keeweb icon indicating copy to clipboard operation
keeweb copied to clipboard

Webdav validation does not allow relative files

Open slurdge opened this issue 3 years ago • 0 comments

The webdav provider provides validation for all its fields, which is a good thing. However the URL validation regular expression is a bit too narrow as it won't allow to open files relative to the server where the file is served. I'm refreshing my keepass+webdav docker file (see here for old version https://github.com/slurdge/docker-keewebdav) and it will force me to type https://example.com/file.kdbx instead of just file.kdbx

fields: [
    {
        id: 'path',
        title: 'openUrl',
        desc: 'openUrlDesc',
        type: 'text',
        required: true,
        pattern: '^https://.+'
    },

Current line is there: https://github.com/keeweb/keeweb/blob/dfc6201285ec1dfecd2e8f80363d82811e75bc6d/app/scripts/storage/impl/storage-webdav.js#L24

It is not coherent with the displayed message, which states:

https://server/path/file.kdbx, or just file.kdbx

I understand the reasoning behind having a https for secure communication, but I don't see the added security as the kdbx should be strong by itself. However as a middle ground I think the following regexp would be better:

 pattern: '(^https://.+)|([^\:]+\.kdbx)'

Or some other regexp that would allow relative paths. The fact that https is mandatory makes it also cumbersome to test locally in some cases, but this can be easily worked around with self signed certificates.

slurdge avatar Jan 08 '22 21:01 slurdge