From 2e7909f03603d470f3127fd03d44ef236b746c36 Mon Sep 17 00:00:00 2001 From: Robin Appelman Date: Mon, 22 Jun 2026 20:04:14 +0200 Subject: [PATCH 1/2] perf: block all '{DAV:}' custom properties except for 'displayname' Signed-off-by: Robin Appelman --- apps/dav/lib/DAV/CustomPropertiesBackend.php | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/apps/dav/lib/DAV/CustomPropertiesBackend.php b/apps/dav/lib/DAV/CustomPropertiesBackend.php index 8be2af9da8062..f001ed3b32611 100644 --- a/apps/dav/lib/DAV/CustomPropertiesBackend.php +++ b/apps/dav/lib/DAV/CustomPropertiesBackend.php @@ -89,6 +89,15 @@ class CustomPropertiesBackend implements BackendInterface { '{http://owncloud.org/ns}enabled', ]; + /** + * Allowed properties for the dav namespace, all other properties in the namespace are ignored + * + * @var string[] + */ + private const ALLOWED_DAV_PROPERTIES = [ + '{DAV:}displayname', + ]; + /** * Properties set by one user, readable by all others * @@ -279,6 +288,9 @@ private function isPropertyAllowed(string $property): bool { if (in_array($property, self::IGNORED_PROPERTIES)) { return false; } + if (str_starts_with($property, '{DAV:}')) { + return in_array($property, self::ALLOWED_DAV_PROPERTIES); + } if (str_starts_with($property, '{http://owncloud.org/ns}') || str_starts_with($property, '{http://nextcloud.org/ns}')) { return in_array($property, self::ALLOWED_NC_PROPERTIES); } From 086c85d39092925acef03562618555e80ed4780c Mon Sep 17 00:00:00 2001 From: Robin Appelman Date: Mon, 22 Jun 2026 20:04:41 +0200 Subject: [PATCH 2/2] perf: block all '{http://open-collaboration-services.org/ns}' custom properties Signed-off-by: Robin Appelman --- apps/dav/lib/DAV/CustomPropertiesBackend.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apps/dav/lib/DAV/CustomPropertiesBackend.php b/apps/dav/lib/DAV/CustomPropertiesBackend.php index f001ed3b32611..d9e3572ce60a9 100644 --- a/apps/dav/lib/DAV/CustomPropertiesBackend.php +++ b/apps/dav/lib/DAV/CustomPropertiesBackend.php @@ -288,6 +288,9 @@ private function isPropertyAllowed(string $property): bool { if (in_array($property, self::IGNORED_PROPERTIES)) { return false; } + if (str_starts_with($property, '{http://open-collaboration-services.org/ns}')) { + return false; + } if (str_starts_with($property, '{DAV:}')) { return in_array($property, self::ALLOWED_DAV_PROPERTIES); }