firebase / firebase/firebase-admin-node

Application Credentials are not fully parsed/validated during initializeApp

未关闭
#1,062 8 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
api: core
主要语言
TypeScript
星标
1.7k
派生
419
平均合并
3 天 10 小时
30 天内合并 PR
16

描述

### [READ] Step 1: Are you in the right place?
Yes

### [REQUIRED] Step 2: Describe your environment

* Operating System version: Linux
* Firebase SDK version: 9.20
* Firebase Product: FCM
* Node.js version: v12.18.4
* NPM version: 6.14.6

### [REQUIRED] Step 3: Describe the problem

#### Steps to reproduce:

1. Copy JSON-encoded Google Application Credentials from a browser based tool like Bitwarden
2. Attempt to use the SDK with those credentials (valid JSON containing a poorly-encoded/formatted PEM)
3. Initialize the app without error
4. Send an FCM message, receive an error: ``` error: {
"library": "PEM routines",
"function": "get_name",
"reason": "no start line",
"code": "ERR_OSSL_PEM_NO_START_LINE"
}```

**What I expect to happen:**
I would like the error to be thrown when I `initializeApp` during the bootstrapping of our application so I can treat it as a configuration error, rather than an error we hit at runtime the first time that a message is sent.

#### Relevant Code:

```javascript
const FCM_TOKEN = JSON.parse(GOOGLE_APPLICATION_CREDENTIALS)

const serviceAccount = {
projectId: FCM_TOKEN.project_id,
clientEmail: FCM_TOKEN.client_email,
privateKey: FCM_TOKEN.private_key
}

// Shouldn't this to throw if the credentials cannot be parsed?
firebaseAdmin.initializeApp({
credential: firebaseAdmin.credential.cert(serviceAccount),
databaseURL: 'https://xxxx.firebaseio.com'
})
```

贡献指南

打开贡献指南

调研方向

Start at the initializeApp and credential.cert entry points shown in the report, and reproduce the malformed PEM credentials described in the steps. Verify that invalid credentials are rejected during initializeApp rather than only when the first FCM message is sent.

由索引模型根据 Issue 内容生成。

评估

技术栈
node.js, typescript
领域
authentication
Issue 类型
缺陷
难度
3/5
预计耗时
1-2 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
25/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。