getrruleset has no limiter, potential DoS

[pbiering]

vobject's getrruleset has no limiter inside:

vobject/vobject/icalendar.py

Line 410 in 8ebd737

def getrruleset(self, addRDate=False):

This can cause a potential DoS if e.g. COUNT is too high or FREQ in combination with UNTIL creates too many entries.

Found in radicale by Kozea/Radicale#2188

Suggestion: add an optional parameter to be able to provide a limit while calling the function, otherwise workarounds are needed like parsing COUNT or calculate outside using FREQ and UNTIL.

[pbiering]

Suggestions for sanity checks:

• validate RRULE syntax in general (potentially already done by vobject.icalendar.rrule.rrulestr)
• check COUNT against a (configurable) limit
• if DTSTART is provided:
  • UNTIL >= DTSTART
  • if FREQ given:
    • check (UNTIL-DTSTART)/interval(FREQ) against a (configurable) limit
• VTODO handling: missing DTSTART but RRULE with UNTIL is allowed?!
  (potentially more cases to be catched)

[da4089]

Heh. dateutil.rruleset.count() fails when given an RRULE without an UNTIL or COUNT:

File "<input>", line 1, in <module>
  File "/home/d/proj/py-vobject/.venv/lib/python3.14/site-packages/dateutil/rrule.py", line 187, in count
    for x in self:
             ^^^^
  File "/home/d/proj/py-vobject/.venv/lib/python3.14/site-packages/dateutil/rrule.py", line 1410, in _iter
    advance_iterator(ritem)
    ~~~~~~~~~~~~~~~~^^^^^^^
  File "/home/d/proj/py-vobject/.venv/lib/python3.14/site-packages/dateutil/rrule.py", line 1327, in __next__
    self.dt = advance_iterator(self.gen)
              ~~~~~~~~~~~~~~~~^^^^^^^^^^
  File "/home/d/proj/py-vobject/.venv/lib/python3.14/site-packages/dateutil/rrule.py", line 884, in _iter
    date = datetime.date.fromordinal(ii.yearordinal + i)
ValueError:` year must be in 1..9999, not 10000
>>>

[pbiering]

@da4089 - looks like you hit another bug? In radicale I used a slightly different code, not the function count():

                if not hasattr(component, "dtstart"):
                    # e.g. VTODO
                    rrule = vobject.icalendar.rrule.rrulestr(component.rrule.value)
                else:
                    dtstart = radicale_filter.date_to_datetime(component.dtstart.value)
                    ignoretz = (
                        not isinstance(dtstart, datetime.datetime)
                        or dtstart.tzinfo is None
                    )
                    rrule = vobject.icalendar.rrule.rrulestr(component.rrule.value, ignoretz=ignoretz)
                # early check of maximum of COUNT to avoid DoS (workaround)
                if hasattr(rrule, "_count") and rrule._count is not None:
                  ...

[da4089]

In concept, I think the right thing to do here is to return a batch of results (like an SQL cursor), with the option of requesting further batches if you wish. The DATE-TIME of the last entry in the returned batch could be used as the starting point for the next batch.

But vobject currently has no direct access to the recurrence info at all: you have to use the dateutil functionality. dateutil.rruleset.xafter() seems like it does roughly the right thing?

import vobject

# An infinitely long recurrence of weekly events.
raw = "BEGIN:VCALENDAR\r\n" \
      + "VERSION:2.0\r\n" \
      + "PRODID:test\r\n" \
      + "BEGIN:VEVENT\r\n" \
      + "UID:test\r\n" \
      + "DTSTART:20000101T000000Z\r\n" \
      + "DURATION:PT1H\r\n" \
      + "DTSTAMP:20000101T000000Z\r\n" \
      + "RDATE;VALUE=PERIOD:20000102T000000Z/PT2H\r\n" \
      + "RRULE:FREQ=WEEKLY\r\n" \
      + "END:VEVENT\r\n" \
      + "END:VCALENDAR\r\n"

# Parse and extract the RRULE.
obj = vobject.readOne(raw)
vevent = obj.contents['vevent'][0]
rruleset = vevent.getrruleset()

# Set starting timestamp to DTSTART of recurrence.
start = vevent.dtstart.value

# Fetch first 10 recurrences (inc=True to include the first recurrence).
a = list(rruleset.xafter(start, 10, True))

# Advance starting point to the timestamp of the last-fetched recurrence.
start = a[-1]

# Fetch next 10 recurrences.
b = list(rruleset.xafter(start, 10))

[da4089]

That does however reveal another bug: the RDATE, which adds an out-of-sequence recurrence on 2000-01-02, does not appear to be parsed (by readOne).

The results appear to be 2000-01-01, 2000-01-08, etc.

[da4089]

Also, xafter appears to just return the datetime instance for the recurrence, but RDATE allows for recurrences with a non-standard duration. In the example above, the default weekly recurrence is for one hour, but the RDATE additional recurrence is a two hour event.