fix(parser): reject app IDs longer than 32 characters in info.xml#1811
Open
miaulalala wants to merge 1 commit into
Open
fix(parser): reject app IDs longer than 32 characters in info.xml#1811miaulalala wants to merge 1 commit into
miaulalala wants to merge 1 commit into
Conversation
miaulalala
added
bug
release critical
security
Nextcloud server stores app IDs in a varchar(32) column and crashes with an uncaught InvalidArgumentException when reading config for apps whose ID exceeds that limit. Enforce the same limit at upload time via the info.xml XSD so oversized IDs are rejected with a clear error instead of being silently accepted and later crashing server installs. Fixes #1809 Signed-off-by: Anna Larch <anna@nextcloud.com>
miaulalala
force-pushed
the
fix/app-id-length-limit
branch
from
1173e6b to
5894662
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
maxLengthon the<id>element ofinfo.xmlin the release XSD, matching thevarchar(32)limit Nextcloud server'sAppConfiguses for app IDs.InvalidAppMetadataXmlException(surfaced as a 400ValidationError), instead of being silently accepted and later crashing Nextcloud server's apps list (InvalidArgumentException: Value (...) for app is too long (32)) once the app is installed.Fixes #1809
Test plan
nextcloudappstore/api/v1/tests/data/infoxmls/toolongid.xmlusing the real-world 39-character offending app ID (skynettechnologiesallinoneaccessibility) from the issue.test_parse_too_long_idasserting the parser raisesInvalidAppMetadataXmlExceptionfor that fixture.python manage.py test nextcloudappstore.api.v1.tests.test_parser --settings nextcloudappstore.settings.development— all 61 tests pass, including existing fixtures with short IDs (no regressions).🤖 Generated with Claude Code