Files with '+' (plus sign) trigger unlogged internal server errors

[CyrilBrulebois]

Steps to reproduce

1. Create a new text file named foo+bar.txt

Expected behaviour

There should be no errors.

Actual behaviour

The web interface gets an An error occurred! popup, whose whole content is: An internal server error occurred.

Unfortunately, there are no application logs in data/nextcloud.log, so nothing to report on the web interface's admin section.

On the webserver:

192.168.122.100 - - [05/Aug/2019:15:53:37 +0200] "PUT /remote.php/dav/files/kibi/foo+bar.txt HTTP/1.0" 201 661 "-" "Mozilla/5.0 [TRUNCATED]"
192.168.122.100 - - [05/Aug/2019:15:53:37 +0200] "PROPFIND /remote.php/dav/files/kibi/foo+bar.txt HTTP/1.0" 207 1828 "-" "Mozilla/5.0 [TRUNCATED]"

Thanks to either Chromium or Firefox integrated web tools, the PROPFIND request looks like this:

<d:multistatus xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns" xmlns:oc="http://owncloud.org/ns" xmlns:nc="http://nextcloud.org/ns">
  <d:response>
    <d:href>/remote.php/dav/files/kibi/foo%2bbar.txt</d:href>
    <d:propstat>
      <d:prop>
          [TRUNCATED]
      </d:prop>
      <d:status>HTTP/1.1 200 OK</d:status>
    <d:propstat>
      <d:prop><nc:is-encrypted/></d:prop>
    <d:status>HTTP/1.1 404 Not Found</d:status>
    </d:propstat>
  </d:response>
</d:multistatus>

This issue seems very related to the existing one #15849, but it seems much more generic as there are no specific/external storage enabled, thus filing separately.

Other consequences:

• Trying to edit the text file would trigger an error.
• Trying to adjust properties like sharing would lead to a spinner and a never-ending loop.

Trying to force a file scan (occ files:scan) doesn't change anything.

Server configuration

Operating system: Linux

Web server: Apache2

Database: MariaDB 10

PHP version: 7.3

Nextcloud version: 16.0.3

Updated from an older Nextcloud/ownCloud or fresh install: fresh install

Where did you install Nextcloud from: https://download.nextcloud.com/

Signing status: No errors have been found.

List of activated apps:

sudo -u www-data php occ app:list

Enabled:

• accessibility: 1.2.0
• activity: 2.9.1
• bruteforcesettings: 1.4.0
• calendar: 1.7.0
• cloud_federation_api: 0.2.0
• comments: 1.6.0
• contacts: 3.1.3
• dav: 1.9.2
• federatedfilesharing: 1.6.0
• federation: 1.6.0
• files: 1.11.0
• files_pdfviewer: 1.5.0
• files_rightclick: 0.13.0
• files_sharing: 1.8.0
• files_texteditor: 2.8.0
• files_trashbin: 1.6.0
• files_versions: 1.9.0
• files_videoplayer: 1.5.0
• firstrunwizard: 2.5.0
• gallery: 18.3.0
• logreader: 2.1.0
• lookup_server_connector: 1.4.0
• nextcloud_announcements: 1.5.0
• notifications: 2.4.1
• oauth2: 1.4.2
• password_policy: 1.6.0
• privacy: 1.0.0
• provisioning_api: 1.6.0
• recommendations: 0.4.0
• serverinfo: 1.6.0
• sharebymail: 1.6.0
• support: 1.0.0
• survey_client: 1.4.0
• systemtags: 1.6.0
• theming: 1.7.0
• twofactor_backupcodes: 1.5.0
• updatenotification: 1.6.0
• user_ldap: 1.6.0
• viewer: 1.0.0
• workflowengine: 1.6.0
  Disabled:
• admin_audit
• encryption
• files_external

Nextcloud configuration:

{
    "system": {
        "trusted_domains": [
            "RE.MO.VED"
        ],
        "dbtype": "mysql",
        "version": "16.0.3.0",
        "overwrite.cli.url": "http:\/\/localhost",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "installed": true,
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "redis": {
            "port": "6379"
        },
        "updater.release.channel": "production",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "ldapIgnoreNamingRules": false,
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory"
    }
}

Are you using external storage, if yes which one: no

Are you using encryption: HTTPS layer, no file storage side encryption

Are you using an external user-backend, if yes which one: LDAP

Client configuration

Browser: Firefox 60.8, Chromium 73

Operating system: Linux

Logs

Web server error log

As mentioned above, no error logs…

Nextcloud log (data/nextcloud.log)

And no nextcloud logs either.

Browser log

Already quoted in the introductory section.

[skjnldsv]

Hey :)

Does this fixes your issue? #15849 (comment)

[CyrilBrulebois]

I've just tried applying that patch on top of my 16.0.3 instance, but that doesn't seem to be fixing anything unfortunately. I've also tried to use str_ireplace() to make sure both %2B and %2b would be converted to +, without luck.

Edit: To clarify, I tested mostly creating new text files with a single + in their names, like foo+bar.txt, bar+bar.txt, etc. And noticed the same 400 errors when they get added.

[skjnldsv]

Thanks for trying :)

1. Create a new text file named foo+bar.txt

From the web ui or in desktop then sync?

[CyrilBrulebois]

This is from the web UI, with either Firefox or Chromium. (I thought it would be the easiest to document, as that's independent of the actual sync client/version.)

[skjnldsv]

I cannot reproduce on 16/17 🤔
Can you upgrade to your latest stable nextcloud and test again? :)

[CyrilBrulebois]

At first I wasn't sure whether this could be related to some rewrite rules (the quoted configuration should show Pretty URLs were enabled)… I'll try and come up with a minimal reproducer that I'll test in a VM, as opposed to a full-fledged production-ready instance I've been reporting this from.

[ghost]

This issue has been automatically marked as stale because it has not had recent activity and seems to be missing some essential information. It will be closed if no further activity occurs. Thank you for your contributions.