safer base64 generated values in settings (#22990)
Generated values for settings are a random base64 string with a length of 32. Unfortunately, base64 has some accepted characters like `+` and `/` that don't behave correctly if we use them in a URL without the proper additional encoding. Use instead this safe version of base64 https://datatracker.ietf.org/doc/html/rfc4648#section-5, where: - `/` becomes `_` - `+` becomes `-` Fixes https://mattermost.atlassian.net/browse/MM-51923
Этот коммит содержится в:
@@ -38,7 +38,11 @@ export default class GeneratedSetting extends React.PureComponent<Props> {
|
|||||||
private regenerate = (e: React.MouseEvent) => {
|
private regenerate = (e: React.MouseEvent) => {
|
||||||
e.preventDefault();
|
e.preventDefault();
|
||||||
|
|
||||||
this.props.onChange(this.props.id, crypto.randomBytes(256).toString('base64').substring(0, 32));
|
// Pure base64 implementation can contain characters that are not URL safe without additional
|
||||||
|
// encoding. Adopt a URL/Filename safer alphabet as noted in https://datatracker.ietf.org/doc/html/rfc4648#section-5
|
||||||
|
// where: 62 - (minus) , 63 _ (underscore)
|
||||||
|
const value = crypto.randomBytes(256).toString('base64').substring(0, 32);
|
||||||
|
this.props.onChange(this.props.id, value.replaceAll('+', '-').replaceAll('/', '_'));
|
||||||
};
|
};
|
||||||
|
|
||||||
public render() {
|
public render() {
|
||||||
|
|||||||
Ссылка в новой задаче
Block a user