Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[MM-54465] Remove lowercase call when checking path names #2831

Merged

Conversation

devinbinnie
Copy link
Member

Summary

When we were checking if two URLs were equal, we were assuming that like the URL's origin, the pathname was also not case-sensitive. This is not the case so it was possible that two URLs with different URLs could be considered equal.

This PR removed the call to toLowerCase() to make sure we respect case sensitivity for path names.

Ticket Link

https://mattermost.atlassian.net/browse/MM-54465

Fixed an issue where two different URLs could be considered the same.

@devinbinnie devinbinnie added 2: Dev Review Requires review by a core committer Do Not Merge Should not be merged until this label is removed CherryPick/Approved Meant for the quality or patch release tracked in the milestone 3: Security Review Review requested from Security Team labels Sep 13, 2023
@devinbinnie devinbinnie added this to the v5.5.0 milestone Sep 13, 2023
@@ -201,7 +201,7 @@ export function validateV0ConfigData(data: ConfigV0) {
function cleanURL(url: string): string {
let updatedURL = url;
if (updatedURL.includes('\\')) {
updatedURL = updatedURL.toLowerCase().replace(/\\/gi, '/');
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are there any cases where later we compare the server url that it make break now if it's there any casing mistmatch?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't be. We were doing this to make sure the path name was lower case, and this function is mostly to get rid of double slashes. We do a lower case when we compared host and origin in other parts of the code.

Copy link
Member

@marianunez marianunez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@esarafianou esarafianou removed the 3: Security Review Review requested from Security Team label Sep 14, 2023
@amyblais amyblais added 4: Reviews Complete All reviewers have approved the pull request and removed 2: Dev Review Requires review by a core committer labels Sep 14, 2023
@devinbinnie devinbinnie removed the Do Not Merge Should not be merged until this label is removed label Sep 15, 2023
@devinbinnie devinbinnie merged commit 128d15a into mattermost:master Sep 15, 2023
13 checks passed
@mattermost-build
Copy link
Contributor

Cherry pick is scheduled.

mattermost-build pushed a commit to mattermost-build/desktop that referenced this pull request Sep 15, 2023
@mattermost-build mattermost-build added CherryPick/Done Successfully cherry-picked to the quality or patch release tracked in the milestone and removed CherryPick/Approved Meant for the quality or patch release tracked in the milestone labels Sep 15, 2023
devinbinnie added a commit that referenced this pull request Sep 15, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
4: Reviews Complete All reviewers have approved the pull request CherryPick/Done Successfully cherry-picked to the quality or patch release tracked in the milestone release-note
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants