fix: Event creation could still throw uncaught exceptions

l10n/de.json

@@ -29,7 +29,8 @@
         "Organizer contains invalid characters.": "Der Organisator enthält ungültige Zeichen.",
         "Invalid organizer email address.": "Ungültige E-Mail-Adresse des Organisators.",
         "No writable calendar was found in your account. Create one in the Nextcloud Calendar app, then try again.": "In deinem Konto wurde kein beschreibbarer Kalender gefunden. Erstelle einen in der Nextcloud-Kalender-App und versuche es erneut.",
-        "The selected calendar is no longer writable. Pick another one and try again.": "Der ausgewählte Kalender ist nicht mehr beschreibbar. Wähle einen anderen aus und versuche es erneut."
+        "The selected calendar is no longer writable. Pick another one and try again.": "Der ausgewählte Kalender ist nicht mehr beschreibbar. Wähle einen anderen aus und versuche es erneut.",
+        "The event could not be created. Please try again.": "Das Meeting konnte nicht erstellt werden. Bitte versuche es erneut."
     },
     "pluralForms": "nplurals=2; plural=(n != 1);"
 }

l10n/de_DE.json

@@ -29,7 +29,8 @@
         "Organizer contains invalid characters.": "Der Organisator enthält ungültige Zeichen.",
         "Invalid organizer email address.": "Ungültige E-Mail-Adresse des Organisators.",
         "No writable calendar was found in your account. Create one in the Nextcloud Calendar app, then try again.": "In Ihrem Konto wurde kein beschreibbarer Kalender gefunden. Erstellen Sie einen in der Nextcloud-Kalender-App und versuchen Sie es erneut.",
-        "The selected calendar is no longer writable. Pick another one and try again.": "Der ausgewählte Kalender ist nicht mehr beschreibbar. Wählen Sie einen anderen aus und versuchen Sie es erneut."
+        "The selected calendar is no longer writable. Pick another one and try again.": "Der ausgewählte Kalender ist nicht mehr beschreibbar. Wählen Sie einen anderen aus und versuchen Sie es erneut.",
+        "The event could not be created. Please try again.": "Das Meeting konnte nicht erstellt werden. Bitte versuchen Sie es erneut."
     },
     "pluralForms": "nplurals=2; plural=(n != 1);"
 }

l10n/en.json

@@ -29,7 +29,8 @@
         "Organizer contains invalid characters.": "Organizer contains invalid characters.",
         "Invalid organizer email address.": "Invalid organizer email address.",
         "No writable calendar was found in your account. Create one in the Nextcloud Calendar app, then try again.": "No writable calendar was found in your account. Create one in the Nextcloud Calendar app, then try again.",
-        "The selected calendar is no longer writable. Pick another one and try again.": "The selected calendar is no longer writable. Pick another one and try again."
+        "The selected calendar is no longer writable. Pick another one and try again.": "The selected calendar is no longer writable. Pick another one and try again.",
+        "The event could not be created. Please try again.": "The event could not be created. Please try again."
     },
     "pluralForms": "nplurals=2; plural=(n != 1);"
 }

lib/AppInfo/Application.php

@@ -4,32 +4,9 @@ declare(strict_types=1);
 
 namespace OCA\AToCal\AppInfo;
 
-use OCA\AToCal\Controller\CalendarController;
 use OCP\AppFramework\App;
-use OCP\AppFramework\IAppContainer;
 
 class Application extends App
 {
     public const APP_ID = 'atocal';
-
-    public function __construct(array $urlParams = [])
-    {
-        parent::__construct(self::APP_ID, $urlParams);
-
-        $container = $this->getContainer();
-
-        $container->registerService(
-            CalendarController::class,
-            function (IAppContainer $c): CalendarController {
-                return new CalendarController(
-                    self::APP_ID,
-                    $c->get(\OCP\IRequest::class),
-                    $c->get(\OCP\Calendar\IManager::class),
-                    $c->get(\OCP\IUserSession::class),
-                    $c->get(\OCP\IURLGenerator::class),
-                    $c->get(\OCP\IDateTimeZone::class)
-                );
-            }
-        );
-    }
 }

lib/Controller/CalendarController.php

@@ -20,6 +20,7 @@ use OCP\IURLGenerator;
 use OCP\IUserSession;
 use OCP\IDateTimeZone;
 use OCP\IL10N;
+use Psr\Log\LoggerInterface;
 use Sabre\VObject\Reader;
 
 class CalendarController extends Controller
@@ -67,6 +68,7 @@ class CalendarController extends Controller
     private IURLGenerator $urlGenerator;
     private IDateTimeZone $dateTimeZone;
     private IL10N $l10n;
+    private LoggerInterface $logger;
 
     public function __construct(
         string $appName,
@@ -76,7 +78,8 @@ class CalendarController extends Controller
         IUserSession $userSession,
         IURLGenerator $urlGenerator,
         IDateTimeZone $dateTimeZone,
-        IL10N $l10n
+        IL10N $l10n,
+        LoggerInterface $logger
     ) {
         parent::__construct($appName, $request);
 
@@ -86,6 +89,7 @@ class CalendarController extends Controller
         $this->urlGenerator = $urlGenerator;
         $this->dateTimeZone = $dateTimeZone;
         $this->l10n = $l10n;
+        $this->logger = $logger;
     }
 
     /**
@@ -202,7 +206,27 @@ class CalendarController extends Controller
             );
         }
 
+        /*
+         * Backend failures, e.g. CalendarException, must not end
+         * in a generic 500 page. Log the cause, re-render the form.
+         */
+        try {
             $this->createEvent($calendar, $data);
+        } catch (\Throwable $e) {
+            $this->logger->error(
+                'Failed to create calendar event: ' . $e->getMessage(),
+                ['exception' => $e]
+            );
+
+            return $this->renderConfirm(
+                $data,
+                $calendars,
+                $calendarId,
+                $this->l10n->t(
+                    'The event could not be created. Please try again.'
+                )
+            );
+        }
 
         /*
          * Open the Nextcloud Calendar application if enabled,
@@ -535,11 +559,22 @@ class CalendarController extends Controller
 
     private function assertHttpsUrl(string $value, string $message): void
     {
+        /*
+         * filter_var() plus the regex reject whitespace, backslashes
+         * and non-ASCII characters: browsers may display those
+         * differently than PHP parses them, e.g. IDN homographs.
+         */
+        if (filter_var($value, FILTER_VALIDATE_URL) === false
+            || preg_match('/[^\x21-\x7E]|\\\\/', $value) === 1) {
+            throw new \InvalidArgumentException($message);
+        }
+
         $parts = parse_url($value);
 
         $valid = $parts !== false
             && isset($parts['scheme'], $parts['host'])
             && !isset($parts['user'])
+            && !isset($parts['pass'])
             && strtolower($parts['scheme']) === 'https'
             && $parts['host'] !== '';
 
@@ -595,7 +630,11 @@ class CalendarController extends Controller
     /**
      * Reject invalid UTF-8 and control characters. Newlines
      * (\n, \r) are only allowed where multi-line text is
-     * expected, e.g. the description.
+     * expected, e.g. the description. Also rejects Unicode
+     * spoofing characters: bidi overrides and line separators
+     * can make text display misleadingly. Format characters
+     * like the zero-width joiner (U+200D) stay allowed, emoji
+     * sequences need them.
      */
     private function assertClean(string $v, string $msg, bool $allowNewlines = false): void
     {
@@ -603,7 +642,13 @@ class CalendarController extends Controller
             ? '/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/'
             : '/[\x00-\x1F\x7F]/';
 
-        if (!mb_check_encoding($v, 'UTF-8') || preg_match($re, $v) === 1) {
+        if (!mb_check_encoding($v, 'UTF-8')
+            || preg_match($re, $v) === 1
+            || preg_match(
+                '/[\x{202A}-\x{202E}\x{2066}-\x{2069}\x{2028}\x{2029}\x{0085}]/u',
+                $v
+            ) === 1
+        ) {
             throw new \InvalidArgumentException($msg);
         }
     }