Security: State-changing GET endpoint is marked NoCSRFRequired and can be abused for CSRF-driven storage spam

[tomaioo]

Summary

Security: State-changing GET endpoint is marked NoCSRFRequired and can be abused for CSRF-driven storage spam

Problem

Severity: Medium | File: lib/Controller/ViewController.php:L70

getCalendarDotSvg is documented as @NoCSRFRequired and performs a write operation (newFile) in app data based on request input. Because this is a GET-style retrieval endpoint with side effects, a third-party site can trigger authenticated users' browsers to hit it repeatedly, causing unwanted file creation and potential storage exhaustion/DoS.

Solution

Make the endpoint side-effect free (serve generated SVG directly without persisting), or require POST with CSRF protection for writes. Add rate limiting and cleanup/overwrite logic to prevent unbounded file growth.

Changes

• lib/Controller/ViewController.php (modified)

[SebastianKrupinski]

Hi @tomaioo

Thank you for your PR, add letting us know about this.

Although your solution was on the right track, there was a better way to accomplish this. Normally we would discuss this here in the ticket, but since this was a security related issue/PR in public view, we had to act quickly. So I create a new PR with the alternate solution.

But we hope that you will contribute to our project in the future and hope you understand.

[SebastianKrupinski]

Closing in favour of #8223

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!