fix(dav): harden authorization and bounded PROPFIND semantics

backend/api/dav.py

@@ -1,4 +1,5 @@
 import logging
+import re
 from html import escape as escape_xml_text
 from urllib.parse import unquote
 
@@ -14,14 +15,30 @@
 router = APIRouter(prefix="/dav", tags=["dav"])
 
 
+_INVALID_PERCENT_ESCAPE = re.compile(r"%(?![0-9A-Fa-f]{2})")
+_NESTED_PERCENT_ESCAPE = re.compile(r"%(?=[0-9A-Fa-f]{2})")
+
+
 def _normalize_dav_authorization_path(path: str) -> str:
+    # RFC 3986 §2.4: never decode the same string more than once. Decode
+    # exactly once, then reject ambiguous nested encodings instead of
+    # collapsing them with a recursive-unquote loop (CWE-174).
     normalized_path = path.replace("\\", "/")
-    for _ in range(100):
-        decoded_path = unquote(normalized_path).replace("\\", "/")
-        if decoded_path == normalized_path:
-            return normalized_path
-        normalized_path = decoded_path
-    raise HTTPException(status_code=400, detail="DAV path decoding limit exceeded")
+    try:
+        decoded_path = unquote(normalized_path, errors="strict").replace("\\", "/")
+    except UnicodeDecodeError as exc:
+        raise HTTPException(
+            status_code=400, detail="DAV path contains invalid percent encoding"
+        ) from exc
+    if _INVALID_PERCENT_ESCAPE.search(decoded_path):
+        raise HTTPException(
+            status_code=400, detail="DAV path contains invalid percent encoding"
+        )
+    if decoded_path != normalized_path and _NESTED_PERCENT_ESCAPE.search(decoded_path):
+        raise HTTPException(
+            status_code=400, detail="DAV path contains nested percent encoding"
+        )
+    return decoded_path
 
 
 def _dav_path_owner_user_id(path: str) -> str | None:

backend/tests/test_dav_api.py

@@ -1,8 +1,11 @@
 import defusedxml.ElementTree as ET
 
 import pytest
+from fastapi import HTTPException
 from fastapi.testclient import TestClient
 
+from api.dav import _normalize_dav_authorization_path
+
 from main import app
 from services.webdav_service import webdav_service
 
@@ -201,3 +204,21 @@ async def run_handler():
             found_in_logs = True
 
     assert found_in_logs, "DAV Request log was not found"
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        "/%252e%252e/bob",
+        "/%25252e%25252e/bob",
+        "/alice%255c..%255c..%255cbob",
+    ],
+)
+def test_normalize_dav_authorization_path_rejects_nested_encoding(path: str) -> None:
+    with pytest.raises(HTTPException):
+        _normalize_dav_authorization_path(path)
+
+
+def test_normalize_dav_authorization_path_single_decode_round_trip() -> None:
+    assert _normalize_dav_authorization_path("/alice/docs") == "/alice/docs"
+    assert _normalize_dav_authorization_path("/%2e%2e/bob") == "/../bob"