[Bug]: TypeError in Sabre when handling DAV HEAD range, breaks e.g. fast PDF loading

[hubimuc]

Steps to reproduce

Create a public Nextcloud share link for a single PDF file (not folder).
Access the public DAV endpoint (e.g. viewer or HEAD request on /public.php/dav/files/<token>).
Observe slow load and server log TypeError.

CorePlugin::httpGet() sets $body = '' for HEAD but does not convert it to a stream. Later, range handling calls stream_get_meta_data($body) which fails on string bodies. This breaks range support used by PDF viewers, causing very slow loads.

This issue relates to nextcloud/3rdparty#2241

Pull request in Nextcloud nextcloud/3rdparty#2241 with proposed fix to initialize $body = fopen('php://temp', 'r+');

public function httpGet(RequestInterface $request, ResponseInterface $response)
{
$path = $request->getPath();
$node = $this->server->tree->getNodeForPath($path);

    if (!$node instanceof IFile) {
        return;
    }

    if ('HEAD' === $request->getHeader('X-Sabre-Original-Method')) {
        $body = fopen('php://temp', 'r+');
    } else {
        $body = $node->get();

[alecpl]

According to https://datatracker.ietf.org/doc/html/rfc7233#section-3.1 "A server MUST ignore a Range header field received with a request method other than GET.". So, the proposed fix is not the only approach, and the fix belongs in Server::getHTTPRange() which should return null on all request methods other than GET.

[hubimuc]

So in Server.php modified comment and introductory code:

/**
* Returns the HTTP range header.
*
* This method returns null if there is no well-formed HTTP Range request
* header, if the header cannot be parsed, or if the request method does
* not permit Range processing (i.e. any method other than GET)
* Please refer to RFC 7233 section 3.1.
* Otherwise, it returns array($start, $end).
*
* The first number is the offset of the first byte in the range.
* The second number is the offset of the last byte in the range.
*
* If the second offset is null, it should be treated as the offset of the last byte of the entity
* If the first offset is null, the second offset should be used to retrieve the last x bytes of the entity
*
* @return int[]|null
*/

public function getHTTPRange()
{
    $method = $this->httpRequest->getHeader('X-Sabre-Original-Method')
        ?: $this->httpRequest->getMethod();

    if ('GET' !== strtoupper($method)) {
        return null; // MUST ignore Range on non-GET (RFC 7233 §3.1)
    }
    ...

and no further change required. Correct?
(This assumes that all Range processing in sabre/dav goes through Server::getHTTPRange(). If that assumption holds (as it currently appears), no further changes are required.)

[alecpl]

Yes. From what I see it does not break any existing tests, but it would be good to add a tests for this, probably somewhere in tests/Sabre/DAV/ServerRangeTest.php.