HTTP 400 when trying to retrieve a file thumbnail

[stefan-niedermann]

Reproduce

1. Clone minimal sample app
2. Go to your Nextcloud web interface and get the URL of any preview of the files app
3. Replace the URL from the sample project in the request
4. Start app, choose the Account where the preview image is
5. Crash

Stacktrace

2020-10-16 10:01:16.338 2735-3878/com.nextcloud.client D/OwnCloudClient #0: REQUEST GET /index.php/core/preview
2020-10-16 10:01:16.338 2735-3878/com.nextcloud.client D/AdvancedSslSocketFactory: Creating SSL Socket with remote nextcloud.niedermann.it:443, local null:0, params: org.apache.commons.httpclient.params.HttpConnectionParams@50c4e27
2020-10-16 10:01:16.339 2735-3878/com.nextcloud.client D/AdvancedSslSocketFactory: ... with connection timeout 60000 and socket timeout 60000
2020-10-16 10:01:16.343 2735-7787/com.nextcloud.client D/OpenGLRenderer: endAllActiveAnimators on 0x7d4961319700 (RippleDrawable) with handle 0x7d49abde26c0
2020-10-16 10:01:16.347 2735-3878/com.nextcloud.client I/ServerNameIndicator: SSLSocket implementation: org.conscrypt.Java8FileDescriptorSocket
2020-10-16 10:01:16.347 2735-3878/com.nextcloud.client I/ServerNameIndicator: SNI done, hostname: nextcloud.niedermann.it
2020-10-16 10:01:16.961 2735-3878/com.nextcloud.client E/InputStreamBinder: []
2020-10-16 10:01:16.961 2735-3878/com.nextcloud.client E/InputStreamBinder: Error during Nextcloud request
 java.lang.IllegalStateException: CE_5
 at com.nextcloud.android.sso.InputStreamBinder.processRequestV2(InputStreamBinder.java:429)
 at com.nextcloud.android.sso.InputStreamBinder.performNextcloudRequestAndBodyStreamV2(InputStreamBinder.java:125)
 at com.nextcloud.android.sso.InputStreamBinder.performNextcloudRequestV2(InputStreamBinder.java:108)
 at com.nextcloud.android.sso.aidl.IInputStreamService$Stub.onTransact(IInputStreamService.java:134)
 at android.os.Binder.execTransactInternal(Binder.java:1021)
 at android.os.Binder.execTransact(Binder.java:994)
 Caused by: java.lang.IllegalStateException: 400
 at com.nextcloud.android.sso.InputStreamBinder.processRequestV2(InputStreamBinder.java:429) 
 at com.nextcloud.android.sso.InputStreamBinder.performNextcloudRequestAndBodyStreamV2(InputStreamBinder.java:125) 
 at com.nextcloud.android.sso.InputStreamBinder.performNextcloudRequestV2(InputStreamBinder.java:108) 
 at com.nextcloud.android.sso.aidl.IInputStreamService$Stub.onTransact(IInputStreamService.java:134) 
 at android.os.Binder.execTransactInternal(Binder.java:1021) 
 at android.os.Binder.execTransact(Binder.java:994) 
 Caused by: java.lang.IllegalStateException: []
 
 at com.nextcloud.android.sso.InputStreamBinder.processRequestV2(InputStreamBinder.java:429) 
 at com.nextcloud.android.sso.InputStreamBinder.performNextcloudRequestAndBodyStreamV2(InputStreamBinder.java:125) 
 at com.nextcloud.android.sso.InputStreamBinder.performNextcloudRequestV2(InputStreamBinder.java:108) 
 at com.nextcloud.android.sso.aidl.IInputStreamService$Stub.onTransact(IInputStreamService.java:134) 
 at android.os.Binder.execTransactInternal(Binder.java:1021) 
 at android.os.Binder.execTransact(Binder.java:994) 

Note, that avatars and Deck attachments can be fetched without any problems.

Context

I maintain a small library project (nextcloud-commons) which provides for example a integration with Glide (to load images via the SSO API to avoid authentication- and certificate issues).

The issue has been reported there and is reproducable with a minimal sample and without Glide.

cc @David-Development @tobiasKaminsky

[tobiasKaminsky]

I tried it and it does not crash.

I suspect that the url is "wrong":
/index.php/core/preview?fileId=71520&c=0bf5d05b8ddb80890d3835eb17f006e7&x=250&y=250&forceIcon=0"

Parameter c is a session id, which is to prevent csrf, so this may not be send from another client.
All request via SSO are authenticated on their own, so it is enough to send
/nc/index.php/core/preview?fileId=142780&x=1920&y=1200&a=true

I hope that helps.

P.S: 👏👏👏👏👏 for the project idea to simply reproduce it!

[stefan-niedermann]

I tried to remove the c parameter, but it doesn't make a difference for me. I also removed the forceIcon parameter and added the a=true parameter to get a similar URL like you, but in each case i get the 400 with the IllegalStateException.

Should i create a test account for you, so we can test whether or not this is an issue with the instance? (i doubt because the original reporter has also the issue, but you never know)...

[tobiasKaminsky]

Should i create a test account for you

Sure, but please test it first, if it really happens also there :)

[stefan-niedermann]

@tobiasKaminsky I just sent you the credentials for the test account (and yes, of course i made sure it is reproducible with it 😉 )

[tobiasKaminsky]

Hm. There it happens.
On Android Files we use "index.php/core/preview.png?file=/remoteh/path.jpg&x=1280&y=1024&a=1&mode=cover&forceIcon=0"

Maybe this other endpoint is not allowed via client?

[stefan-niedermann]

How is the browser then able to fetch it? Is this something that needs to be fixed upstream? I would expect a 401 instead of a 400 at least...?

[tobiasKaminsky]

Some endpoints are only internal, so they cannot be used via client, but only within php.
Not sure, if this is the case here…

@nextcloud/server-triage do you have an idea why we get a 400 here?

[matiasdelellis]

Hi everyone,
Just to add something. I originally use the same endpoint of nextcloud client... (The example with the fronted urls, was just to simplify the example.)

ie.: https://delellis.com.ar/core/preview.png?file=/Toucan.jpg&x=512&y=512

Now just test adding the part: &a=1&mode=cover&forceIcon=0, and the result is the same.. So it is independent of it... 😕

[tobiasKaminsky]

We need to add the parameter as a map to the request.
It is not allowed to add the url with query parameter.

Map<String, String> params = new HashMap<String, String>();
 params.put("file", "/Image.jpg");
 params.put("x", "400");
 params.put("y", "400");
 params.put("a", "1");
 params.put("mode", "cover");
 params.put("forceIcon", "0");
 
 requestBuilder = new NextcloudRequest.Builder()
 .setMethod("GET")
 .setUrl("/index.php/core/preview.png")
 .setParameter(params);
 NextcloudRequest nextcloudRequest = requestBuilder.build();

[stefan-niedermann]

Interesting. I will test this to confirm that this works. Maybe we can implement some magic in the NextcloudRequest.Builder to parse the query params automatically and add them as Map. If not, we can maybe directly throw a more meaningfil exception or at least add a paragraph to the REAMDE.md 😉 Thank you for invetigating, @tobiasKaminsky

[David-Development]

@stefan-niedermann Personally I would suggest throwing a more meaningful exception. Is there any reason why we would want to automatically parse urls with query parameters? There are probably some good use cases around the glide integration, right?

[stefan-niedermann]

An exception would be fine for me - then i will parse this in my integration library and do the magic there 🙂

[stefan-niedermann]

I thought it as a convenience feature, so other don't stumble upon it^^