[eas-json] validate EAS Submit inputs better #2198

szdziedzic · 2024-01-25T10:05:48Z

Why

We want to perform stricter validation of EAS Submit inputs.

How

Use Joi schema for validation

Test Plan

Automated tests
Submit test app manually

szdziedzic · 2024-01-25T10:08:28Z

/changelog-entry chore Validate EAS Submit inputs better

github-actions · 2024-01-25T10:08:38Z

Size Change: -999 B (0%)

Total Size: 51.5 MB

Filename	Size	Change
`./packages/eas-cli/dist/eas-linux-x64.tar.gz`	51.5 MB	-999 B (0%)

_{compressed-size-action}

codecov · 2024-01-25T10:10:19Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (b5f2f52) 54.14% compared to head (9c9320d) 54.16%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2198      +/-   ##
==========================================
+ Coverage   54.14%   54.16%   +0.03%     
==========================================
  Files         516      516              
  Lines       18798    18808      +10     
  Branches     3769     3772       +3     
==========================================
+ Hits        10176    10186      +10     
  Misses       8601     8601              
  Partials       21       21

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

packages/eas-json/src/utils.ts

sjchmiela

Looks ok. A nice improvement could be moving from Joi to Zod and using Zod-inferred types to ensure we never pass non-resolved/non-validated credentials to the build.

Like, we could say:

const ResolvedProfile = z.object({
  ...,
  resolved: z.boolean().default(true),

Using z.infer<typeof ResolvedProfile> in a function that accepts the profile as input would ensure on type level we never forget to resolve, because the argument would need to have the resolved: true property which it could only get when resolving.

This can probably also be achieved with Joi and manual typing, I'm ok with that too.

packages/eas-json/src/submit/schema.ts

sjchmiela · 2024-01-25T14:13:45Z

packages/eas-cli/src/submit/ios/IosSubmitCommand.ts

@@ -111,6 +111,11 @@ export default class IosSubmitCommand {
    const envAppSpecificPassword = getenv.string('EXPO_APPLE_APP_SPECIFIC_PASSWORD', '');

    if (envAppSpecificPassword) {
+      if (!/^[a-z]{4}-[a-z]{4}-[a-z]{4}-[a-z]{4}$/.test(envAppSpecificPassword)) {
+        throw new Error(
+          'EXPO_APPLE_APP_SPECIFIC_PASSWORD must be in the format XXXX-XXXX-XXXX-XXXX, where X is a lowercase letter.'


Ugh, do we need to depend on this? Like, is this value susceptible to being used for a hack?

I don't think so, but the format for this value is well known, so why not validate it?

packages/eas-cli/src/submit/ios/__tests__/IosSubmitCommand-test.ts

sjchmiela · 2024-01-25T14:22:55Z

packages/eas-json/src/submit/resolver.ts

@@ -99,7 +99,7 @@ function mergeProfiles<T extends Platform>(

 export function getDefaultProfile<T extends Platform>(platform: T): SubmitProfile<T> {
  const Schema =
-    platform === Platform.ANDROID ? AndroidSubmitProfileSchema : IosSubmitProfileSchema;
+    platform === Platform.ANDROID ? AndroidSubmitProfileSchema : UnresolvedIosSubmitProfileSchema;


Can we add a comment why we can use Unresolved here?

I don't think it matters which one we use here. I just used the same one which was used until now. I didn't think about it too much.

Ah, because Joi will only check and throw if there is a value. If it's undefined it will do nothing. Let's use Resolved then?

…t.ts Co-authored-by: Stanisław Chmiela <[email protected]>

szdziedzic · 2024-01-25T14:42:00Z

I agree that Zod is nice, but in my opinion, if we decide to do Joi->Zod migration we should do it in a separate PR and keep the validation lib we use consistent across the whole package. I want to keep this PR as purpose-focused as possible.

ide · 2024-01-26T04:52:34Z

packages/eas-json/src/submit/schema.ts

+  ascApiKeyId: Joi.string()
+    .regex(/^[\dA-Z]{10}$/)
+    .message(
+      'Invalid Apple App Store Connect API Key ID ("ascApiKeyId") was specified. It should consist of 10 upper case letters or digits. Example: "AB32CDE81F". Learn more: https://expo.fyi/creating-asc-api-key.'


Suggested change

'Invalid Apple App Store Connect API Key ID ("ascApiKeyId") was specified. It should consist of 10 upper case letters or digits. Example: "AB32CDE81F". Learn more: https://expo.fyi/creating-asc-api-key.'

'Invalid Apple App Store Connect API Key ID ("ascApiKeyId") was specified. It should consist of 10 uppercase letters or digits. Example: "AB32CDE81F". Learn more: https://expo.fyi/creating-asc-api-key.'

ide · 2024-01-26T04:53:37Z

packages/eas-json/src/submit/schema.ts

+  appleId: Joi.string()
+    .email()
+    .message(
+      'Invalid Apple ID was specified. It should be a valid email address. Example: "[email protected]".'


Prefer to use domains that are guaranteed not to be used in examples. example.com and the .example TLD are valid for examples.

Suggested change

'Invalid Apple ID was specified. It should be a valid email address. Example: "name@domain.com".'

'Invalid Apple ID was specified. It should be a valid email address. Example: "name@example.com".'

ide · 2024-01-26T04:54:19Z

packages/eas-json/src/submit/schema.ts

+  appleTeamId: Joi.string()
+    .regex(/^[\dA-Z]{10}$/)
+    .message(
+      'Invalid Apple Team ID was specified. It should consist of 10 letters or digits. Example: "AB32CDE81F".'


Suggested change

'Invalid Apple Team ID was specified. It should consist of 10 letters or digits. Example: "AB32CDE81F".'

'Invalid Apple Team ID was specified. It should consist of 10 uppercase letters or digits. Example: "AB32CDE81F".'

github-actions · 2024-01-26T09:29:05Z

✅ Thank you for adding the changelog entry!

szdziedzic added 2 commits January 25, 2024 10:55

[eas-json] sanitize EAS Submit inputs better

2e2ffc9

add link to docs

971c5e0

szdziedzic requested review from brentvatne, ide, sjchmiela, radoslawkrzemien and randomhajile January 25, 2024 10:05

szdziedzic requested a review from khamilowicz as a code owner January 25, 2024 10:05

update CHANGELOG.md

2f0f41d

sjchmiela approved these changes Jan 25, 2024

View reviewed changes

packages/eas-json/src/utils.ts Outdated Show resolved Hide resolved

packages/eas-json/src/utils.ts Outdated Show resolved Hide resolved

packages/eas-json/src/utils.ts Outdated Show resolved Hide resolved

packages/eas-json/src/utils.ts Outdated Show resolved Hide resolved

szdziedzic added 2 commits January 25, 2024 14:27

validate app specific password

13ae4c0

use Joi schema for validation

e24cd93

szdziedzic requested a review from sjchmiela January 25, 2024 14:09

fix typo

5b124ba

sjchmiela approved these changes Jan 25, 2024

View reviewed changes

szdziedzic and others added 2 commits January 25, 2024 15:34

minor improvements

38da730

Update packages/eas-cli/src/submit/ios/__tests__/IosSubmitCommand-tes…

3e6fdc6

…t.ts Co-authored-by: Stanisław Chmiela <[email protected]>

make uuid validation less strict

d96d071

randomhajile approved these changes Jan 25, 2024

View reviewed changes

wschurman approved these changes Jan 25, 2024

View reviewed changes

ide reviewed Jan 26, 2024

View reviewed changes

szdziedzic added 2 commits January 26, 2024 10:17

apply suggested changes

a9fc92e

fix tests

9c9320d

szdziedzic merged commit 126c562 into main Jan 26, 2024
9 checks passed

szdziedzic deleted the @szdziedzic/sanitize-values-in-eas-submit-profile-better branch January 26, 2024 09:48

szdziedzic mentioned this pull request Jan 29, 2024

Revert "Revert "[eas-json] validate EAS Submit inputs better"" #2202

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[eas-json] validate EAS Submit inputs better #2198

[eas-json] validate EAS Submit inputs better #2198

szdziedzic commented Jan 25, 2024 •

edited

Loading

szdziedzic commented Jan 25, 2024

github-actions bot commented Jan 25, 2024 •

edited

Loading

codecov bot commented Jan 25, 2024 •

edited

Loading

sjchmiela left a comment

sjchmiela Jan 25, 2024

szdziedzic Jan 25, 2024 •

edited

Loading

sjchmiela Jan 25, 2024

sjchmiela Jan 25, 2024

szdziedzic Jan 25, 2024

sjchmiela Jan 25, 2024

szdziedzic commented Jan 25, 2024

ide Jan 26, 2024

ide Jan 26, 2024

ide Jan 26, 2024

github-actions bot commented Jan 26, 2024

	'Invalid Apple App Store Connect API Key ID ("ascApiKeyId") was specified. It should consist of 10 upper case letters or digits. Example: "AB32CDE81F". Learn more: https://expo.fyi/creating-asc-api-key.'
	'Invalid Apple App Store Connect API Key ID ("ascApiKeyId") was specified. It should consist of 10 uppercase letters or digits. Example: "AB32CDE81F". Learn more: https://expo.fyi/creating-asc-api-key.'

	'Invalid Apple ID was specified. It should be a valid email address. Example: "name@domain.com".'
	'Invalid Apple ID was specified. It should be a valid email address. Example: "name@example.com".'

	'Invalid Apple Team ID was specified. It should consist of 10 letters or digits. Example: "AB32CDE81F".'
	'Invalid Apple Team ID was specified. It should consist of 10 uppercase letters or digits. Example: "AB32CDE81F".'

[eas-json] validate EAS Submit inputs better #2198

[eas-json] validate EAS Submit inputs better #2198

Conversation

szdziedzic commented Jan 25, 2024 • edited Loading

Why

How

Test Plan

szdziedzic commented Jan 25, 2024

github-actions bot commented Jan 25, 2024 • edited Loading

codecov bot commented Jan 25, 2024 • edited Loading

Codecov Report

sjchmiela left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

szdziedzic Jan 25, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

szdziedzic commented Jan 25, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Jan 26, 2024

szdziedzic commented Jan 25, 2024 •

edited

Loading

github-actions bot commented Jan 25, 2024 •

edited

Loading

codecov bot commented Jan 25, 2024 •

edited

Loading

szdziedzic Jan 25, 2024 •

edited

Loading