starred/floccus

Fork 0

mirror of https://github.com/floccusaddon/floccus.git synced 2026-04-26 06:35:59 +03:00

[GH-ISSUE #1870] Does not verify content-length when chunked-encoding is used #1253

New issue

Closed

opened 2026-02-25 22:39:27 +03:00 by kerem · 2 comments

kerem commented

2026-02-25 22:39:27 +03:00

Owner

Originally created by @serious-angel on GitHub (Feb 27, 2025).
Original GitHub issue: https://github.com/floccusaddon/floccus/issues/1870

Which version of floccus are you using?

5.4.4

How many bookmarks do you have, roughly?

34000+

Are you using other means to sync bookmarks in parallel to floccus?

Sync method

WebDAV

Which browser are you using? In case you are using the phone App, specify the Android or iOS version and device please.

129.0.6668.100

Which version of Nextcloud Bookmarks are you using? (if relevant)

No response

Which version of Nextcloud? (if relevant)

No response

What kind of WebDAV server are you using? (if relevant)

RClone

Describe the Bug

Due to the WebDav connection interrupted, Floccus got only partial XBEL file and merged it with the local browser. The browser extension then uploaded the local changes to the remote, and that resulted in all the bookmarks across all the devices to annihilate the ~13600 bookmarks from all the clients with this extension installed.

That happened the moment I have been reviewing backups and the storage for months now, and if not the backup of 2024, I would lose all of them. Apparently, only ~5000 was gone, yet I have no idea what are those now.

I have no idea why not implement something like size verification via PROPFIND for such crucially important data people collect for years and trust your solutions also donating you money for it.

Not just that, but when I donated, I thought it will stop requesting for the donation regularly, but then I see the following, proving that no one cares:

github.com/floccusaddon/floccus@e116e861d5/src/lib/browser/BrowserController.js (L126-L132)

It's the second time it removes my bookmarks, ~~but you removed my issue from the issue tracker~~ (sorry, https://github.com/floccusaddon/floccus/issues/1697) I reported in ~2024 regarding XML parsing, where HTML title value parsing issues caused the XML to get malformed, you then fixed with: https://github.com/floccusaddon/floccus/commit/995a53b1b1cfc0aadb9203345ace49cf0baa1c9b

~~'Will remember you deleted my reported issue from your repository.~~
'Will not recommend it to anyone anymore.
'Regret I donated to lose my history.
'Deleted the extension and I appreciate you for it, the work and effort, but won't return back.

Stay safe.

Expected Behavior

Do not disrespectfully delete someone's history.

To Reproduce

Use Floccus.

Debug log provided

I have provided a debug log file

Originally created by @serious-angel on GitHub (Feb 27, 2025). Original GitHub issue: https://github.com/floccusaddon/floccus/issues/1870 ### Which version of floccus are you using? 5.4.4 ### How many bookmarks do you have, roughly? 34000+ ### Are you using other means to sync bookmarks in parallel to floccus? No ### Sync method WebDAV ### Which browser are you using? In case you are using the phone App, specify the Android or iOS version and device please. 129.0.6668.100 ### Which version of Nextcloud Bookmarks are you using? (if relevant) _No response_ ### Which version of Nextcloud? (if relevant) _No response_ ### What kind of WebDAV server are you using? (if relevant) RClone ### Describe the Bug Due to the WebDav connection interrupted, Floccus got only partial XBEL file and merged it with the local browser. The browser extension then uploaded the local changes to the remote, and that resulted in all the bookmarks across all the devices to annihilate the `~13600` bookmarks from all the clients with this extension installed. That happened the moment I have been reviewing backups and the storage for months now, and if not the backup of 2024, I would lose all of them. Apparently, only ~5000 was gone, yet I have no idea what are those now. I have no idea why not implement something like size verification via [PROPFIND](<http://www.webdav.org/specs/rfc2518.html#METHOD_PROPFIND>) for such crucially important data people collect for years and trust your solutions also donating you money for it. Not just that, but when I donated, I thought it will stop requesting for the donation regularly, but then I see the following, proving that no one cares: https://github.com/floccusaddon/floccus/blob/e116e861d57770a78ffb984d51a32d69e6c73dc5/src/lib/browser/BrowserController.js#L126-L132 It's the second time it removes my bookmarks, ~~but you removed my issue from the issue tracker~~ (sorry, https://github.com/floccusaddon/floccus/issues/1697) I reported in ~2024 regarding XML parsing, where HTML `title` value parsing issues caused the XML to get malformed, you then fixed with: <https://github.com/floccusaddon/floccus/commit/995a53b1b1cfc0aadb9203345ace49cf0baa1c9b> --- ![Image](https://github.com/user-attachments/assets/34888187-f478-4692-892a-19dc6d6c78b2) --- ~'Will remember you deleted my reported issue from your repository.~ 'Will not recommend it to anyone anymore. 'Regret I donated to lose my history. 'Deleted the extension and I appreciate you for it, the work and effort, but won't return back. Stay safe. ### Expected Behavior Do not disrespectfully delete someone's history. ### To Reproduce Use Floccus. ### Debug log provided - [ ] I have provided a debug log file

kerem

2026-02-25 22:39:27 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-25 22:39:28 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Feb 27, 2025):

Hello 👋

Thank you for taking the time to open this issue with floccus. I know it's frustrating when software
causes problems. You have made the right choice to come here and open an issue to make sure your problem gets looked at
and if possible solved.
I'm Marcel and I created floccus a few years ago, maintaining it ever since. I currently work for Nextcloud
which leaves me with less time for side projects like this one than I used to have.
I still try to answer all issues and if possible fix all bugs here, but it sometimes takes a while until I get to it.
Until then, please be patient.
Note also that GitHub is a place where people meet to make software better together. Nobody here is under any obligation
to help you, solve your problems or deliver on any expectations or demands you may have, but if enough people come together we can
collaborate to make this software better. For everyone.
Thus, if you can, you could also have a look at other issues to see whether you can help other people with your knowledge
and experience. If you have coding experience it would also be awesome if you could step up to dive into the code and
try to fix the odd bug yourself. Everyone will be thankful for extra helping hands!
To continue the development and maintenance of this project in a sustainable way I ask that you donate to the project when opening an issue
(or at least once your issue is solved), if you're not a donor already.
You can find donation options at https://floccus.org/donate/. Thank you!

One last word: If you feel, at any point, like you need to vent, this is not the place for it; you can go to the Nextcloud forum,
to twitter or somewhere else. But this is a technical issue tracker, so please make sure to
focus on the tech and keep your opinions to yourself.

I look forward to working with you on this issue
Cheers 💙

@github-actions[bot] commented on GitHub (Feb 27, 2025): Hello :wave: Thank you for taking the time to open this issue with floccus. I know it's frustrating when software causes problems. You have made the right choice to come here and open an issue to make sure your problem gets looked at and if possible solved. I'm Marcel and I created floccus a few years ago, maintaining it ever since. I currently work for Nextcloud which leaves me with less time for side projects like this one than I used to have. I still try to answer all issues and if possible fix all bugs here, but it sometimes takes a while until I get to it. Until then, please be patient. Note also that GitHub is a place where people meet to make software better *together*. Nobody here is under any obligation to help you, solve your problems or deliver on any expectations or demands you may have, but if enough people come together we can collaborate to make this software better. For everyone. Thus, if you can, you could also have a look at other issues to see whether you can help other people with your knowledge and experience. If you have coding experience it would also be awesome if you could step up to dive into the code and try to fix the odd bug yourself. Everyone will be thankful for extra helping hands! To continue the development and maintenance of this project in a sustainable way I ask that you donate to the project when opening an issue (or at least once your issue is solved), if you're not a donor already. You can find donation options at <https://floccus.org/donate/>. Thank you! One last word: If you feel, at any point, like you need to vent, this is not the place for it; you can go to the Nextcloud forum, to twitter or somewhere else. But this is a technical issue tracker, so please make sure to focus on the tech and keep your opinions to yourself. I look forward to working with you on this issue Cheers :blue_heart:

kerem commented

2026-02-25 22:39:28 +03:00

Author

Owner

@marcelklehr commented on GitHub (Feb 27, 2025):

Hello @serious-angel

first up, I'm truly sorry this happened to you. I do intend to do good with the software I develop, but there is never a guarantee that it does not contain bugs. I do care, though. It also affects me when things go wrong, believe me.

Secondly, I never deleted your issue from last year, I only closed it. Here it is: https://github.com/floccusaddon/floccus/issues/1697

Thirdly, yes, I regularly ask for donations because I think it's fair to ask for something in return for the time I spent on developing this. I cannot prevent the "ask for donations" page from showing for people that already donated, because I believe in privacy and don't want to track people in any way. I'm grateful for your donation, I do care.

Fourthly, coming to the technical side of this issue: Usually the browser will verify the content length of responses on its own, which is why I didn't implement any size verification so far. However, I now found out that if and only if chunked encoding is used for the response, the browser has no way of knowing how long the data to download is and if the response is cut off without the browser knowing ... here we are.

Know this: I will fix the issue, I'm sad to have disappointed a user.

Warm regards,
Marcel

@marcelklehr commented on GitHub (Feb 27, 2025): Hello @serious-angel first up, I'm truly sorry this happened to you. I do intend to do good with the software I develop, but there is never a guarantee that it does not contain bugs. I do care, though. It also affects me when things go wrong, believe me. Secondly, I never deleted your issue from last year, I only closed it. Here it is: https://github.com/floccusaddon/floccus/issues/1697 Thirdly, yes, I regularly ask for donations because I think it's fair to ask for something in return for the time I spent on developing this. I cannot prevent the "ask for donations" page from showing for people that already donated, because I believe in privacy and don't want to track people in any way. I'm grateful for your donation, I do care. Fourthly, coming to the technical side of this issue: Usually the browser will verify the content length of responses on its own, which is why I didn't implement any size verification so far. However, I now found out that if and only if chunked encoding is used for the response, the browser has no way of knowing how long the data to download is and if the response is cut off without the browser knowing ... here we are. Know this: I will fix the issue, I'm sad to have disappointed a user. Warm regards, Marcel

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/floccus#1253

No description provided.

Rows
Columns