fix: reject unhyphenated channelIDs from register

Closes #1225
mozilla-services · May 11, 2018 · 2579197 · 2579197
1 parent 976c4c3
commit 2579197
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 4 deletions.
diff --git a/autopush_rs/src/client.rs b/autopush_rs/src/client.rs
@@ -696,7 +696,6 @@ where
             );
             transition!(AwaitMigrateUser { response, data });
         } else if all_acked && webpush.flags.reset_uaid {
-
             let response = data.srv.ddb.drop_uaid(&data.srv.opts.router_table_name, &webpush.uaid);
             transition!(AwaitDropUser { response, data });
         }
@@ -733,9 +732,18 @@ where
                     transition!(AwaitInput { data });
                 }
             }
-            Either::A(ClientMessage::Register { channel_id, key }) => {
+            Either::A(ClientMessage::Register {
+                channel_id: channel_id_str,
+                key,
+            }) => {
                 debug!("Got a register command";
-                "channel_id" => channel_id.hyphenated().to_string());
+                       "channel_id" => &channel_id_str);
+                let channel_id =
+                    Uuid::parse_str(&channel_id_str).chain_err(|| "Invalid channelID")?;
+                if channel_id.hyphenated().to_string() != channel_id_str {
+                    return Err("Bad UUID format, use lower case, dashed format".into());
+                }
+
                 let uaid = webpush.uaid.clone();
                 let message_month = webpush.message_month.clone();
                 let srv = data.srv.clone();
@@ -750,6 +758,8 @@ where
             }
             Either::A(ClientMessage::Unregister { channel_id, code }) => {
                 debug!("Got a unregister command");
+                // XXX: unregister should check the format of channel_id like
+                // register does
                 let uaid = webpush.uaid.clone();
                 let message_month = webpush.message_month.clone();
                 let fut = data.srv.ddb.unregister(

diff --git a/autopush_rs/src/protocol.rs b/autopush_rs/src/protocol.rs
@@ -38,7 +38,7 @@ pub enum ClientMessage {
 
     Register {
         #[serde(rename = "channelID")]
-        channel_id: Uuid,
+        channel_id: String,
         key: Option<String>,
     },