Subject: Re: COPY: "Duplicate" functionality

From: Daurnimator <[email-masked]>
Date: Fri, 9 Dec 2016 15:16:17 +1100

On 1 November 2016 at 16:18, ChanMaxthon <[email-masked]> wrote:
> I think you can generate a name, HEAD it, and then COPY it if you get a 404.

That's a latent TOCTOU vulnerability.

Instead, specify "Overwrite: F" and do the copy with a suffix of your
choosing e.g " (1)".
If you get a 412 in response then increment and try with e.g. a suffix of " (2)"

Alternatively, you could generate a unique path (e.g. a UUID) and use that.