From 2e3b0541046d3e318f1dcccb0455fcec0c14879b Mon Sep 17 00:00:00 2001 From: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Date: Fri, 27 Mar 2026 06:13:53 -0700 Subject: [PATCH 1/3] fix(files_sharing): validate input in PublicPreviewController#getPreview Return 400 Bad Request when the file parameter is empty and the shared node is a folder, instead of passing the folder itself to getPreview which triggers an internal server error. Also rename the local variable to $fileNode to prevent the catch block from calling getMimeType() on the original string parameter when get() throws NotFoundException. Fixes #59229 Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Signed-off-by: Josh --- .../Controller/PublicPreviewController.php | 54 +++++--- apps/files_sharing/openapi.json | 4 +- .../PublicPreviewControllerTest.php | 127 +++++++++++++++++- openapi.json | 4 +- 4 files changed, 163 insertions(+), 26 deletions(-) diff --git a/apps/files_sharing/lib/Controller/PublicPreviewController.php b/apps/files_sharing/lib/Controller/PublicPreviewController.php index 24a537e110d1d..2d67743290f5e 100644 --- a/apps/files_sharing/lib/Controller/PublicPreviewController.php +++ b/apps/files_sharing/lib/Controller/PublicPreviewController.php @@ -17,8 +17,10 @@ use OCP\AppFramework\Http\RedirectResponse; use OCP\AppFramework\PublicShareController; use OCP\Constants; +use OCP\Files\File; use OCP\Files\Folder; use OCP\Files\NotFoundException; +use OCP\Files\NotPermittedException; use OCP\IPreview; use OCP\IRequest; use OCP\ISession; @@ -29,8 +31,7 @@ class PublicPreviewController extends PublicShareController { - /** @var IShare */ - private $share; + private IShare $share; public function __construct( string $appName, @@ -64,10 +65,13 @@ protected function isPasswordProtected(): bool { } /** - * Get a preview for a shared file + * Get a preview for a public share. + * + * For shares pointing to a single file, the $file parameter is ignored. + * For folder shares, $file must be the relative path to a file inside the shared folder. * * @param string $token Token of the share - * @param string $file File in the share + * @param string $file Relative path to a file inside a shared folder; ignored for single-file shares * @param int $x Width of the preview * @param int $y Height of the preview * @param bool $a Whether to not crop the preview @@ -122,27 +126,43 @@ public function getPreview( return new DataResponse([], Http::STATUS_FORBIDDEN); } + $previewFile = null; + try { - $node = $share->getNode(); - if ($node instanceof Folder) { - $file = $node->get($file); + $shareNode = $share->getNode(); + if ($shareNode instanceof Folder) { + if ($file === '') { + return new DataResponse([], Http::STATUS_BAD_REQUEST); + } + + $previewFile = $shareNode->get($file); + if ($previewFile instanceof Folder) { + return new DataResponse([], Http::STATUS_BAD_REQUEST); + } } else { - $file = $node; + $previewFile = $shareNode; } - $f = $this->previewManager->getPreview($file, $x, $y, !$a); - $response = new FileDisplayResponse($f, Http::STATUS_OK, ['Content-Type' => $f->getMimeType()]); + $preview = $this->previewManager->getPreview($previewFile, $x, $y, !$a); + $response = new FileDisplayResponse( + $preview, + Http::STATUS_OK, + ['Content-Type' => $preview->getMimeType()] + ); + $response->cacheFor($cacheForSeconds); return $response; - } catch (NotFoundException $e) { - // If we have no preview enabled, we can redirect to the mime icon if any - if ($mimeFallback) { - if ($url = $this->mimeIconProvider->getMimeIconUrl($file->getMimeType())) { + } catch (NotFoundException) { + // If a preview could not be generated for a resolved file, we can redirect to the mime icon if any + if ($mimeFallback && $previewFile instanceof File) { + if ($url = $this->mimeIconProvider->getMimeIconUrl($previewFile->getMimeType())) { return new RedirectResponse($url); } } return new DataResponse([], Http::STATUS_NOT_FOUND); - } catch (\InvalidArgumentException $e) { + } catch (NotPermittedException) { + return new DataResponse([], Http::STATUS_FORBIDDEN); + } catch (\InvalidArgumentException) { return new DataResponse([], Http::STATUS_BAD_REQUEST); } } @@ -200,8 +220,10 @@ public function directLink(string $token) { $response = new FileDisplayResponse($f, Http::STATUS_OK, ['Content-Type' => $f->getMimeType()]); $response->cacheFor(3600 * 24); return $response; - } catch (NotFoundException $e) { + } catch (NotFoundException) { return new DataResponse([], Http::STATUS_NOT_FOUND); + } catch (NotPermittedException) { + return new DataResponse([], Http::STATUS_FORBIDDEN); } catch (\InvalidArgumentException $e) { return new DataResponse([], Http::STATUS_BAD_REQUEST); } diff --git a/apps/files_sharing/openapi.json b/apps/files_sharing/openapi.json index c31231f8ee996..d9050db326cc3 100644 --- a/apps/files_sharing/openapi.json +++ b/apps/files_sharing/openapi.json @@ -1474,7 +1474,7 @@ "/index.php/apps/files_sharing/publicpreview/{token}": { "get": { "operationId": "public_preview-get-preview", - "summary": "Get a preview for a shared file", + "summary": "Get a preview for a public share", "tags": [ "public_preview" ], @@ -1500,7 +1500,7 @@ { "name": "file", "in": "query", - "description": "File in the share", + "description": "Relative path to a file inside a shared folder; ignored for single-file shares", "schema": { "type": "string", "default": "" diff --git a/apps/files_sharing/tests/Controller/PublicPreviewControllerTest.php b/apps/files_sharing/tests/Controller/PublicPreviewControllerTest.php index d8cbaed227fd1..17dd231f202e4 100644 --- a/apps/files_sharing/tests/Controller/PublicPreviewControllerTest.php +++ b/apps/files_sharing/tests/Controller/PublicPreviewControllerTest.php @@ -11,6 +11,7 @@ use OCP\AppFramework\Http; use OCP\AppFramework\Http\DataResponse; use OCP\AppFramework\Http\FileDisplayResponse; +use OCP\AppFramework\Http\RedirectResponse; use OCP\AppFramework\Utility\ITimeFactory; use OCP\Constants; use OCP\Files\File; @@ -33,6 +34,7 @@ class PublicPreviewControllerTest extends TestCase { private IManager&MockObject $shareManager; private ITimeFactory&MockObject $timeFactory; private IRequest&MockObject $request; + private IMimeIconProvider&MockObject $mimeIconProvider; private PublicPreviewController $controller; @@ -43,6 +45,7 @@ protected function setUp(): void { $this->shareManager = $this->createMock(IManager::class); $this->timeFactory = $this->createMock(ITimeFactory::class); $this->request = $this->createMock(IRequest::class); + $this->mimeIconProvider = $this->createMock(IMimeIconProvider::class); $this->timeFactory->method('getTime') ->willReturn(1337); @@ -55,7 +58,7 @@ protected function setUp(): void { $this->shareManager, $this->createMock(ISession::class), $this->previewManager, - $this->createMock(IMimeIconProvider::class), + $this->mimeIconProvider, ); } @@ -154,7 +157,7 @@ public function testShareNoDownloadButPreviewHeader() { $preview->method('getMimeType') ->willReturn('myMime'); - $res = $this->controller->getPreview('token', 'file', 10, 10, true); + $res = $this->controller->getPreview('token', 'file', 10, 10, true, false); $expected = new FileDisplayResponse($preview, Http::STATUS_OK, ['Content-Type' => 'myMime']); $expected->cacheFor(15 * 60); $this->assertEquals($expected, $res); @@ -190,7 +193,7 @@ public function testShareWithAttributes() { $preview->method('getMimeType') ->willReturn('myMime'); - $res = $this->controller->getPreview('token', 'file', 10, 10, true); + $res = $this->controller->getPreview('token', 'file', 10, 10, true, false); $expected = new FileDisplayResponse($preview, Http::STATUS_OK, ['Content-Type' => 'myMime']); $expected->cacheFor(3600 * 24); $this->assertEquals($expected, $res); @@ -222,7 +225,7 @@ public function testPreviewFile() { $preview->method('getMimeType') ->willReturn('myMime'); - $res = $this->controller->getPreview('token', 'file', 10, 10, true); + $res = $this->controller->getPreview('token', 'file', 10, 10, true, false); $expected = new FileDisplayResponse($preview, Http::STATUS_OK, ['Content-Type' => 'myMime']); $expected->cacheFor(3600 * 24); $this->assertEquals($expected, $res); @@ -248,11 +251,123 @@ public function testPreviewFolderInvalidFile(): void { ->with($this->equalTo('file')) ->willThrowException(new NotFoundException()); - $res = $this->controller->getPreview('token', 'file', 10, 10, true); + $res = $this->controller->getPreview('token', 'file', 10, 10, true, false); $expected = new DataResponse([], Http::STATUS_NOT_FOUND); $this->assertEquals($expected, $res); } + public function testPreviewFolderEmptyFileReturnsBadRequest(): void { + $share = $this->createMock(IShare::class); + $this->shareManager->method('getShareByToken') + ->with($this->equalTo('token')) + ->willReturn($share); + + $share->method('getPermissions') + ->willReturn(Constants::PERMISSION_READ); + + $folder = $this->createMock(Folder::class); + $share->method('getNode') + ->willReturn($folder); + + $share->method('canSeeContent') + ->willReturn(true); + + $res = $this->controller->getPreview('token', '', 10, 10, false, false); + $expected = new DataResponse([], Http::STATUS_BAD_REQUEST); + $this->assertEquals($expected, $res); + } + + public function testPreviewFolderSubfolderReturnsBadRequest(): void { + $share = $this->createMock(IShare::class); + $this->shareManager->method('getShareByToken') + ->with($this->equalTo('token')) + ->willReturn($share); + + $share->method('getPermissions') + ->willReturn(Constants::PERMISSION_READ); + + $folder = $this->createMock(Folder::class); + $share->method('getNode') + ->willReturn($folder); + + $share->method('canSeeContent') + ->willReturn(true); + + $subfolder = $this->createMock(Folder::class); + $folder->method('get') + ->with($this->equalTo('nested')) + ->willReturn($subfolder); + + $res = $this->controller->getPreview('token', 'nested', 10, 10, false, false); + $expected = new DataResponse([], Http::STATUS_BAD_REQUEST); + $this->assertEquals($expected, $res); + } + + public function testPreviewFolderInvalidFileWithMimeFallbackReturnsNotFound(): void { + $share = $this->createMock(IShare::class); + $this->shareManager->method('getShareByToken') + ->with($this->equalTo('token')) + ->willReturn($share); + + $share->method('getPermissions') + ->willReturn(Constants::PERMISSION_READ); + + $folder = $this->createMock(Folder::class); + $share->method('getNode') + ->willReturn($folder); + + $share->method('canSeeContent') + ->willReturn(true); + + $folder->method('get') + ->with($this->equalTo('file')) + ->willThrowException(new NotFoundException()); + + $this->mimeIconProvider->expects($this->never()) + ->method('getMimeIconUrl'); + + $res = $this->controller->getPreview('token', 'file', 10, 10, false, true); + $expected = new DataResponse([], Http::STATUS_NOT_FOUND); + $this->assertEquals($expected, $res); + } + + public function testPreviewFolderValidFileMimeFallbackRedirectsWhenPreviewMissing(): void { + $share = $this->createMock(IShare::class); + $this->shareManager->method('getShareByToken') + ->with($this->equalTo('token')) + ->willReturn($share); + + $share->method('getPermissions') + ->willReturn(Constants::PERMISSION_READ); + + $folder = $this->createMock(Folder::class); + $share->method('getNode') + ->willReturn($folder); + + $share->method('canSeeContent') + ->willReturn(true); + + $file = $this->createMock(File::class); + $folder->method('get') + ->with($this->equalTo('file')) + ->willReturn($file); + + $file->method('getMimeType') + ->willReturn('text/plain'); + + $this->previewManager->method('getPreview') + ->with($this->equalTo($file), 10, 10, true) + ->willThrowException(new NotFoundException()); + + $this->mimeIconProvider->method('getMimeIconUrl') + ->with('text/plain') + ->willReturn('/icon-url'); + + $res = $this->controller->getPreview('token', 'file', 10, 10, false, true); + $expected = new RedirectResponse('/icon-url'); + $this->assertEquals($expected, $res); + } + public function testPreviewFolderValidFile(): void { $share = $this->createMock(IShare::class); $this->shareManager->method('getShareByToken') @@ -284,7 +399,7 @@ public function testPreviewFolderValidFile(): void { $preview->method('getMimeType') ->willReturn('myMime'); - $res = $this->controller->getPreview('token', 'file', 10, 10, true); + $res = $this->controller->getPreview('token', 'file', 10, 10, true, false); $expected = new FileDisplayResponse($preview, Http::STATUS_OK, ['Content-Type' => 'myMime']); $expected->cacheFor(3600 * 24); $this->assertEquals($expected, $res); diff --git a/openapi.json b/openapi.json index d329d32c3ab62..981524e7e15ad 100644 --- a/openapi.json +++ b/openapi.json @@ -25605,7 +25605,7 @@ "/index.php/apps/files_sharing/publicpreview/{token}": { "get": { "operationId": "files_sharing-public_preview-get-preview", - "summary": "Get a preview for a shared file", + "summary": "Get a preview for a public share", "tags": [ "files_sharing/public_preview" ], @@ -25631,7 +25631,7 @@ { "name": "file", "in": "query", - "description": "File in the share", + "description": "Relative path to a file inside a shared folder; ignored for single-file shares", "schema": { "type": "string", "default": "" From c5af6e93294f73d077a9af7543b7b33bd4c460d4 Mon Sep 17 00:00:00 2001 From: Daniel Kesselberg Date: Thu, 9 Jul 2026 22:13:41 +0200 Subject: [PATCH 2/3] fixup! fix(files_sharing): validate input in PublicPreviewController#getPreview --- apps/files_sharing/openapi.json | 3 ++- openapi.json | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/apps/files_sharing/openapi.json b/apps/files_sharing/openapi.json index d9050db326cc3..db484a93aebc6 100644 --- a/apps/files_sharing/openapi.json +++ b/apps/files_sharing/openapi.json @@ -1474,7 +1474,8 @@ "/index.php/apps/files_sharing/publicpreview/{token}": { "get": { "operationId": "public_preview-get-preview", - "summary": "Get a preview for a public share", + "summary": "Get a preview for a public share.", + "description": "For shares pointing to a single file, the $file parameter is ignored. For folder shares, $file must be the relative path to a file inside the shared folder.", "tags": [ "public_preview" ], diff --git a/openapi.json b/openapi.json index 981524e7e15ad..c75354ce417c6 100644 --- a/openapi.json +++ b/openapi.json @@ -25605,7 +25605,8 @@ "/index.php/apps/files_sharing/publicpreview/{token}": { "get": { "operationId": "files_sharing-public_preview-get-preview", - "summary": "Get a preview for a public share", + "summary": "Get a preview for a public share.", + "description": "For shares pointing to a single file, the $file parameter is ignored. For folder shares, $file must be the relative path to a file inside the shared folder.", "tags": [ "files_sharing/public_preview" ], From a1c164784eb32facd5516f0e5ac7c377db2507b8 Mon Sep 17 00:00:00 2001 From: Daniel Kesselberg Date: Thu, 9 Jul 2026 22:23:38 +0200 Subject: [PATCH 3/3] fixup! fix(files_sharing): validate input in PublicPreviewController#getPreview --- .../lib/Controller/PublicPreviewController.php | 4 ++-- .../Controller/PublicPreviewControllerTest.php | 14 ++++++++++++++ 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/apps/files_sharing/lib/Controller/PublicPreviewController.php b/apps/files_sharing/lib/Controller/PublicPreviewController.php index 2d67743290f5e..de3b3daab4efa 100644 --- a/apps/files_sharing/lib/Controller/PublicPreviewController.php +++ b/apps/files_sharing/lib/Controller/PublicPreviewController.php @@ -97,7 +97,7 @@ public function getPreview( ) { $cacheForSeconds = 60 * 60 * 24; // 1 day - if ($token === '' || $x === 0 || $y === 0) { + if ($token === '' || $x < 1 || $y < 1) { return new DataResponse([], Http::STATUS_BAD_REQUEST); } @@ -136,7 +136,7 @@ public function getPreview( } $previewFile = $shareNode->get($file); - if ($previewFile instanceof Folder) { + if (!($previewFile instanceof File)) { return new DataResponse([], Http::STATUS_BAD_REQUEST); } } else { diff --git a/apps/files_sharing/tests/Controller/PublicPreviewControllerTest.php b/apps/files_sharing/tests/Controller/PublicPreviewControllerTest.php index 17dd231f202e4..ec159c4fc284d 100644 --- a/apps/files_sharing/tests/Controller/PublicPreviewControllerTest.php +++ b/apps/files_sharing/tests/Controller/PublicPreviewControllerTest.php @@ -83,6 +83,20 @@ public function testInvalidHeight(): void { $this->assertEquals($expected, $res); } + public function testNegativeWidth(): void { + $res = $this->controller->getPreview('token', 'file', -1, 10); + $expected = new DataResponse([], Http::STATUS_BAD_REQUEST); + + $this->assertEquals($expected, $res); + } + + public function testNegativeHeight(): void { + $res = $this->controller->getPreview('token', 'file', 10, -1); + $expected = new DataResponse([], Http::STATUS_BAD_REQUEST); + + $this->assertEquals($expected, $res); + } + public function testInvalidShare(): void { $this->shareManager->method('getShareByToken') ->with($this->equalTo('token'))