Folder creation on server allows trailing whitespaces, breaks upload

[mga0]

⚠️ Before posting ⚠️

• This is a bug, not a question or an enhancement.
• I've searched for similar issues and didn't find a duplicate.
• I've written a clear and descriptive title for this issue, not just "Bug" or "Crash".
• I agree to follow Nextcloud's Code of Conduct.

Steps to reproduce

In the app, folder creation on server allows trailing whitespaces. This breaks following the upload of files to nextcloud server side.

How to reproduce:

1. In some user's server space, press "(+)" -> " New folder" -> Type a folder with a trailing whitespace (e.g "Test ")
2. Folder is created successfully with whitespace
3. Add some files to it
4. See the upload breaking with upload error "Unknown Error"
5. Check server's log, (below)

Expected behaviour

As some keywords have auto-completion with auto whitespace insertion, the folder name should be sanitized in the app before being sent to the server for folder creation.
Following, the upload will go through.

Actual behaviour

The upload breaks after some time in the upload section with error "Unknown Error"
Check server's log, (below)

Android version

14

Device brand and model

Pixel 5

Stock or custom OS?

Stock

Nextcloud android app version

34.1.1

Nextcloud server version

33.0.2

Using a reverse proxy?

Yes

Android logs

No response

Server error logs

Warning | PHP | file_put_contents(/data/myuser/files/Test /fdb98d809cd16c30d0ad66042794cf9b.ocTransferId922929805.part): Failed to open stream: Not a directory at /var/www/html/lib/private/Files/Storage/Local.php#306

Error | webdav | GenericFileExceptionFailed write stream to files/Test /fdb98d809cd16c30d0ad66042794cf9b.ocTransferId922929805.part
Error while writing stream to storage: Failed write stream to files/Test /fdb98d809cd16c30d0ad66042794cf9b.ocTransferId922929805.part

Error | no app in context | ExceptionError while copying file to target location (copied: -1 bytes, expected filesize: 2882130 bytes)

Additional information

No response

[tobiasKaminsky]

Thanks for reporting it.

I am a bit surprised about this log / filename, as Android does not add any "ocTransfer" or ".part"
/fdb98d809cd16c30d0ad66042794cf9b.ocTransferId922929805.part

Regarding fix:
I am unsure if we should trim trailing whitespace or make sure that server/app can indeed upload to such a folder.

[tobiasKaminsky]

I tested it now with a latest NC35 and it works.
REQUEST PUT /remote.php/dav/files/tobias/w%20/IMG_20260903_065515.jpg

Also chunked upload (big files) work.

May it be that your reverse proxy is doing somehing wrong?

[mga0]

Thanks for looking into it. I can do an upgrade to NC35 over the weekend if this helps. This would however break testing on the NC33.x as I don't want to set up a dev env.

I am unsure if we should trim trailing whitespace or make sure that server/app can indeed upload to such a folder.

Yes, I was also thinking about this.
IMO, both sides need to be hardened:
The app, as a user usually has not the intention to add spaces to folders (for me, my keyboard added unnoticed an auto-whitespace, causing several days of delay until I analyzed the issue) - and no one knows which other sloppily written applications will break when getting into contact with this folder down the line
but also app and server client, as unsanitized inputs are the first step to a command injection attack. When my whitespace is interpreted like an argument separator on the server, this observation here looks prone to a php code injection.

The reverse proxy is another source of misconfiguration, I'll have a look, but I am using a pretty standard swag setup here.