safer base64 generated values in settings (#22990)
Generated values for settings are a random base64 string with a length of 32. Unfortunately, base64 has some accepted characters like `+` and `/` that don't behave correctly if we use them in a URL without the proper additional encoding. Use instead this safe version of base64 https://datatracker.ietf.org/doc/html/rfc4648#section-5, where: - `/` becomes `_` - `+` becomes `-` Fixes https://mattermost.atlassian.net/browse/MM-51923
Этот коммит содержится в:
@@ -38,7 +38,11 @@ export default class GeneratedSetting extends React.PureComponent<Props> {
|
||||
private regenerate = (e: React.MouseEvent) => {
|
||||
e.preventDefault();
|
||||
|
||||
this.props.onChange(this.props.id, crypto.randomBytes(256).toString('base64').substring(0, 32));
|
||||
// Pure base64 implementation can contain characters that are not URL safe without additional
|
||||
// encoding. Adopt a URL/Filename safer alphabet as noted in https://datatracker.ietf.org/doc/html/rfc4648#section-5
|
||||
// where: 62 - (minus) , 63 _ (underscore)
|
||||
const value = crypto.randomBytes(256).toString('base64').substring(0, 32);
|
||||
this.props.onChange(this.props.id, value.replaceAll('+', '-').replaceAll('/', '_'));
|
||||
};
|
||||
|
||||
public render() {
|
||||
|
||||
Ссылка в новой задаче
Block a user