[Bug]: Improper input validation in PublicPreviewController triggers internal server error

[kesselb]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

An incomplete input validation in PublicPreviewController can trigger an internal server error.

Steps to reproduce

Case A

1. Create a public link for a folder
2. Send GET https://server33.internal/index.php/apps/files_sharing/publicpreview/{token}
3. 💥

server/apps/files_sharing/lib/Controller/PublicPreviewController.php

Lines 123 to 130 in 7e9e126

	$node = $share->getNode();
	if ($node instanceof Folder) {
	$file = $node->get($file);
	} else {
	$file = $node;
	}
	$f = $this->previewManager->getPreview($file, $x, $y, !$a);

• Default for $file is an empty string.
• $file = $node->get(''); is still an Folder instance
• getPreview expectes File

Case B

1. Create a public link for a folder
2. Send GET https://server33.internal/index.php/apps/files_sharing/publicpreview/{token}?file=notexist.png&mimeFallback=1
3. 💥

server/apps/files_sharing/lib/Controller/PublicPreviewController.php

Lines 122 to 142 in 7e9e126

	try {
	$node = $share->getNode();
	if ($node instanceof Folder) {
	$file = $node->get($file);
	} else {
	$file = $node;
	}
	$f = $this->previewManager->getPreview($file, $x, $y, !$a);
	$response = new FileDisplayResponse($f, Http::STATUS_OK, ['Content-Type' => $f->getMimeType()]);
	$response->cacheFor($cacheForSeconds);
	return $response;
	} catch (NotFoundException $e) {
	// If we have no preview enabled, we can redirect to the mime icon if any
	if ($mimeFallback) {
	if ($url = $this->mimeIconProvider->getMimeIconUrl($file->getMimeType())) {
	return new RedirectResponse($url);
	}
	}
	return new DataResponse([], Http::STATUS_NOT_FOUND);
	} catch (\InvalidArgumentException $e) {

• get and getPreview both throw NotFoundException.
• However the branch with mimetype fallback only works if the preview not exists, not if the node not exists.

Expected behavior

No internal server error