webdav: return forbidden on failed proppatch

Some file systems do not allow opening directories with a write flag.
The PROPPATCH implementation always opens all files it tries to patch
with O_RDWR. When running on Linux with the Dir implementation of
FileSystem, this leads to all PROPPATCH calls to a directory failing
with an Internal Server Error.

Some clients, such as git via the Microsoft Mini Redirector try to patch
directories' properties. A server using a Dir FileSystem fails in this
situation, which makes it unusable for that entire class of clients.

Rather than failing with a Internal Server Error we can instead return
Forbidden, which indicates to the client that it's not allowed to patch
properties on that file. This patch does so if we fail to open the file,
and the error is because of a lack of permission, or because the file is
a directory. We don't unconditionally return Forbidden in this case
because other errors are more likey to be ephemeral: a client retrying
could possibly succeed in a subsequent patch.

Fixes golang/go#43929

Author: klarose

webdav/prop.go

@@ -307,6 +307,13 @@ loop:
 
 	f, err := fs.OpenFile(ctx, name, os.O_RDWR, 0)
 	if err != nil {
+		stat, statErr := fs.Stat(ctx, name)
+		// If the error is a permission error or the file is a directory, return permission
+		// denied. We check the directory case because some file systems do not support
+		// writing to directories.
+		if errors.Is(err, os.ErrPermission) || (statErr == nil && stat.IsDir()) {
+			return patchesForbidden(patches), nil
+		}
 		return nil, err
 	}
 	defer f.Close()
@@ -327,13 +334,17 @@ loop:
 	}
 	// The file doesn't implement the optional DeadPropsHolder interface, so
 	// all patches are forbidden.
+	return patchesForbidden(patches), nil
+}
+
+func patchesForbidden(patches []Proppatch) []Propstat {
 	pstat := Propstat{Status: http.StatusForbidden}
 	for _, patch := range patches {
 		for _, p := range patch.Props {
 			pstat.Props = append(pstat.Props, Property{XMLName: p.XMLName})
 		}
 	}
-	return []Propstat{pstat}, nil
+	return []Propstat{pstat}
 }
 
 func escapeXML(s string) string {