validateSubscriptionDetails() does not stictly validate key and token

K

Kirby

Well-known member
Licensed customer
Affected version
2.2.19
\XF\Repository\UserPushRepository::validateSubscriptionDetails() does not validate if key and token are fully valid Base64.

This allows invalid values to be stored in the DB causing possible errors like
Code: 
InvalidArgumentException: Invalid data provided src/vendor/spomky-labs/base64url/src/Base64Url.php:51

#0 src/vendor/minishlink/web-push/src/Encryption.php(82): Base64Url\Base64Url::decode('<redacted>')
when sending notifications.
 

Similar threads

X
Fixed CronEntry::verifyRunRules does not validate value ranges
Replies
1
Views
49
XF Bug Bot
XF Bug Bot
X
Not a bug XF\DevelopmentOutput\Permission does not fully validate permission name
Replies
1
Views
412
Chris D
Chris D
X
Fixed getQuotedUserIds does not validate post id's are ints, and MySQL reacts poorly
Replies
1
Views
2K
XF Bug Bot
XF Bug Bot
Back
Top Bottom