Bug 513730 - KIO WebDAV client corrupts file contents by overwriting them with the XML body of a PROPFIND request when permission errors or specific server responses occur.
Summary: KIO WebDAV client corrupts file contents by overwriting them with the XML bod...
Status: RESOLVED UNMAINTAINED
Alias: None
Product: frameworks-kio
Classification: Frameworks and Libraries
Component: WebDAV (other bugs)
Version First Reported In: 5.26.0
Platform: Neon Linux
: NOR grave
Target Milestone: ---
Assignee: KIO Bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-12-23 07:15 UTC by sergey mironov
Modified: 2026-01-05 16:58 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed/Implemented In:
Sentry Crash Report:


Attachments
file contain rewrited xml - ori must b empty (167 bytes, text/plain)
2025-12-23 07:15 UTC, sergey mironov
Details

Note You need to log in before you can comment on or make changes to this bug.
Description sergey mironov 2025-12-23 07:15:56 UTC
Created attachment 187891 [details]
file contain rewrited xml - ori must b empty

**Summary**
KIO WebDAV client corrupts file contents by overwriting them with the XML body of a PROPFIND request when permission errors or specific server responses occur.

**Description**
When using Dolphin to create or edit a file on a WebDAV server (reproduced on a local Docker-based setup), the resulting file content becomes corrupted. Instead of the intended user data, the file is saved containing the XML payload of a PROPFIND request. This behavior indicates that an internal request buffer is being reused incorrectly.

**Actual behavior**
The file on the WebDAV server is overwritten with the following content:

```xml
<D:propfind xmlns:D="DAV:">
  <D:prop>
    <D:creationdate/>
    <D:getcontentlength/>
    <D:displayname/>
    <D:resourcetype/>
  </D:prop>
</D:propfind>
```

**Expected behavior**
The file must contain the actual data provided by the user.
If the server responds with an error (401, 403, 500, etc.), KIO must abort the operation and present an error message, rather than proceeding with a PUT request using an incorrect buffer.

**Steps to reproduce**

1. Connect to a WebDAV server in Dolphin using:
   `webdav://admin:admin@localhost:18080`
2. Ensure a permission mismatch on the server side (e.g. the target directory is owned by `root` on the host, while the Docker container runs as a non-root user).
3. Create a new text file or copy an existing file into this directory via Dolphin.
4. Inspect the file on the server (e.g. using `cat`) — the file content will be replaced by the PROPFIND XML payload.

**Additional information**

* `curl -T` with the same credentials works correctly.
* GNOME Nautilus (using `dav://` via GVFS) works correctly.
* This strongly suggests a race condition or buffer reuse bug in `kio_http` (or related KIO WebDAV code), where the request body of a metadata operation (PROPFIND) is mistakenly reused as the payload for a subsequent PUT request.

**Environment**

* OS: KDE neon 5.26 (Linux)
* KDE Plasma version: 5.26.0
* KDE Frameworks version: 5.99.0
Comment 1 TraceyC 2026-01-05 16:58:32 UTC
Your Neon installation includes Plasma and KIO versions that are now EOL. Please upgrade with the provided tools to the current Neon edition. Thank you for your understanding.