From 9b81c086226fc9b3f95d233f1419a8746eb9fedb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Peso?= Date: Tue, 18 Apr 2023 18:22:16 +0200 Subject: [PATCH] safer base64 generated values in settings (#22990) Generated values for settings are a random base64 string with a length of 32. Unfortunately, base64 has some accepted characters like `+` and `/` that don't behave correctly if we use them in a URL without the proper additional encoding. Use instead this safe version of base64 https://datatracker.ietf.org/doc/html/rfc4648#section-5, where: - `/` becomes `_` - `+` becomes `-` Fixes https://mattermost.atlassian.net/browse/MM-51923 --- .../src/components/admin_console/generated_setting.tsx | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/webapp/channels/src/components/admin_console/generated_setting.tsx b/webapp/channels/src/components/admin_console/generated_setting.tsx index 8f00f5c862..4665443779 100644 --- a/webapp/channels/src/components/admin_console/generated_setting.tsx +++ b/webapp/channels/src/components/admin_console/generated_setting.tsx @@ -38,7 +38,11 @@ export default class GeneratedSetting extends React.PureComponent { private regenerate = (e: React.MouseEvent) => { e.preventDefault(); - this.props.onChange(this.props.id, crypto.randomBytes(256).toString('base64').substring(0, 32)); + // Pure base64 implementation can contain characters that are not URL safe without additional + // encoding. Adopt a URL/Filename safer alphabet as noted in https://datatracker.ietf.org/doc/html/rfc4648#section-5 + // where: 62 - (minus) , 63 _ (underscore) + const value = crypto.randomBytes(256).toString('base64').substring(0, 32); + this.props.onChange(this.props.id, value.replaceAll('+', '-').replaceAll('/', '_')); }; public render() {