refactor: return 400 for propfind request when depth is neither 0 nor 1 (#403)

diff --git a/src/server.rs b/src/server.rs
index 3cb7996beb2327798ef88975e6484c51d9ed80aa..942da7d039477f78c5aeee638e8768562668e51a 100644 (file)
--- a/src/server.rs
+++ b/src/server.rs
@@ -963,9 +963,10 @@ impl Server {
     ) -> Result<()> {
         let depth: u32 = match headers.get("depth") {
             Some(v) => match v.to_str().ok().and_then(|v| v.parse().ok()) {
-                Some(v) => v,
-                None => {
-                    status_bad_request(res, "");
+                Some(0) => 0,
+                Some(1) => 1,
+                _ => {
+                    status_bad_request(res, "Invalid depth: only 0 and 1 are allowed.");
                     return Ok(());
                 }
             },
@@ -975,7 +976,7 @@ impl Server {
             Some(v) => vec![v],
             None => vec![],
         };
-        if depth != 0 {
+        if depth == 1 {
             match self
                 .list_dir(path, &self.args.serve_path, access_paths)
                 .await

diff --git a/tests/webdav.rs b/tests/webdav.rs
index 1230419325bb4dbc4ec3a410e7da2989d518eacd..9f74916e699577b9ff8abd51cbfc9bd54db41f35 100644 (file)
--- a/tests/webdav.rs
+++ b/tests/webdav.rs
@@ -40,6 +40,17 @@ fn propfind_dir_depth0(server: TestServer) -> Result<(), Error> {
     Ok(())
 }
 
+#[rstest]
+fn propfind_dir_depth2(server: TestServer) -> Result<(), Error> {
+    let resp = fetch!(b"PROPFIND", format!("{}dir1", server.url()))
+        .header("depth", "2")
+        .send()?;
+    assert_eq!(resp.status(), 400);
+    let body = resp.text()?;
+    assert_eq!(body, "Invalid depth: only 0 and 1 are allowed.");
+    Ok(())
+}
+
 #[rstest]
 fn propfind_404(server: TestServer) -> Result<(), Error> {
     let resp = fetch!(b"PROPFIND", format!("{}404", server.url())).send()?;