WebDAVClient 2.6 released

by

I shipped WebDAVClient 2.6.0 to NuGet today – sixteen PRs that had been queueing on the version-2.6 branch all landed together. Here’s the rundown.

Security

  • Hardened ResponseParser‘s XmlReaderSettings against XXE (explicit DtdProcessing = Prohibit + XmlResolver = null).
  • Wired the previously-dead ServerCertificateValidationCallback into the HttpClientHandler so it actually runs.
  • Added host validation in BuildServerUrl to prevent SSRF via absolute URIs returned by the server.
  • Validate CustomHeaders keys/values for CR/LF to prevent HTTP header injection.

Performance

  • List() no longer calls GetServerUrl per item.
  • Cache MOVE/COPY request body bytes in static fields.
  • ResponseParser no longer allocates a lowercased string per node.
  • Avoid redundant header dictionary lookup in HttpRequest / HttpUploadRequest.
  • Avoid copying CustomHeaders into a temporary dictionary on every call.
  • Use OrdinalIgnoreCase for parent-folder URL comparison in List().

Bug fixes

  • Fixed shared HttpClientHandler being disposed twice when uploadTimeout is set.

Tests & tooling

  • Added a real WebDAVClient.UnitTests project (MSTest, multi-targeted) with a stub-handler harness for network-free testing.
  • New GitHub Actions workflow auto-publishes the NuGet package when master is bumped.
  • Added .NET 10 support and dropped .NET 9.

Documentation

  • README refresh: typos, changelog catch-up, and a usage example that actually shows using, Port, CustomHeaders, CancellationToken, and CopyFile / CopyFolder.
  • Filled in missing XML docs across IClient (parameters, cancellationToken, exceptions, valid depth values), Item model, both exception types, and the IHttpClientWrapper / HttpClientWrapper pair.

NuGet: WebDAVClient 2.6.0 · Source: github.com/saguiitay/WebDAVClient

Should be a drop-in upgrade from 2.5.x. The one thing worth double-checking: ServerCertificateValidationCallback actually runs now, so if you had it set “just in case”, make sure it returns true for the certs you actually expect.