Merge pull request #27 from jatoben/reject-mkcol-with-body

MKCOL with body should return 415 Unsupported Media Type
georgi · Jul 19, 2015 · 77d7e31 · 77d7e31
2 parents b4dcfc4 + 49f3125
commit 77d7e31
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/lib/rack_dav/controller.rb b/lib/rack_dav/controller.rb
@@ -83,6 +83,10 @@ def delete
     end
 
     def mkcol
+      # Reject message bodies - RFC2518:8.3.1
+      body = @request.body.read(8)
+      fail UnsupportedMediaType if !body.nil? && body.length > 0
+
       map_exceptions do
         resource.make_collection
       end

diff --git a/spec/controller_spec.rb b/spec/controller_spec.rb
@@ -364,6 +364,10 @@ def media_type_params
       multistatus_response('/d:propstat/d:prop/d:resourcetype/d:collection').should_not be_empty
     end
 
+    it 'should not create a collection with a body' do
+      mkcol('/folder', :input => 'body').should be_unsupported_media_type
+    end
+
     it 'should not find properties for nonexistent resources' do
       propfind('/non').should be_not_found
     end