Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

FR: Validate and recover URL strings in IAM #8485

Closed
yakovmanshin opened this issue Aug 3, 2021 · 0 comments · Fixed by #8486
Closed

FR: Validate and recover URL strings in IAM #8485

yakovmanshin opened this issue Aug 3, 2021 · 0 comments · Fixed by #8486
Assignees
@prakhar1989 @charlotteliang
Labels
api: inappmessaging Firebase In App Messaging type: feature request

Comments

@yakovmanshin
Copy link
Contributor

Feature proposal

  • Firebase Component: IAM

URLs in IAM are constructed from plain strings, which makes them vulnerable to easy-to-make mistakes, such as trailing whitespaces. In some cases, such mistakes result in crashes (#8482).

Although it’s not possible to rule out every situation which prevents a successful string-to-URL conversion, certain issues—such as redundant whitespaces in the URL string—can be fixed automatically.

Additionally, the Firebase Console clearly states that image URLs must use the HTTPS scheme. This requirement is not enforced in the SDK, which may lead to inconsistent results, depending on App Transport Security configuration et al., and a bunch of confusion.
@paulb777 paulb777 added the api: inappmessaging Firebase In App Messaging label Aug 3, 2021
This was referenced Aug 3, 2021
Merged
Closed
paulb777 pushed a commit that referenced this issue Aug 11, 2021
@yakovmanshin
[#8485] Added URL Recovery for IAM URLs (#8486)
d28849c 
* URL strings in in-app messages are sanitized and, when possible, recovered before they’re used in the `NSURL` initializer
* Added validation for image URLs, which must use the HTTPS scheme, according to the Firebase Console
* Updated `FIRIAMFetchResponseParserTests` to test URL validation and recovery
@firebase firebase locked and limited conversation to collaborators Sep 11, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
api: inappmessaging Firebase In App Messaging type: feature request
4 participants
@paulb777 @prakhar1989 @yakovmanshin @charlotteliang