From dec37597e484b7735267d6ae54735e0f1055ba54 Mon Sep 17 00:00:00 2001
From: Christoph Wurst <christoph@winzerhof-wurst.at>
Date: Fri, 28 Feb 2025 09:05:05 +0100
Subject: fix(dav): Handle long absence status earlier

Validate the request early. Don't let this cause a database error.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
---
 apps/dav/lib/Controller/OutOfOfficeController.php | 8 ++++++--
 apps/dav/openapi.json                             | 5 +++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/apps/dav/lib/Controller/OutOfOfficeController.php b/apps/dav/lib/Controller/OutOfOfficeController.php
index 5ab99c34b79..66f89308802 100644
--- a/apps/dav/lib/Controller/OutOfOfficeController.php
+++ b/apps/dav/lib/Controller/OutOfOfficeController.php
@@ -38,6 +38,7 @@ use OCP\IRequest;
 use OCP\IUserManager;
 use OCP\IUserSession;
 use OCP\User\IAvailabilityCoordinator;
+use function mb_strlen;
 
 /**
  * @psalm-import-type DAVOutOfOfficeData from ResponseDefinitions
@@ -120,10 +121,10 @@ class OutOfOfficeController extends OCSController {
 	 * @param string $lastDay Last day of the absence in format `YYYY-MM-DD`
 	 * @param string $status Short text that is set as user status during the absence
 	 * @param string $message Longer multiline message that is shown to others during the absence
-	 * @return DataResponse<Http::STATUS_OK, DAVOutOfOfficeData, array{}>|DataResponse<Http::STATUS_BAD_REQUEST, array{error: 'firstDay'}, array{}>|DataResponse<Http::STATUS_UNAUTHORIZED, null, array{}>
+	 * @return DataResponse<Http::STATUS_OK, DAVOutOfOfficeData, array{}>|DataResponse<Http::STATUS_BAD_REQUEST, array{error: 'firstDay'|'statusLength'}, array{}>|DataResponse<Http::STATUS_UNAUTHORIZED, null, array{}>
 	 *
 	 * 200: Absence data
-	 * 400: When the first day is not before the last day
+	 * 400: When validation fails, e.g. data range error or the first day is not before the last day
 	 * 401: When the user is not logged in
 	 */
 	#[NoAdminRequired]
@@ -137,6 +138,9 @@ class OutOfOfficeController extends OCSController {
 		if ($user === null) {
 			return new DataResponse(null, Http::STATUS_UNAUTHORIZED);
 		}
+		if (mb_strlen($status) > 100) {
+			return new DataResponse(['error' => 'statusLength'], Http::STATUS_BAD_REQUEST);
+		}
 
 		$parsedFirstDay = new DateTimeImmutable($firstDay);
 		$parsedLastDay = new DateTimeImmutable($lastDay);
diff --git a/apps/dav/openapi.json b/apps/dav/openapi.json
index 7a1c33914cc..b4ee296d648 100644
--- a/apps/dav/openapi.json
+++ b/apps/dav/openapi.json
@@ -624,7 +624,7 @@
                         }
                     },
                     "400": {
-                        "description": "When the first day is not before the last day",
+                        "description": "When validation fails, e.g. data range error or the first day is not before the last day",
                         "content": {
                             "application/json": {
                                 "schema": {
@@ -652,7 +652,8 @@
                                                         "error": {
                                                             "type": "string",
                                                             "enum": [
-                                                                "firstDay"
+                                                                "firstDay",
+                                                                "statusLength"
                                                             ]
                                                         }
                                                     }
-- 
cgit v1.2.3