WebDAV (Sardine) ignores the TLS trust configuration; no end-to-end TLS test coverage #125

Summary

The TLS trust configuration on NextcloudConnector — trustAllCertificates(boolean) and the new trustCertificate(...) / trustCertificates(...) — only affects the OCS HTTP client in ConnectorCommon. WebDAV requests go through Sardine, which builds its own HttpClient in AWebdavHandler.buildAuthSardine() and does not receive any of this trust material.

Impact

Against a server with a self-signed or private-CA certificate:

• OCS calls (shares, provisioning, config, group folders) can be made to work via trustAllCertificates / trustCertificate.
• WebDAV file/folder operations (upload, download, list, rename, delete) still fail certificate validation, so the library is only half-usable on such servers.

This is a pre-existing gap (it also applied to trustAllCertificates before the trustCertificate work), surfaced by the security review.

Proposed fix

• Build the Sardine client with an SSLContext derived from the same ServerConfig trust settings:
  • trustAllCertificates → trust-all SSLContext + no-op hostname verifier (matching the OCS behaviour), and
  • hasTrustedCertificates() → pinned-certificate SSLContext with hostname verification kept on.
• Sardine allows a custom client, e.g. new SardineImpl(httpClientBuilder) or by supplying an SSLContext/socket factory; wire the trust material through there.

Test coverage gap

There is currently no end-to-end TLS test at all (the Testcontainers rig serves HTTP), so none of the trust paths — OCS or WebDAV — are exercised over real TLS. Closing this needs an HTTPS-fronted test server:

• Front the Nextcloud test container with a TLS reverse proxy using a self-signed certificate (or enable HTTPS in the image), exposing the generated cert to the tests.
• Assert: default config rejects the self-signed cert; trustCertificate(thatCert) accepts it while still verifying hostname; trustAllCertificates accepts it.
• Assert the same for a WebDAV operation (upload/download), which will initially fail until the Sardine fix above is in place.

Notes

Related: security-review follow-ups (PRs #120, #121, #122, #123). Also related to #87 (lifecycle/shutdown) for how the WebDAV/Sardine clients are managed.