[Bug]: Range: bytes=0-0 on (public) WebDAV returns whole file instead of first byte #65581

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

Root cause: sabre/dav CorePlugin::httpGet() uses a truthiness check for the end
offset ($range[1] ? $range[1] : $nodeSize - 1), and (int) 0 is falsy.
Same code is present in 3rdparty/sabre/dav 4.7.0 bundled with Nextcloud.
Upstream fix: sabre-io/dav#1681

Impact: Akamai partial object caching / Large File Optimization probes with
bytes=0-0 and fails with ERR_POC_FWD_BAD_RLEN, so files > 1.8 GB behind Akamai
cannot be downloaded (ERR_OBJ_TOO_BIG). Other CDNs and download managers that
probe the first byte are likely affected too.

Please bump sabre/dav in nextcloud/3rdparty once the fix is released and
consider a backport to supported stable branches.

Nextcloud version: 33.0.9
Webserver / PHP: 8.4.26

Steps to reproduce

1. Share a large file via public link
2. curl -s -o /dev/null -D - -H "Range: bytes=0-0"
   "https:///public.php/dav/files//"

Expected behavior

Expected: 206, Content-Range: bytes 0-0/, Content-Length: 1
Actual: 206, Content-Range: bytes 0-/, full body
"Range: bytes=1-1" works correctly, so only a last-byte-pos of 0 is affected.

Nextcloud Server version

33

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response