fix: sanitize input for dname on signing key #4828
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
fixes #4791
fixes https://discord.com/channels/930156205542883409/930871438666235964/1292435840554897502
PR Type
Describe the current behavior?
Depending on the manifest app name or short name it can create an unexpected value for signing key inputs, which causes differentes issues:
Describe the new behavior?
After some investigation on bubblewrap, Andre already added some characters escapes here: GoogleChromeLabs/bubblewrap#373 but it's not covering all possible characters that can invalidate the input as coded here: https://github.com/frohoff/jdk8u-jdk/blob/da0da73ab82ed714dc5be94acd2f0d00fbdfe2e9/src/share/classes/sun/security/x509/AVA.java#L95C33-L95C49
We can still open an issue or PR to escape it on bubblewrap, but decided to add a sanitize + validation layer for PWABuilder similar to the existing input validation for app name. (+ Friendly)
Behaviors added:
sl-details
content allowing to scroll into the error.PR Checklist
npm run test
and ensure that all tests passAdditional Information
I couldn't find a validate manifest to test the sanitize at first try, the original manifest from the issue is currently down, but here a simple demo of the function:
And demo for the input validation + show sl-details on errors.
Home._.PWABuilder.-.Google.Chrome.2024-10-08.11-43-32.mp4