.get(path);
     if (!lock)
         return false;
+    clearTimeout(lock.timeout);
+    locks.delete(path);
+    return true;
+}
+async function isLocked(path, ctx) {
+    const lock = locks.get(path);
+    if (!lock)
+        return false;
+    // if the resource is gone, keeping the lock only creates fake 423 responses
+    if (!await (0, vfs_1.urlToNode)(path, ctx)) {
+        releaseWebdavLock(path);
+        return false;
+    }
     const ifHeader = ctx.get('If');
     const tokenHeader = ctx.get(TOKEN_HEADER);
-    if (hasToken(ifHeader, lock.token) || hasToken(tokenHeader, lock.token))
+    if (isSameLockPrincipal(lock, ctx) && (hasToken(ifHeader, lock.token) || hasToken(tokenHeader, lock.token)))
         return false;
     ctx.status = cross_1.HTTP_LOCKED;
     return true;
@@ -49,7 +63,13 @@ function hasToken(header, token) {
         return false;
     return header.includes(`<${token}>`) || header.split(/[,;\s]+/).includes(token);
 }
-async function handledWebdav(ctx) {
+function getWebdavPrincipal(ctx) {
+    return (0, auth_1.getCurrentUsername)(ctx) || '';
+}
+function isSameLockPrincipal(lock, ctx) {
+    return lock.principal === getWebdavPrincipal(ctx);
+}
+const webdav = async (ctx, next) => {
     let { path } = ctx;
     path = path.replace(/^\/+/, '/'); // double-slash is causing empty listing in filezilla-pro
     const ua = ctx.get('user-agent');
@@ -61,25 +81,26 @@ async function handledWebdav(ctx) {
     if (isWebdavAuthRequest && ua && (0, auth_1.getCurrentUsername)(ctx))
         webdavDetectedAgents.try(webdavAgentKey(ctx, ua), () => true);
     if (ctx.method === 'OPTIONS') {
-        if (ctx.get('Access-Control-Request-Method'))
-            return; // it's a preflight cors request, not webdav
+        if (ctx.get('Access-Control-Request-Method')) // it's a preflight cors request, not webdav
+            return next();
         setWebdavHeaders();
         ctx.body = '';
-        return true;
+        return;
     }
     if (isWebdavAuthRequest && shouldChallengeWebdav())
-        return true;
+        return;
     if (ctx.method === 'PUT') {
-        if (isLocked(path, ctx))
-            return true;
+        if (await isLocked(path, ctx))
+            return;
+        const overwriteGraceKey = path + (0, cross_1.prefix)('|', (0, auth_1.getCurrentUsername)(ctx)); // bind temporary overwrite grace to the authenticated user so accounts cannot reuse each other's grace window
         // Finder first creates an empty file (a test?) then wants to overwrite it, which requires deletion permission, but the user may not have it, causing a renamed upload. To solve, so we give it special permission for a few seconds.
         const x = ctx.get('x-expected-entity-length'); // field used by Finder's webdav on actual upload, after
         if (!x && !ctx.length) {
-            canOverwrite.add(path);
-            setTimeout(() => canOverwrite.delete(path), 10_000); // grace period
+            canOverwrite.add(overwriteGraceKey);
+            setTimeout(() => canOverwrite.delete(overwriteGraceKey), 10_000); // grace period
         }
-        else if (canOverwrite.has(path)) {
-            canOverwrite.delete(path);
+        else if (canOverwrite.has(overwriteGraceKey)) {
+            canOverwrite.delete(overwriteGraceKey);
             const node = await (0, vfs_1.urlToNode)(path, ctx);
             if (node?.source)
                 await (0, promises_1.rm)(node.source).catch(() => { });
@@ -88,25 +109,27 @@ async function handledWebdav(ctx) {
             ctx.req.headers['content-length'] = x;
         if (KNOWN_UA.test(ua) || webdavDetectedAgents.has(webdavAgentKey(ctx, ua)))
             ctx.query.existing ??= 'overwrite'; // with webdav this is our default
-        return; // default handling
+        return next();
     }
     if (ctx.method === 'MKCOL') {
         setWebdavHeaders();
-        if (isLocked(path, ctx))
-            return true;
+        if (await isLocked(path, ctx))
+            return;
         const node = await (0, vfs_1.urlToNode)(path, ctx);
-        if (node)
-            return ctx.status = cross_1.HTTP_METHOD_NOT_ALLOWED;
-        let name = '';
-        const parentNode = await (0, vfs_1.urlToNode)(path, ctx, vfs_1.vfs, v => name = v);
-        if (!parentNode)
-            return ctx.status = cross_1.HTTP_NOT_FOUND;
+        if (node) {
+            ctx.status = cross_1.HTTP_METHOD_NOT_ALLOWED;
+            return;
+        }
+        const parentNode = await (0, vfs_1.urlToNode)((0, path_1.dirname)(path), ctx);
+        if (!parentNode) // this is a bit incoherent with the way we handle PUT, which doesn't stop in this case, but it's by RFC 4918 section 9.3
+            return ctx.status = cross_1.HTTP_CONFLICT;
+        const name = (0, cross_1.safeDecodeURIComponent)((0, path_1.basename)(path), '');
         if (!(0, misc_1.isValidFileName)(name))
             return ctx.status = cross_1.HTTP_BAD_REQUEST;
         if ((0, vfs_1.statusCodeForMissingPerm)(parentNode, 'can_upload', ctx)) {
             if (ctx.status === cross_1.HTTP_UNAUTHORIZED)
                 setWebdavHeaders(true);
-            return true;
+            return;
         }
         try {
             await (0, promises_1.mkdir)((0, path_1.join)(parentNode.source, name));
@@ -118,21 +141,26 @@ async function handledWebdav(ctx) {
     }
     if (ctx.method === 'MOVE') {
         setWebdavHeaders();
-        if (isLocked(path, ctx))
-            return true;
+        if (await isLocked(path, ctx))
+            return;
         const node = await (0, vfs_1.urlToNode)(path, ctx);
         if (!node)
-            return;
+            return next();
         let dest = ctx.get('destination');
         const i = dest.indexOf('//');
         if (i >= 0)
             dest = dest.slice(dest.indexOf('/', i + 2));
         dest = (0, cross_1.join)(ctx.state.root || '', dest); // on Windows, we must use / as the delimiter to be able to compare with `path` below
-        if (isLocked(dest, ctx))
-            return true;
+        if (await isLocked(dest, ctx))
+            return;
         if ((0, path_1.dirname)(path) === (0, path_1.dirname)(dest)) // rename case. `path` is is encoded, so we test before decoding `dest`
             try {
-                await (0, frontEndApis_1.requestedRename)(node, (0, path_1.basename)(decodeURI(dest)), ctx);
+                // decode the single path segment so reserved chars like %2C become their real name on rename
+                const newName = (0, cross_1.safeDecodeURIComponent)((0, path_1.basename)(dest), '');
+                if (!newName)
+                    return ctx.status = cross_1.HTTP_BAD_REQUEST;
+                await (0, frontEndApis_1.requestedRename)(node, newName, ctx);
+                releaseWebdavLock(path); // RFC 4918 says MOVE must not carry locks to destination, so clear source lock on success
                 return ctx.status = cross_1.HTTP_CREATED;
             }
             catch (e) {
@@ -142,13 +170,18 @@ async function handledWebdav(ctx) {
         if (moveRes instanceof Error)
             return ctx.status = moveRes.status || cross_1.HTTP_SERVER_ERROR;
         const err = moveRes?.errors?.[0];
+        if (!err)
+            releaseWebdavLock(path); // successful MOVE leaves the old path invalid, therefore its lock must be dropped
         return ctx.status = !err ? cross_1.HTTP_CREATED : typeof err === 'number' ? err : cross_1.HTTP_SERVER_ERROR;
     }
     if (ctx.method === 'DELETE') {
         setWebdavHeaders();
-        if (isLocked(path, ctx))
-            return true;
-        return; // allow default handling in serveGuiAndSharedFiles.ts
+        if (await isLocked(path, ctx))
+            return;
+        await next();
+        if (ctx.status === cross_1.HTTP_OK)
+            releaseWebdavLock(path); // webdav clients may forget UNLOCK; successful delete must clear any lock
+        return;
     }
     if (ctx.method === 'UNLOCK') {
         setWebdavHeaders();
@@ -156,8 +189,10 @@ async function handledWebdav(ctx) {
         const lock = locks.get(path);
         if (x !== lock?.token)
             return ctx.status = cross_1.HTTP_BAD_REQUEST;
-        clearTimeout(lock.timeout);
-        locks.delete(path);
+        // with force_webdav_login disabled a client may silently fall back to anonymous; keep lock ownership on the original principal
+        if (!isSameLockPrincipal(lock, ctx))
+            return ctx.status = cross_1.HTTP_PRECONDITION_FAILED;
+        releaseWebdavLock(path);
         ctx.set(TOKEN_HEADER, x);
         if (const_1.IS_MAC)
             (0, vfs_1.urlToNode)(path, ctx).then(x => x?.source && dotClean((0, path_1.dirname)(x.source)));
@@ -176,14 +211,17 @@ async function handledWebdav(ctx) {
             const lock = locks.get(path);
             if (token !== lock?.token)
                 return ctx.status = cross_1.HTTP_PRECONDITION_FAILED;
+            // same-token refresh from another principal would make abandoned locks effectively persistent
+            if (!isSameLockPrincipal(lock, ctx))
+                return ctx.status = cross_1.HTTP_PRECONDITION_FAILED;
             // refresh lock – keep the same token on refresh so clients can continue using the lock they already hold
             clearTimeout(lock.timeout);
-            lock.timeout = setTimeout(() => locks.delete(path), seconds * 1000);
+            lock.timeout = setTimeout(() => releaseWebdavLock(path), seconds * 1000);
             lock.seconds = seconds;
             locks.set(path, lock);
             ctx.set(TOKEN_HEADER, lock.token);
             ctx.body = renderLockResponse(lock.token, lock.seconds);
-            return true;
+            return;
         }
         const lockinfo = (0, cross_1.try_)(() => xmlParser.parse(body).lockinfo);
         const scope = lodash_1.default.keys(lockinfo?.lockscope)[0];
@@ -197,11 +235,11 @@ async function handledWebdav(ctx) {
         if (locks.has(path))
             return ctx.status = cross_1.HTTP_LOCKED;
         const newToken = 'urn:uuid:' + (0, node_crypto_1.randomUUID)();
-        const timeout = setTimeout(() => locks.delete(path), seconds * 1000);
-        locks.set(path, { token: newToken, timeout, seconds });
+        const timeout = setTimeout(() => releaseWebdavLock(path), seconds * 1000);
+        locks.set(path, { token: newToken, timeout, seconds, principal: getWebdavPrincipal(ctx) });
         ctx.set(TOKEN_HEADER, newToken);
         ctx.body = renderLockResponse(newToken, seconds);
-        return true;
+        return;
         function getProvidedLockToken(ctx) {
             const direct = ctx.get(TOKEN_HEADER).replace(/[<>]/g, '');
             if (direct)
@@ -224,14 +262,14 @@ async function handledWebdav(ctx) {
         setWebdavHeaders();
         const node = await (0, vfs_1.urlToNode)(path, ctx);
         if (!node)
-            return;
+            return next();
         let depth = Number(ctx.get('depth'));
         depth = isNaN(depth) ? Infinity : depth;
         const isList = depth !== 0;
         if ((0, vfs_1.statusCodeForMissingPerm)(node, isList ? 'can_list' : 'can_see', ctx)) {
             if (ctx.status === cross_1.HTTP_UNAUTHORIZED)
                 setWebdavHeaders(true);
-            return true;
+            return;
         }
         ctx.type = 'xml';
         ctx.status = 207;
@@ -246,7 +284,7 @@ async function handledWebdav(ctx) {
         }
         res.write(`</multistatus>`);
         res.end();
-        return true;
+        return;
         async function sendEntry(node, append = false) {
             if ((0, vfs_1.nodeIsLink)(node))
                 return;
@@ -272,6 +310,7 @@ async function handledWebdav(ctx) {
         setWebdavHeaders();
         return ctx.status = cross_1.HTTP_METHOD_NOT_ALLOWED;
     }
+    return next();
     function setWebdavHeaders(authenticate = false) {
         ctx.set('DAV', '1,2');
         ctx.set('MS-Author-Via', 'DAV');
@@ -300,7 +339,8 @@ async function handledWebdav(ctx) {
             return true;
         }
     }
-}
+};
+exports.webdav = webdav;
 function compileWebdavAgentRegex(v) {
     return !v ? null : v === true ? /.*/ : new RegExp(v.trim(), 'i');
 }