Core Rule Set: Nextcloud's calendar and contacts sync pass (closes #280)

rproxy passes MKCALENDAR on. nextcloud.conf allows it on
/remote.php/dav/calendars/ and PROPFIND on /.well-known/caldav and
carddav. The XML of an MKCOL there skips 930120, 932120, 932250 and
932260. That of an MKCALENDAR, and of an MKCOL on the address books'
paths, also skips 932125 and 932230, for the description. A PUT of
text/calendar or text/vcard there skips 920530: the Calendar and
Contacts apps name the charset twice when they change an event or a
contact.

Recorded from Nextcloud 35.0.2 with Calendar 6.6.5, Contacts 8.9.5 and
requests imitating DAVx5.

Model: opus-5-5

SPEC.md

@@ -1346,6 +1346,35 @@ The changes hold in front of every app, and no setting undoes them:
     The XML body of a `SEARCH` on `/remote.php/dav/`, the Files app's search,
     skips the four rules.
 
+    The Calendar and Contacts apps, and CalDAV and CardDAV clients, use these
+    paths:
+    - `/remote.php/dav/calendars/`, which holds the calendars;
+    - `/remote.php/dav/addressbooks/`, which holds the address books.
+
+    There:
+    - `MKCALENDAR`, with which a CalDAV client makes a calendar, is allowed on
+      the calendars' paths only.
+    - The XML body of an `MKCOL` names a new calendar or address book. A new
+      address book's body may also hold its description. The body skips the four
+      rules. On the address books' paths, it also skips two rules that refused a
+      description such as `Powershell and python3 contacts; ls -la first`
+      (932125, 932230).
+    - The XML body of an `MKCALENDAR` holds the new calendar's name and
+      description. It skips the four rules, and two rules that refused a
+      description such as `Powershell and python3 meetings; ls -la first`
+      (932125, 932230).
+    - The body of a `PUT` of an event or a contact is not read, as for any `PUT`
+      on the WebDAV paths. So the Core Rule Set does not check an event's title,
+      location or description, or a contact's names.
+    - The Calendar and Contacts apps name the charset twice in the
+      `Content-Type` of the `PUT` that changes an event or a contact. A `PUT`
+      typed `text/calendar` or `text/vcard` skips 920530, the rule against two
+      charsets.
+
+    A CalDAV or CardDAV client finds these paths with a `PROPFIND` on
+    `/.well-known/caldav` or `/.well-known/carddav`. That method is allowed on
+    those two paths.
+
     These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
     applies to a JSON field when the query has a parameter of that name, such as
     `json.message`. Nextcloud's pages are matched at the site root and under
@@ -2034,13 +2063,17 @@ image runs it by default (see "Deployment").
 - `SEARCH`
 - `LOCK`
 - `UNLOCK`
+- `MKCALENDAR`
 
 It answers any other method `405`, with no question and no report. The answer's
 `Allow` header names these methods.
 
-Nextcloud's Files app and sync client use the last nine, which are WebDAV
-methods. The Core Rule Set refuses them except where an app's exclusions allow
-them.
+The last ten are WebDAV methods, for Nextcloud:
+
+- its Files app and sync client use the nine from `PROPFIND` to `UNLOCK`;
+- a CalDAV client makes a calendar with `MKCALENDAR`.
+
+The Core Rule Set refuses them except where an app's exclusions allow them.
 
 `rproxy` answers `400`, with no question and no report, to a request with: