[Bug]: Using UUIDs for usernames breaks xml-api, if UUID starts with a digit.

[someone-somenet-org]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Using UUIDs for usernames breaks xml-api, if UUID starts with a digit (maybe every username that starts with a digit is broken?)

It does not seem to be broken, when using format=json (which doesnt help much, since the administrative account page uses the xml call)

I have been tinkering for many, many hours and finally came to this exception:

ValueError: XMLWriter::startElement(): Argument #2 must be a valid element name, "1CA11E1C-FAA5-4187-B46F-E06370ABF51F" given at /opt/nextcloud/lib/private/AppFramework/OCS/BaseResponse.php#139

Steps to reproduce

1. curl -u "admin:pw" -X GET 'https://.../ocs/v2.php/cloud/users/details?offset=0&limit=25&search=' -H "OCS-APIRequest: true" -v | less
2. Works
3. Create account 1CA11E1C-FAA5-4187-B46F-E06370ABF51F via admin account page.
4. curl -u "admin:pw" -X GET 'https://.../ocs/v2.php/cloud/users/details?offset=0&limit=25&search=' -H "OCS-APIRequest: true" -v | less
5. Document is empty now.

Expected behavior

That creating UUID or maybe in general account names that start with digits do not break the XML-API.

Nextcloud Server version

30

Operating system

RHEL/CentOS

PHP engine version

PHP 8.2

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

[joshtrichards]

That creating UUID or maybe in general account names that start with digits do not break the XML-API.

Confirmed. Any account name starting with a digit is impacted. And both v1 and v2 APIs impacted.

The error occurs because XML elements can't start with numbers.

It does not seem to be broken, when using format=json (which doesnt help much, since the administrative account page uses the xml call)

The admin Accounts page actually doesn't use xml. I expected this to immediately trigger problems in the Accounts UI too, but it doesn't. It is because it uses the json response as well. Instead of passing format=json it relies on passing the Accept: application/json header in the request to achieve the same thing. That may explain why this hasn't been more widely reported.