Skip to content

fix: harden capabilities deserialization when sharing fields are missing #3166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
joshtrichards wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

fix: harden capabilities deserialization when sharing fields are missing #3166

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9441060
fix(Capabilities): make deserialization defensive and schema-tolerant
joshtrichards Apr 27, 2026
e540419
test(Capabilities): improve/expand deserializer tests
joshtrichards Apr 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
192 changes: 125 additions & 67 deletions ...src/main/java/it/niedermann/owncloud/notes/persistence/sync/CapabilitiesDeserializer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,93 +49,151 @@ public class CapabilitiesDeserializer implements JsonDeserializer<Capabilities>
public Capabilities deserialize(JsonElement json, Type typeOfT, JsonDeserializationContext context) throws JsonParseException {
final var response = new Capabilities();
final var data = json.getAsJsonObject();
if (data.has(VERSION)) {
final var version = data.getAsJsonObject(VERSION);
final var nextcloudMajorVersion = version.get("major");
response.setNextcloudMajorVersion(String.valueOf(nextcloudMajorVersion));

final var nextcloudMinorVersion = version.get("minor");
response.setNextcloudMinorVersion(String.valueOf(nextcloudMinorVersion));
deserializeVersion(data, response);


final var nextcloudMicroVersion = version.get("micro");
response.setNextcloudMicroVersion(String.valueOf(nextcloudMicroVersion));
if (!data.has(CAPABILITIES)) {
return response;
}

if (data.has(CAPABILITIES)) {
final var capabilities = data.getAsJsonObject(CAPABILITIES);
final var capabilities = data.getAsJsonObject(CAPABILITIES);

deserializeFilesSharing(capabilities, response);
deserializeNotes(capabilities, response);
deserializeTheming(capabilities, response);
deserializeDirectEditing(capabilities, response);
deserializeUserStatus(capabilities, response);

if (capabilities.has(CAPABILITIES_FILES_SHARING)) {
final var filesSharing = capabilities.getAsJsonObject(CAPABILITIES_FILES_SHARING);
final var federation = filesSharing.getAsJsonObject("federation");
final var outgoing = federation.get("outgoing");
return response;
}

response.setFederationShare(outgoing.getAsBoolean());
private void deserializeVersion(final JsonObject data, final Capabilities response) {
if (!data.has(VERSION)) {
return;
}

final var publicObject = filesSharing.getAsJsonObject("public");
if (publicObject.has("password")) {
final var password = publicObject.getAsJsonObject("password");
final var enforced = password.getAsJsonPrimitive("enforced");
final var askForOptionalPassword = password.getAsJsonPrimitive("askForOptionalPassword");
final var version = data.getAsJsonObject(VERSION);

response.setPublicPasswordEnforced(enforced.getAsBoolean());
response.setAskForOptionalPassword(askForOptionalPassword.getAsBoolean());
}
if (version.has("major")) {
response.setNextcloudMajorVersion(String.valueOf(version.get("major")));
}
if (version.has("minor")) {
response.setNextcloudMinorVersion(String.valueOf(version.get("minor")));
}
if (version.has("micro")) {
response.setNextcloudMicroVersion(String.valueOf(version.get("micro")));
}
}

private void deserializeFilesSharing(final JsonObject capabilities, final Capabilities response) {
if (!capabilities.has(CAPABILITIES_FILES_SHARING)) {
return;
}

final var isReSharingAllowed = filesSharing.getAsJsonPrimitive("resharing");
final var defaultPermission = filesSharing.getAsJsonPrimitive("default_permissions");
response.setDefaultPermission(defaultPermission.getAsInt());
response.setReSharingAllowed(isReSharingAllowed.getAsBoolean());
final var filesSharing = capabilities.getAsJsonObject(CAPABILITIES_FILES_SHARING);

if (filesSharing.has("federation")) {
final var federation = filesSharing.getAsJsonObject("federation");
if (federation.has("outgoing")) {
response.setFederationShare(federation.get("outgoing").getAsBoolean());
}
}

if (capabilities.has(CAPABILITIES_NOTES)) {
final var notes = capabilities.getAsJsonObject(CAPABILITIES_NOTES);
if (notes.has(CAPABILITIES_NOTES_API_VERSION)) {
response.setApiVersion(notes.get(CAPABILITIES_NOTES_API_VERSION).toString());
}
if (filesSharing.has("api_enabled")) {
final var shareApiEnabled = filesSharing.get("api_enabled");
if (!shareApiEnabled.getAsBoolean()) {
return;
}
if (capabilities.has(CAPABILITIES_THEMING)) {
final var theming = capabilities.getAsJsonObject(CAPABILITIES_THEMING);
if (theming.has(CAPABILITIES_THEMING_COLOR)) {
try {
response.setColor(Color.parseColor(ColorUtil.formatColorToParsableHexString(theming.get(CAPABILITIES_THEMING_COLOR).getAsString())));
} catch (Exception e) {
e.printStackTrace();
}
}

if (filesSharing.has("public")) {
final var publicObject = filesSharing.getAsJsonObject("public");
if (publicObject.has("password")) {
final var password = publicObject.getAsJsonObject("password");
if (password.has("enforced")) {
response.setPublicPasswordEnforced(password.getAsJsonPrimitive("enforced").getAsBoolean());
}
if (theming.has(CAPABILITIES_THEMING_COLOR_TEXT)) {
try {
response.setTextColor(Color.parseColor(ColorUtil.formatColorToParsableHexString(theming.get(CAPABILITIES_THEMING_COLOR_TEXT).getAsString())));
} catch (Exception e) {
e.printStackTrace();
}
if (password.has("askForOptionalPassword")) {
response.setAskForOptionalPassword(password.getAsJsonPrimitive("askForOptionalPassword").getAsBoolean());
}
}
response.setDirectEditingAvailable(hasDirectEditingCapability(capabilities));

if (capabilities.has(CAPABILITIES_USER_STATUS)) {
final var userStatus = capabilities.getAsJsonObject(CAPABILITIES_USER_STATUS);
if (userStatus.has(CAPABILITIES_SUPPORTS_BUSY)) {
final var userStatusSupportsBusy = userStatus.getAsJsonPrimitive(CAPABILITIES_SUPPORTS_BUSY);
if (userStatusSupportsBusy != null) {
response.setUserStatusSupportsBusy(userStatusSupportsBusy.getAsBoolean());
}
}
}

if (filesSharing.has("resharing")) {
response.setReSharingAllowed(filesSharing.getAsJsonPrimitive("resharing").getAsBoolean());
}

if (filesSharing.has("default_permissions")) {
response.setDefaultPermission(filesSharing.getAsJsonPrimitive("default_permissions").getAsInt());
}
}

private void deserializeNotes(final JsonObject capabilities, final Capabilities response) {
if (!capabilities.has(CAPABILITIES_NOTES)) {
return;
}

final var notes = capabilities.getAsJsonObject(CAPABILITIES_NOTES);
if (notes.has(CAPABILITIES_NOTES_API_VERSION)) {
response.setApiVersion(notes.get(CAPABILITIES_NOTES_API_VERSION).toString());
}
}

private void deserializeTheming(final JsonObject capabilities, final Capabilities response) {
if (!capabilities.has(CAPABILITIES_THEMING)) {
return;
}

final var theming = capabilities.getAsJsonObject(CAPABILITIES_THEMING);
if (theming.has(CAPABILITIES_THEMING_COLOR)) {
try {
response.setColor(Color.parseColor(ColorUtil.formatColorToParsableHexString(
theming.get(CAPABILITIES_THEMING_COLOR).getAsString()
)));
} catch (Exception e) {
e.printStackTrace();
}
}

if (theming.has(CAPABILITIES_THEMING_COLOR_TEXT)) {
try {
response.setTextColor(Color.parseColor(ColorUtil.formatColorToParsableHexString(
theming.get(CAPABILITIES_THEMING_COLOR_TEXT).getAsString()
)));
} catch (Exception e) {
e.printStackTrace();
}
}
return response;
}

private boolean hasDirectEditingCapability(final JsonObject capabilities) {
if (capabilities.has(CAPABILITIES_FILES)) {
final var files = capabilities.getAsJsonObject(CAPABILITIES_FILES);
if (files.has(CAPABILITIES_FILES_DIRECT_EDITING)) {
final var directEditing = files.getAsJsonObject(CAPABILITIES_FILES_DIRECT_EDITING);
if (directEditing.has(CAPABILITIES_FILES_DIRECT_EDITING_SUPPORTS_FILE_ID)) {
return directEditing.get(CAPABILITIES_FILES_DIRECT_EDITING_SUPPORTS_FILE_ID).getAsBoolean();
}
private void deserializeUserStatus(final JsonObject capabilities, final Capabilities response) {
if (!capabilities.has(CAPABILITIES_USER_STATUS)) {
return;
}

final var userStatus = capabilities.getAsJsonObject(CAPABILITIES_USER_STATUS);
if (userStatus.has(CAPABILITIES_SUPPORTS_BUSY)) {
final var userStatusSupportsBusy = userStatus.getAsJsonPrimitive(CAPABILITIES_SUPPORTS_BUSY);
if (userStatusSupportsBusy != null) {
response.setUserStatusSupportsBusy(userStatusSupportsBusy.getAsBoolean());
}
}
}

private void deserializeDirectEditing(final JsonObject capabilities, final Capabilities response) {
if (!capabilities.has(CAPABILITIES_FILES)) {
response.setDirectEditingAvailable(false);
return;
}

final var files = capabilities.getAsJsonObject(CAPABILITIES_FILES);
if (files.has(CAPABILITIES_FILES_DIRECT_EDITING)) {
final var directEditing = files.getAsJsonObject(CAPABILITIES_FILES_DIRECT_EDITING);
if (directEditing.has(CAPABILITIES_FILES_DIRECT_EDITING_SUPPORTS_FILE_ID)) {
response.setDirectEditingAvailable(
directEditing.get(CAPABILITIES_FILES_DIRECT_EDITING_SUPPORTS_FILE_ID).getAsBoolean()
);
}
}
return false;
}
}
Loading
Loading