Failing preview generation results in 404 istead of original image

[max-nextcloud]

Describe the bug
We had some traces in Sentry:

Since we don't catch these they will be caught on the Controller Level which then sends a 404.
We should return the raw image instead. In case of the trace here it was a png and could have been served fine.

Server details:
cloud.nextcloud.com from 30.0.1.1 to 30.0.2.2 - probably longer.

[bootlesshacker]

Just saw this issue too on 30.0.2. This would be a useful fix given it can trigger firewalls to engage at quantity of HTTP errors.

[max-nextcloud]

@bootlesshacker To be frank I think the risk is fairly minimal. It will be pretty rare to see more than say 10 files on a page that exhibit this behavior and I doubt firewalls will kick in after 10 404s.

Did you observe such behavior in the past or can you trigger it if you try?

[juliusknorr]

Would agree, a 404 is not a response code I would expect any firewall to start acting on.

Generally speaking a 404 is the expected response on the server preview endpoint as well.

[bootlesshacker]

@bootlesshacker To be frank I think the risk is fairly minimal. It will be pretty rare to see more than say 10 files on a page that exhibit this behavior and I doubt firewalls will kick in after 10 404s.

Did you observe such behavior in the past or can you trigger it if you try?

It triggered over 100 404's in 60 seconds from a single IP address which did indeed cause a small temporary block in this instance, which is how I came to learn of the issue. Can you let me know specifically what condition we would expect these 404's to generate?

@juliusknorr Respectfully, you may not expect it, but it is not an uncommon setup for people to filter out web bots / enumeration.

[juliusknorr]

That certainly sounds too much indeed, we should both return the image if available and probably not send that many requests at once, I was only arguing that the 404 status code itself is nothing unexpected from the Nextcloud perspective, so if that alone is causing larger blocking it might be something worth to reconsider those specific blocking rules.

[bootlesshacker]

Thank you. I've amended the rule in the interim and lifted the threshold. I'm comfortable it doesn't normally trigger until this issue, but I'll see if I can amend it for now to exclude certain Nextcloud endpoints where a 404 is potentially expected.