safer base64 generated values in settings (#22990)

Generated values for settings are a random base64 string with a length of 32. Unfortunately, base64 has some accepted characters like `+` and `/` that don't behave correctly if we use them in a URL without the proper additional encoding.

Use instead this safe version of base64 https://datatracker.ietf.org/doc/html/rfc4648#section-5, where:
- `/` becomes `_`
- `+` becomes `-`

Fixes https://mattermost.atlassian.net/browse/MM-51923
Этот коммит содержится в:
José Peso
2023-04-18 18:22:16 +02:00
коммит произвёл GitHub
родитель 9729641823
Коммит 9b81c08622

Просмотреть файл

@@ -38,7 +38,11 @@ export default class GeneratedSetting extends React.PureComponent<Props> {
private regenerate = (e: React.MouseEvent) => {
e.preventDefault();
this.props.onChange(this.props.id, crypto.randomBytes(256).toString('base64').substring(0, 32));
// Pure base64 implementation can contain characters that are not URL safe without additional
// encoding. Adopt a URL/Filename safer alphabet as noted in https://datatracker.ietf.org/doc/html/rfc4648#section-5
// where: 62 - (minus) , 63 _ (underscore)
const value = crypto.randomBytes(256).toString('base64').substring(0, 32);
this.props.onChange(this.props.id, value.replaceAll('+', '-').replaceAll('/', '_'));
};
public render() {