firebase / firebase/firebase-admin-node
Application Credentials are not fully parsed/validated during initializeApp
- Dominant language
- TypeScript
- Stars
- 1.7k
- Forks
- 419
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 16
Description
### [READ] Step 1: Are you in the right place?
Yes
### [REQUIRED] Step 2: Describe your environment
* Operating System version: Linux
* Firebase SDK version: 9.20
* Firebase Product: FCM
* Node.js version: v12.18.4
* NPM version: 6.14.6
### [REQUIRED] Step 3: Describe the problem
#### Steps to reproduce:
1. Copy JSON-encoded Google Application Credentials from a browser based tool like Bitwarden
2. Attempt to use the SDK with those credentials (valid JSON containing a poorly-encoded/formatted PEM)
3. Initialize the app without error
4. Send an FCM message, receive an error: ``` error: {
"library": "PEM routines",
"function": "get_name",
"reason": "no start line",
"code": "ERR_OSSL_PEM_NO_START_LINE"
}```
**What I expect to happen:**
I would like the error to be thrown when I `initializeApp` during the bootstrapping of our application so I can treat it as a configuration error, rather than an error we hit at runtime the first time that a message is sent.
#### Relevant Code:
```javascript
const FCM_TOKEN = JSON.parse(GOOGLE_APPLICATION_CREDENTIALS)
const serviceAccount = {
projectId: FCM_TOKEN.project_id,
clientEmail: FCM_TOKEN.client_email,
privateKey: FCM_TOKEN.private_key
}
// Shouldn't this to throw if the credentials cannot be parsed?
firebaseAdmin.initializeApp({
credential: firebaseAdmin.credential.cert(serviceAccount),
databaseURL: 'https://xxxx.firebaseio.com'
})
```
Contributor guide
Research direction
Start at the initializeApp and credential.cert entry points shown in the report, and reproduce the malformed PEM credentials described in the steps. Verify that invalid credentials are rejected during initializeApp rather than only when the first FCM message is sent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100