filip/Stalwart
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

CalDAV: Enforce cumulative iCalendar instances cap in CalDAV free-busy REPORT handler

Browse Source
This commit is contained in:
Maurus Decimus
2026-04-20 10:31:48 +02:00
parent 81596c8127
commit 170d0e95a6
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@@ -93,6 +93,7 @@ This version includes **multiple breaking changes**. If you are upgrading from v
- Use RFC 2616 instead of RFC 1123 for date formatting - Use RFC 2616 instead of RFC 1123 for date formatting
- Fix ACL container/item mismatch in reports. - Fix ACL container/item mismatch in reports.
- CalDAV: Allow organized properties to be present in `PUT` requests if they are equal to the existing ones. - CalDAV: Allow organized properties to be present in `PUT` requests if they are equal to the existing ones.
- CalDAV: Enforce cumulative iCalendar instances cap in CalDAV free-busy REPORT handler
- Configuration: Prefix parsing issues (#2495) - Configuration: Prefix parsing issues (#2495)
- OIDC: JWKS Exposes Symmetric Signing Key - OIDC: JWKS Exposes Symmetric Signing Key
- SQLite: Fix thread pool exhaustion. - SQLite: Fix thread pool exhaustion.

7
crates/dav/src/calendar/freebusy.rs
View File

@@ -160,6 +160,8 @@ impl CalendarFreebusyRequestHandler for Server {
let mut fb_entries: AHashMap<ICalendarFreeBusyType, Vec<(i64, i64)>> = let mut fb_entries: AHashMap<ICalendarFreeBusyType, Vec<(i64, i64)>> =
AHashMap::with_capacity(document_ids.len()); AHashMap::with_capacity(document_ids.len());
let max_instances = self.core.groupware.max_ical_instances;
let mut total_instances: usize = 0;
for document_id in document_ids { for document_id in document_ids {
let Some(archive) = self let Some(archive) = self
@@ -212,6 +214,11 @@ impl CalendarFreebusyRequestHandler for Server {
continue; continue;
} }
total_instances = total_instances.saturating_add(events.len());
if total_instances > max_instances {
return Err(DavError::Code(StatusCode::PAYLOAD_TOO_LARGE));
}
for (component_id, component) in components { for (component_id, component) in components {
let component_id = component_id as u32; let component_id = component_id as u32;
match component.component_type { match component.component_type {