[Bug]: Multiple values in Content-Type Header in WebDAV Requests

What happened?

Summary

Remote Save sends an invalid Content-Type: text/plain,application/xml header for WebDAV requests of type PROPFIND, which violates HTTP specifications and triggers security filters.

Discovered Via

Web Application Firewall (CrowdSec with OWASP CRS) logs showing protocol violations:

• Rule 920470: Illegal Content-Type header
• Rule 920420: Content-Type not allowed by policy
• Rule 921421: Dangerous content type declaration

Current Behavior

PROPFIND /remote.php/dav/files/username/ObsidianNotes/ HTTP/1.1
Content-Type: text/plain,application/xml
Accept: text/xml, application/xml

Expected Behavior

Per RFC 7231, Content-Type should contain a single MIME type:

PROPFIND /remote.php/dav/files/username/ObsidianNotes/ HTTP/1.1
Content-Type: text/xml
Accept: text/xml, application/xml

Impact

• Blocks legitimate sync operations when strict HTTP compliance is enforced
• Triggers false positives in security monitoring systems
• May cause issues with spec-compliant WebDAV servers

Environment

• User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) obsidian/1.8.10 Chrome/132.0.6834.196 Electron/34.2.0 Safari/537.36

Reproduction

1. Configure Remote Save to sync with any WebDAV server
2. Monitor HTTP requests using a WAF or proxy
3. Observe malformed Content-Type header on PROPFIND requests

Reference

• RFC 7231 §3.1.1.5 - Content-Type Syntax

What OS are you using?

Windows

What remote cloud services are you using? (Please choose the specified one if it's in the list)

webdav (NextCloud)

Version of the plugin

0.5.25

Version of Obsidian

1.9.14

Using password or not

• Yes.

Ensure no sensitive information

• I ensure that no sensitive information is submitted in the issue.