From 89ecdf5a0725cc57e7b4b3a28831e1d419c99b41 Mon Sep 17 00:00:00 2001
From: Milan <37556964+MiMoHo@users.noreply.github.com>
Date: Fri, 3 Jul 2026 12:28:12 +0200
Subject: [PATCH] fix(attachments): return 404 when attachment path resolves to
 a folder

getAttachment() relied on assert() to ensure the resolved node is a File. assert() is a no-op with the production setting zend.assertions=-1, so a path pointing at a directory produced a TypeError from the ": File" return type. TypeError is a \Error and is not caught by the controllers' catch(\Exception), ending the request in HTTP 500 instead of 404.

Guard the type explicitly and throw NoteDoesNotExistException, mirroring the existing pattern in getFileById().

Signed-off-by: Milan <37556964+MiMoHo@users.noreply.github.com>
---
 lib/Service/NotesService.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/Service/NotesService.php b/lib/Service/NotesService.php
index f2c042c7c..c5b73774d 100644
--- a/lib/Service/NotesService.php
+++ b/lib/Service/NotesService.php
@@ -316,7 +316,9 @@ public function getAttachment(string $userId, int $noteid, string $path) : File
 			}
 		}
 		$targetNode = $notesFolder->get(implode('/', $p));
-		assert($targetNode instanceof \OCP\Files\File);
+		if (!($targetNode instanceof File)) {
+			throw new NoteDoesNotExistException();
+		}
 		return $targetNode;
 	}