Skip to content

fix: Validate string format of SDK key #162

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jsonbailey merged 9 commits into from
Sep 29, 2025
Merged

fix: Validate string format of SDK key #162

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
e1ccf92
fix: Validate string format of SDK key
jsonbailey Sep 26, 2025
0f63f7d
add sdk-key to test
jsonbailey Sep 26, 2025
7f04fc9
Address feedback to make validation more specific. Removed forcing of…
jsonbailey Sep 26, 2025
61de241
dont log an error if they are offline.
jsonbailey Sep 26, 2025
450b852
fix casing
jsonbailey Sep 26, 2025
427dfaa
adjust validation function
jsonbailey Sep 26, 2025
dfa801e
undo common changes to prevent merge conflict
jsonbailey Sep 27, 2025
70a646a
Update the client to validate the key
jsonbailey Sep 29, 2025
fb77862
Use the proper validation method
jsonbailey Sep 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 17 additions & 3 deletions pkgs/sdk/client/src/ConfigurationBuilder.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
using LaunchDarkly.Sdk.Client.Integrations;
using LaunchDarkly.Sdk.Client.Internal.Interfaces;
using LaunchDarkly.Sdk.Client.Subsystems;
using LaunchDarkly.Sdk.Helpers;

namespace LaunchDarkly.Sdk.Client
{
Expand Down Expand Up @@ -75,9 +76,20 @@ public enum AutoEnvAttributes
internal IBackgroundModeManager _backgroundModeManager;
internal IConnectivityStateManager _connectivityStateManager;

/// <summary>
/// Sets the mobile key only if it passes validation rules.
/// </summary>
private void SetMobileKeyIfValid(string mobileKey)
{
if (ValidationUtils.IsValidSdkKeyFormat(mobileKey))
{
_mobileKey = mobileKey;
}
}

internal ConfigurationBuilder(string mobileKey, AutoEnvAttributes autoEnvAttributes)
{
_mobileKey = mobileKey;
SetMobileKeyIfValid(mobileKey);
_autoEnvAttributes = autoEnvAttributes == AutoEnvAttributes.Enabled; // map enum to boolean
}

Expand All @@ -92,7 +104,8 @@ internal ConfigurationBuilder(Configuration copyFrom)
_events = copyFrom.Events;
_httpConfigurationBuilder = copyFrom.HttpConfigurationBuilder;
_loggingConfigurationBuilder = copyFrom.LoggingConfigurationBuilder;
_mobileKey = copyFrom.MobileKey;
// The mobile key from Configuration should already be valid, but we validate just in case
SetMobileKeyIfValid(copyFrom.MobileKey);
_offline = copyFrom.Offline;
_persistenceConfigurationBuilder = copyFrom.PersistenceConfigurationBuilder;
_serviceEndpointsBuilder = new ServiceEndpointsBuilder(copyFrom.ServiceEndpoints);
Expand Down Expand Up @@ -362,6 +375,7 @@ public ConfigurationBuilder Logging(LoggingConfigurationBuilder loggingConfigura

/// <summary>
/// Sets the key for your LaunchDarkly environment.
/// The key will not be updated if the provided key contains invalid characters.
/// </summary>
/// <remarks>
/// This should be the "mobile key" field for the environment on your LaunchDarkly dashboard.
Expand All @@ -370,7 +384,7 @@ public ConfigurationBuilder Logging(LoggingConfigurationBuilder loggingConfigura
/// <returns>the same builder</returns>
public ConfigurationBuilder MobileKey(string mobileKey)
{
_mobileKey = mobileKey;
SetMobileKeyIfValid(mobileKey);
return this;
}

Expand Down
4 changes: 2 additions & 2 deletions pkgs/sdk/client/src/LaunchDarkly.ClientSdk.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,9 +41,9 @@
<ItemGroup>
<Folder Include="Properties\"/>
<PackageReference Include="System.Numerics.Vectors" Version="4.5.0"/>
<PackageReference Include="LaunchDarkly.CommonSdk" Version="7.1.0"/>
<PackageReference Include="LaunchDarkly.CommonSdk" Version="7.1.1"/>
<PackageReference Include="LaunchDarkly.EventSource" Version="5.2.1"/>
<PackageReference Include="LaunchDarkly.InternalSdk" Version="3.5.4" />
<PackageReference Include="LaunchDarkly.InternalSdk" Version="3.5.5" />
<PackageReference Include="LaunchDarkly.Logging" Version="2.0.0"/>
<PackageReference Include="Microsoft.Maui.Essentials" Version="8.0.100" />
<Compile Include="**\*.cs" Exclude="PlatformSpecific\*.cs;bin\**\*.cs;obj\**\*.cs"/>
Expand Down
21 changes: 17 additions & 4 deletions pkgs/sdk/server/src/ConfigurationBuilder.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
using System;
using System.Collections.Generic;
using LaunchDarkly.Logging;
using LaunchDarkly.Sdk.Helpers;
using LaunchDarkly.Sdk.Server.Hooks;
using LaunchDarkly.Sdk.Server.Integrations;
using LaunchDarkly.Sdk.Server.Interfaces;
Expand Down Expand Up @@ -53,9 +54,20 @@ public sealed class ConfigurationBuilder

#region Internal constructors

/// <summary>
/// Sets the SDK key only if it passes validation rules.
/// </summary>
private void SetSdkKeyIfValid(string sdkKey)
{
if (ValidationUtils.IsValidSdkKeyFormat(sdkKey))
{
_sdkKey = sdkKey;
}
}
Copy link

@cursor cursor bot Sep 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Key Validation Silently Fails Without Alerts

The new key validation in both SDKs silently discards invalid SDK/mobile keys, leaving the internal key field null. This can lead to runtime issues, such as connection failures, without user notification. Copy constructors are particularly problematic, as an already valid key might be unexpectedly nullified.

Additional Locations (1)

Fix in Cursor Fix in Web


internal ConfigurationBuilder(string sdkKey)
{
_sdkKey = sdkKey;
SetSdkKeyIfValid(sdkKey);
}

internal ConfigurationBuilder(Configuration copyFrom)
Expand All @@ -70,7 +82,8 @@ internal ConfigurationBuilder(Configuration copyFrom)
_http = copyFrom.Http;
_logging = copyFrom.Logging;
_offline = copyFrom.Offline;
_sdkKey = copyFrom.SdkKey;
// The SDK key from Configuration should already be valid, but we validate just in case
SetSdkKeyIfValid(copyFrom.SdkKey);
_serviceEndpointsBuilder = new ServiceEndpointsBuilder(copyFrom.ServiceEndpoints);
_startWaitTime = copyFrom.StartWaitTime;
_applicationInfo = copyFrom.ApplicationInfo;
Expand Down Expand Up @@ -317,15 +330,15 @@ public ConfigurationBuilder Offline(bool offline)

/// <summary>
/// Sets the SDK key for your LaunchDarkly environment.
/// They key will not be updated if the provided key contains invalid characters.
/// </summary>
/// <param name="sdkKey">the SDK key</param>
/// <returns>the same builder</returns>
public ConfigurationBuilder SdkKey(string sdkKey)
{
_sdkKey = sdkKey;
SetSdkKeyIfValid(sdkKey);
return this;
}

/// <summary>
/// Sets the SDK's service URIs, using a configuration builder obtained from
/// <see cref="Components.ServiceEndpoints"/>.
Expand Down
4 changes: 2 additions & 2 deletions pkgs/sdk/server/src/LaunchDarkly.ServerSdk.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,9 +39,9 @@

<ItemGroup>
<PackageReference Include="LaunchDarkly.Cache" Version="1.0.2" />
<PackageReference Include="LaunchDarkly.CommonSdk" Version="7.1.0" />
<PackageReference Include="LaunchDarkly.CommonSdk" Version="7.1.1" />
<PackageReference Include="LaunchDarkly.EventSource" Version="5.2.1" />
<PackageReference Include="LaunchDarkly.InternalSdk" Version="3.5.4" />
<PackageReference Include="LaunchDarkly.InternalSdk" Version="3.5.5" />
<PackageReference Include="LaunchDarkly.Logging" Version="2.0.0" />
</ItemGroup>

Expand Down
6 changes: 6 additions & 0 deletions pkgs/sdk/server/src/LdClient.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,12 @@ public LdClient(Configuration config)
_log = logConfig.LogAdapter.Logger(logConfig.BaseLoggerName ?? LogNames.DefaultBase);
_log.Info("Starting LaunchDarkly client {0}",
AssemblyVersions.GetAssemblyVersionStringForType(typeof(LdClient)));

if (_configuration.SdkKey == null && !_configuration.Offline)
{
_log.Error("The SDK key provided is invalid.");
}

_evalLog = _log.SubLogger(LogNames.EvaluationSubLog);

var taskExecutor = new TaskExecutor(this, _log);
Expand Down
4 changes: 2 additions & 2 deletions pkgs/sdk/server/test/LdClientListenersTest.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ public void ClientSendsFlagValueChangeEvents()
var testData = TestData.DataSource();
testData.Update(testData.Flag(flagKey).On(false));

var config = Configuration.Builder("").DataSource(testData)
var config = Configuration.Builder("sdk-key").DataSource(testData)
.Events(Components.NoEvents).Build();

using (var client = new LdClient(config))
Expand Down Expand Up @@ -136,7 +136,7 @@ public void DataSourceStatusProviderSendsStatusUpdates()
var config = BasicConfig()
.DataSource(testData)
.Build();

using (var client = new LdClient(config))
{
var statuses = new EventSink<DataSourceStatus>();
Expand Down
Loading