[Bug]: Calendar subscription event objects in database can have same calendar id as calendar event objects from other calendars

[akhil1508]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

This is a technical report and I'm unsure if it's a bug but it seems potentially dangerous to me. Not sure if the community forum is the right place to open such a discussion so I'm bringing it to GitHub.

1. If a user "user1" has a calendar with id 1 in database
2. And a user "user2" creates a calendar subscription with id 1 in database
3. The calendar objects of the subscription are stored with the calendar id 1

See

server/apps/dav/lib/CalDAV/WebcalCaching/RefreshWebcalService.php

Line 122 in d1d0070

$subscription['id'],

And

server/apps/dav/lib/CalDAV/WebcalCaching/RefreshWebcalService.php

Line 137 in d1d0070

$subscription['id'],

The calendar subscription id and the calendar id are both being used as foreign keys in the calendar objects table and they can clash. Is this intentional design or could it lead to some data of user2 being visible to user1 in some cases?

Steps to reproduce

1. Create two users "user1" and "user2" (in the same order) in a new nextcloud instance
2. Create a new calendar subscription for "user2"
3. Let the RefreshWebcalJob run to sync events for subscription
4. Check database for the calendar objects of the calendar subscription using

SELECT co.calendarid, c.principaluri AS calendar_principaluri, s.principaluri AS subscription_principaluri
FROM oc_calendarobjects co
JOIN oc_calendars c ON (c.id = co.calendarid) 
JOIN oc_calendarsubscriptions s ON (c.id = s.id)
WHERE co.calendartype=1 and s.principaluri = 'principals/users/user2'
AND c.principaluri = 'principals/users/user1';

I see something like

+------------+--------------------------------+--------------------------------+
| calendarid | calendar_principaluri          | subscription_principaluri      |
+------------+--------------------------------+--------------------------------+
|      1 | principals/users/user1 | principals/users/user2 |
|      1 | principals/users/user1 | principals/users/user2 |
|      1 | principals/users/user1 | principals/users/user2 |
....
+------------+--------------------------------+--------------------------------+
39 rows in set (0.003 sec)

Expected behavior

• A new calendar with a new id that stores only subscription data?

Nextcloud Server version

33

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response