1716745 - Failure to add event to CalDAV calendar when UID of ICS event contains special characters - "/" etc.

Status: RESOLVED FIXED

(Calendar :: Provider: CalDAV, defect)

Description

[Pintoch]

Attachment: event_with_uri_as_uid.ics

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

1. Subscribe to a CalDAV calendar with Thunderbird (I use Baikal 0.8.0).
2. Open the following ICS file (produced by timeanddate.com) with Thunderbird and attempt to add the event to your CalDAV calendar:
   https://pintoch.ulminfo.fr/f43036d480/event_with_uri_as_uid.ics (also attached in this bug report)

Actual results:

The event is not added to the calendar, with no error message.
(If the ICS file was received as an email attachment and I tried to add it by clicking the "Add" button next in the "This message contains an event" banner, then I get the error message "Processing message failed. Status: 80004005." which is really not informative at all)

Expected results:

First, better error reporting is need. I would expect something like "This event could not be added to the calendar "My calendar". The server responded with 404 error, Calendar object not found."

Then, I would of course expect the event to actually be added to the calendar. The reason why this fails is that the ICS file contains a URL in the "UID" field, and Thunderbird constructs the CalDAV URL for the event by including this UID in the URL without sufficient escaping or sanitization:
https://my.baikal.instance.com/cal.php/calendars/my_calendar/default/http%3A//www.timeanddate.com/worldclock/fixedtime.html%3Fiso%3D20210720T1400%26msg%3DReconciliation%20CG%20July%20Meeting.ics

I believe the "/" character should be escaped as well.

If I open the ICS file with a text editor and replace the UID by something alphanumeric, Thunderbird successfully imports the event.

Comment 1

[Pintoch]

According to https://bugzilla.mozilla.org/show_bug.cgi?id=1663592, the "@" character also seems to cause issues.

Comment 2

[Pintoch]

Attachment: caldav-event-id-strip-special-chars

Unfortunately I could not build and test this (setting up the build environment took me hours and failed at because llvm-objdump could not be found), but I think this gives an idea of the sort of fix I would expect here.

Comment 3

[Janne Hakonen]

I encountered this when attempting to import an ICS event file to Nextcloud CalDAV calendar. Replacing "/" in UID with e.g. "-" allowed importing the event. Tested this against Nextcloud 29.0.2 with newest Thunderbird Beta 128.0b5 (64-bit).

Nextcloud responds with:

<?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
  <s:exception>Sabre\DAV\Exception\NotFound</s:exception>
  <s:message>Calendar object not found</s:message>
</d:error>

When Thunderbird tries to PUT to https://MY-DOMAIN/remote.php/dav/calendars/jhakonen/oma-kalenteri/b3fb70d5aa23/TRTX2GHM%40ajas.fi.ics with UID-line being UID:b3fb70d5aa23/[e-mail].

Comment 4

[Pintoch]

Attachment: Bug 1716745 - Fix CalDav import of ICS events with special characters in the UID. r=darktrojan

Makes sure the PUT request has a valid URL to avoid import errors.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/5d711ffba2a7
Fix CalDav import of ICS events with special characters in the UID. r=darktrojan

Comment 7

[Magnus Melin [:mkmelin]]

Comment on attachment 9410728 [details]
Bug 1716745 - Fix CalDav import of ICS events with special characters in the UID. r=darktrojan

[Approval Request Comment]
User impact if declined: per bug summary
Testing completed (on c-c, etc.): c-c, beta
Risk to taking this patch (and alternatives if risky): pretty safe

Comment 8

[Wayne Mery (:wsmwk)]

Comment on attachment 9410728 [details]
Bug 1716745 - Fix CalDav import of ICS events with special characters in the UID. r=darktrojan

[Triage Comment]
Approved for esr128

Comment 9

[Daniel Darnell [:dandarnell]]

Thunderbird 128.0.1esr:
https://hg.mozilla.org/releases/comm-esr128/rev/a71d4397f8b4