https://bugs.kde.org/show_bug.cgi?id=513730
Bug ID: 513730
Summary: KIO WebDAV client corrupts file contents by
overwriting them with the XML body of a PROPFIND
request when permission errors or specific server
responses occur.
Classification: Frameworks and Libraries
Product: frameworks-kio
Version First unspecified
Reported In:
Platform: Neon
OS: Linux
Status: REPORTED
Severity: critical
Priority: NOR
Component: WebDAV
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected]
Target Milestone: ---
Created attachment 187891
--> https://bugs.kde.org/attachment.cgi?id=187891&action=edit
file contain rewrited xml - ori must b empty
**Summary**
KIO WebDAV client corrupts file contents by overwriting them with the XML body
of a PROPFIND request when permission errors or specific server responses
occur.
**Description**
When using Dolphin to create or edit a file on a WebDAV server (reproduced on a
local Docker-based setup), the resulting file content becomes corrupted.
Instead of the intended user data, the file is saved containing the XML payload
of a PROPFIND request. This behavior indicates that an internal request buffer
is being reused incorrectly.
**Actual behavior**
The file on the WebDAV server is overwritten with the following content:
```xml
<D:propfind xmlns:D="DAV:">
<D:prop>
<D:creationdate/>
<D:getcontentlength/>
<D:displayname/>
<D:resourcetype/>
</D:prop>
</D:propfind>
```
**Expected behavior**
The file must contain the actual data provided by the user.
If the server responds with an error (401, 403, 500, etc.), KIO must abort the
operation and present an error message, rather than proceeding with a PUT
request using an incorrect buffer.
**Steps to reproduce**
1. Connect to a WebDAV server in Dolphin using:
`webdav://admin:admin@localhost:18080`
2. Ensure a permission mismatch on the server side (e.g. the target directory
is owned by `root` on the host, while the Docker container runs as a non-root
user).
3. Create a new text file or copy an existing file into this directory via
Dolphin.
4. Inspect the file on the server (e.g. using `cat`) — the file content will be
replaced by the PROPFIND XML payload.
**Additional information**
* `curl -T` with the same credentials works correctly.
* GNOME Nautilus (using `dav://` via GVFS) works correctly.
* This strongly suggests a race condition or buffer reuse bug in `kio_http` (or
related KIO WebDAV code), where the request body of a metadata operation
(PROPFIND) is mistakenly reused as the payload for a subsequent PUT request.
**Environment**
* OS: KDE neon 5.26 (Linux)
* KDE Plasma version: 5.26.0
* KDE Frameworks version: 5.99.0
--
You are receiving this mail because:
You are watching all bug changes.
