Core Rule Set: Nextcloud's calendar and contacts sync pass (closes #280)

rproxy passes MKCALENDAR on. nextcloud.conf allows it on
/remote.php/dav/calendars/ and PROPFIND on /.well-known/caldav and
carddav. The XML of an MKCOL there skips 930120, 932120, 932250 and
932260; that of an MKCALENDAR also 932125 and 932230, for its
description. A PUT of text/calendar or text/vcard there skips 920530:
the Calendar and Contacts apps name the charset twice when they change
an event or a contact.

Recorded from Nextcloud 35.0.2 with Calendar 6.6.5, Contacts 8.9.5 and
requests imitating DAVx5.

Model: opus-5-5

SPEC.md

@@ -1346,6 +1346,32 @@ The changes hold in front of every app, and no setting undoes them:
     The XML body of a `SEARCH` on `/remote.php/dav/`, the Files app's search,
     skips the four rules.
 
+    The Calendar and Contacts apps, and CalDAV and CardDAV clients, use these
+    paths:
+    - `/remote.php/dav/calendars/`, which holds the calendars;
+    - `/remote.php/dav/addressbooks/`, which holds the address books.
+
+    There:
+    - `MKCALENDAR`, with which a CalDAV client makes a calendar, is allowed on
+      the calendars' paths only.
+    - The XML body of an `MKCOL`, which names a new calendar or address book,
+      skips the four rules.
+    - The XML body of an `MKCALENDAR` holds the new calendar's name and
+      description. It skips the four rules, and two rules that refused a
+      description such as `Powershell and python3 meetings; ls -la first`
+      (932125, 932230).
+    - The body of a `PUT` of an event or a contact is not read, as for any `PUT`
+      on the WebDAV paths. So the Core Rule Set does not check an event's title,
+      location or description, or a contact's names.
+    - The Calendar and Contacts apps name the charset twice in the
+      `Content-Type` of the `PUT` that changes an event or a contact. A `PUT`
+      typed `text/calendar` or `text/vcard` skips 920530, the rule against two
+      charsets.
+
+    A CalDAV or CardDAV client finds these paths with a `PROPFIND` on
+    `/.well-known/caldav` or `/.well-known/carddav`. That method is allowed on
+    those two paths.
+
     These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
     applies to a JSON field when the query has a parameter of that name, such as
     `json.message`. Nextcloud's pages are matched at the site root and under
@@ -2034,13 +2060,17 @@ image runs it by default (see "Deployment").
 - `SEARCH`
 - `LOCK`
 - `UNLOCK`
+- `MKCALENDAR`
 
 It answers any other method `405`, with no question and no report. The answer's
 `Allow` header names these methods.
 
-Nextcloud's Files app and sync client use the last nine, which are WebDAV
-methods. The Core Rule Set refuses them except where an app's exclusions allow
-them.
+The last ten are WebDAV methods, for Nextcloud:
+
+- its Files app and sync client use the nine from `PROPFIND` to `UNLOCK`;
+- a CalDAV client makes a calendar with `MKCALENDAR`.
+
+The Core Rule Set refuses them except where an app's exclusions allow them.
 
 `rproxy` answers `400`, with no question and no report, to a request with: