# rustls-webpki 0.101.7 — three advisories, all transitive via AWS SDK → rustls 0.21.12.
# aws-sdk-s3 1.x (latest) has not yet migrated to rustls 0.23.x; no upgrade path available.
# Severity: low — exploitation requires either a rogue CA or a MitM on AWS S3 infrastructure.
# RUSTSEC-2026-0104: DoS via panic in CRL parsing (only if CRLs are processed).
# RUSTSEC-2026-0098: URI name constraints ignored (requires CA misissuance).
# RUSTSEC-2026-0099: Wildcard name constraint bypass (requires CA misissuance).
"RUSTSEC-2026-0104",
"RUSTSEC-2026-0098",
"RUSTSEC-2026-0099",
# instant unmaintained — transitive via azure_core 0.21.0 (latest available).
# No direct security impact; no upgrade path exists.
"RUSTSEC-2024-0384",
The PROPFIND handlers (added in #153) handle the /caldav/{username}/ and
/carddav/{username}/ prefixes returned by discovery, but do so via an
expensive database call to distinguish usernames from UUIDs. The remaining
handlers (PUT, GET, DELETE, REPORT, PROPPATCH) don't handle the prefix
at all, causing 500 errors when standard clients (DAVx5, Apple Calendar,
Thunderbird) follow the discovery URLs.
This commit:
1. Adds a strip_username_prefix() helper that uses a UUID parse check
to distinguish collection IDs from usernames (no DB call needed).
2. Applies it to PUT, GET, DELETE, REPORT, and PROPPATCH handlers in
both caldav_handler.rs and carddav_handler.rs.
3. Refactors PROPFIND in both files to use the same UUID heuristic for
consistency, avoiding unnecessary database queries.
Includes 7 unit tests for the helper function.
Decode XML-escaped WOPI discovery action attributes before storing them
so generated editor URLs use real query separators instead of literal
& entities. Add regression coverage for parsed actions and generated
edit URLs.
When OIDC providers (e.g. Keycloak) use email addresses as usernames or
when claims.sub contains @ or other invalid characters, the username
padding and collision-suffix logic could introduce invalid characters.
The fix filters claims.sub through the same allowed-character filter
before using it in username construction.
FixesDioCrafts/OxiCloud#259
Edouard Vanbelle