firebase / firebase/firebase-admin-node

Application Credentials are not fully parsed/validated during initializeApp

Ouverte
#1,062 8 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
api: core
Langage dominant
TypeScript
Étoiles
1.7k
Forks
419
Merge moyen
3 j 10 h
PR mergées (30 j)
16

Description

### [READ] Step 1: Are you in the right place?
Yes

### [REQUIRED] Step 2: Describe your environment

* Operating System version: Linux
* Firebase SDK version: 9.20
* Firebase Product: FCM
* Node.js version: v12.18.4
* NPM version: 6.14.6

### [REQUIRED] Step 3: Describe the problem

#### Steps to reproduce:

1. Copy JSON-encoded Google Application Credentials from a browser based tool like Bitwarden
2. Attempt to use the SDK with those credentials (valid JSON containing a poorly-encoded/formatted PEM)
3. Initialize the app without error
4. Send an FCM message, receive an error: ``` error: {
"library": "PEM routines",
"function": "get_name",
"reason": "no start line",
"code": "ERR_OSSL_PEM_NO_START_LINE"
}```

**What I expect to happen:**
I would like the error to be thrown when I `initializeApp` during the bootstrapping of our application so I can treat it as a configuration error, rather than an error we hit at runtime the first time that a message is sent.

#### Relevant Code:

```javascript
const FCM_TOKEN = JSON.parse(GOOGLE_APPLICATION_CREDENTIALS)

const serviceAccount = {
projectId: FCM_TOKEN.project_id,
clientEmail: FCM_TOKEN.client_email,
privateKey: FCM_TOKEN.private_key
}

// Shouldn't this to throw if the credentials cannot be parsed?
firebaseAdmin.initializeApp({
credential: firebaseAdmin.credential.cert(serviceAccount),
databaseURL: 'https://xxxx.firebaseio.com'
})
```

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Start at the initializeApp and credential.cert entry points shown in the report, and reproduce the malformed PEM credentials described in the steps. Verify that invalid credentials are rejected during initializeApp rather than only when the first FCM message is sent.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
node.js, typescript
Domaine
authentication
Type d'issue
Bug
Difficulté
3/5
Temps estimé
1-2 jours
Activité
À l'abandon
Clarté
Plutôt claire
Accessibilité débutants
25/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.