fix: crash using invalid characters in HTTP header #75

levibostian · 2022-03-21T17:45:48Z

Fixes: https://github.com/customerio/issues/issues/6980

Shahroz16 · 2022-03-21T19:03:58Z

base/src/main/java/io/customer/base/extenstions/OkHttpExtensions.kt

+ *
+ * Here, we are removing all of the invalid characters to prevent OkHttp throwing an exception.
+ */
+fun String.filterHeaderValue(): String {


I was browsing through Okhttp documentation, and it looks like they provide a method to do something similar, do you think it can do the job for us?

something like

val header = Headers.Builder() header.addUnsafeNonAscii("User-Agent", store.deviceStore.buildUserAgent())

https://square.github.io/okhttp/4.x/okhttp/okhttp3/-headers/-builder/add-unsafe-non-ascii/

that function makes it sound like it would pass along the non-ascii characters in the request so if we decide to use it would need to make sure that wont cause any other issues.

That's my conclusion from looking into addUnsafeNonAscii, too.

I asked team-engineering and SRE if non-ascii characters are going to cause issues. If it won't, we can go with this suggestion. Else, I suggest we stick with the proposed PR solution which strips out non-ascii characters.

From browsing some github issues, there seems to be reasons why using non-ascii is not recommended. If it doesn't cause issues today, it might in the future as we update a web server dependency or something.

Moved conversation to slack since it involves other teams.

From the slack thread, I propose to fix this issue, we use the app's package name instead of app name for the User-Agent value.

I have implemented this idea in this PR. Depending on what we decide as a team, I can do some git cherry-picking/reverting to change the state of this PR to a different solution.

This reverts commit 24825d3.

## [1.0.4](1.0.3...1.0.4) (2022-03-21) ### Bug Fixes * crash using invalid characters in HTTP header ([#75](#75)) ([81a065e](81a065e))

ami-ci · 2022-03-21T21:41:15Z

🎉 This PR is included in version 1.0.4 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

## [1.1.0-alpha.2](1.1.0-alpha.1...1.1.0-alpha.2) (2022-03-25) ### Features * support for custom device attributes and config ([#77](#77)) ([a7dbaba](a7dbaba)) ### Bug Fixes * added java compatibility in public constructors and methods ([2bb73be](2bb73be)) * allow http requests in host app ([#74](#74)) ([1035648](1035648)) * code cleanup ([c651ee6](c651ee6)) * crash using invalid characters in HTTP header ([#75](#75)) ([81a065e](81a065e))

ami-ci · 2022-03-25T12:30:42Z

🎉 This PR is included in version 1.1.0-alpha.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

## 1.0.0 (2023-02-10) ### ⚠ BREAKING CHANGES * android 12 deep link fix * get current FCM token on SDK startup * register device attributes when set * create background queue to make API synchronous ### Features * add device and profile attribute setters ([789f09f](789f09f)) * add device_manufacturer device attribute ([6a60f39](6a60f39)) * add setting a in-app event listener ([customerio#147](https://github.com/nunofgs/customerio-android/issues/147)) ([5fd9559](5fd9559)) * added option to customize push notification from app ([68010f8](68010f8)) * added shared instance for independent components ([70fa8cd](70fa8cd)) * added support for custom track url ([b61a64b](b61a64b)) * added support for device attributes ([customerio#71](https://github.com/nunofgs/customerio-android/issues/71)) ([5fedf26](5fedf26)) * added support to modify notification small icon ([b93c2dc](b93c2dc)) * automatic screen tracking ([customerio#52](https://github.com/nunofgs/customerio-android/issues/52)) ([8f95ebb](8f95ebb)) * changes for react native package ([2f20ac3](2f20ac3)) * create background queue to make API synchronous ([2524460](2524460)) * delete expired background queue tasks ([8dca8b7](8dca8b7)) * event tracking, identify customer ([customerio#29](https://github.com/nunofgs/customerio-android/issues/29)) ([5181268](5181268)) * get current FCM token on SDK startup ([dda443d](dda443d)) * in app sdk ([1036c80](1036c80)) * in-app feature no longer requires orgId ([customerio#163](https://github.com/nunofgs/customerio-android/issues/163)) ([fc2a08e](fc2a08e)) * manual screen tracking ([customerio#51](https://github.com/nunofgs/customerio-android/issues/51)) ([213a278](213a278)) * Push notification ([customerio#31](https://github.com/nunofgs/customerio-android/issues/31)) ([c639802](c639802)) * register device attributes when set ([0f5159e](0f5159e)) * Rich push support ([customerio#34](https://github.com/nunofgs/customerio-android/issues/34)) ([2480127](2480127)) * sdk initialization re-architecture ([9e21960](9e21960)) * set log level via SDK config ([81eea4e](81eea4e)) * support for custom device attributes and config ([customerio#77](https://github.com/nunofgs/customerio-android/issues/77)) ([a7dbaba](a7dbaba)) * updated client to support react native user agent ([7588526](7588526)) ### Bug Fixes * added alternative route to fetch screen name for automatic tracking ([customerio#92](https://github.com/nunofgs/customerio-android/issues/92)) ([37a20b5](37a20b5)) * added java compatibility in public constructors and methods ([2bb73be](2bb73be)) * added java compatibility in public constructors and methods ([acdec46](acdec46)) * added support for big decimal ([customerio#56](https://github.com/nunofgs/customerio-android/issues/56)) ([58c791b](58c791b)) * allow http requests in host app ([customerio#74](https://github.com/nunofgs/customerio-android/issues/74)) ([1035648](1035648)) * android 12 deep link fix ([fd7ae28](fd7ae28)) * cio sdk version attribute using client value ([bb90f35](bb90f35)) * code cleanup ([c651ee6](c651ee6)) * crash using invalid characters in HTTP header ([customerio#75](https://github.com/nunofgs/customerio-android/issues/75)) ([81a065e](81a065e)) * delete device token when clear identify ([72f9753](72f9753)) * deploy code script commands ([customerio#124](https://github.com/nunofgs/customerio-android/issues/124)) ([fe817d1](fe817d1)) * events are tracked to identified customer ([71634ed](71634ed)) * in-app messages instant delivery ([customerio#150](https://github.com/nunofgs/customerio-android/issues/150)) ([a6dcf3c](a6dcf3c)) * in-app messages stop delivering ([4027502](4027502)) * in-app system link causes app reopen ([6349081](6349081)) * moved shared wrapper code ([customerio#158](https://github.com/nunofgs/customerio-android/issues/158)) ([51af98f](51af98f)) * number parsing coverts to double ([customerio#57](https://github.com/nunofgs/customerio-android/issues/57)) ([72a80fe](72a80fe)) * parsing exception for expired tasks ([440bb13](440bb13)) * pro-guarding removal of enums ([customerio#39](https://github.com/nunofgs/customerio-android/issues/39)) ([dd27d35](dd27d35)) * queue attempts to run all tasks on each run ([e180dea](e180dea)) * register device tokens http request ([b1c6872](b1c6872)) * remove currentRoute parameter in in-app event listener ([customerio#159](https://github.com/nunofgs/customerio-android/issues/159)) ([688e4a5](688e4a5)) * rename in app listener keys ([customerio#164](https://github.com/nunofgs/customerio-android/issues/164)) ([f540eaf](f540eaf)) * set gist user token incase identifier exists ([customerio#162](https://github.com/nunofgs/customerio-android/issues/162)) ([44cc4d1](44cc4d1)) * timestamp conversion issue ([customerio#37](https://github.com/nunofgs/customerio-android/issues/37)) ([d986f54](d986f54)) * track opens fcm notification payload ([ab3cd18](ab3cd18)) * updated host endpoints ([customerio#53](https://github.com/nunofgs/customerio-android/issues/53)) ([efe2b9e](efe2b9e)) * updated json adapter usage to safe parsing ([f72280b](f72280b)) * upgrade dependencies ([customerio#146](https://github.com/nunofgs/customerio-android/issues/146)) ([6da8b8d](6da8b8d)) * user agent ([customerio#42](https://github.com/nunofgs/customerio-android/issues/42)) ([37af83e](37af83e)) * user agent client support in preferences repo ([454a18e](454a18e)) * version bump for gist sdk to resolve messaging not showing bug ([05dad42](05dad42))

## 1.0.0 (2023-02-13) ### ⚠ BREAKING CHANGES * android 12 deep link fix * get current FCM token on SDK startup * register device attributes when set * create background queue to make API synchronous ### Features * add device and profile attribute setters ([789f09f](789f09f)) * add device_manufacturer device attribute ([6a60f39](6a60f39)) * add setting a in-app event listener ([customerio#147](https://github.com/nunofgs/customerio-android/issues/147)) ([5fd9559](5fd9559)) * added option to customize push notification from app ([68010f8](68010f8)) * added shared instance for independent components ([70fa8cd](70fa8cd)) * added support for custom track url ([b61a64b](b61a64b)) * added support for device attributes ([customerio#71](https://github.com/nunofgs/customerio-android/issues/71)) ([5fedf26](5fedf26)) * added support to modify notification small icon ([b93c2dc](b93c2dc)) * automatic screen tracking ([customerio#52](https://github.com/nunofgs/customerio-android/issues/52)) ([8f95ebb](8f95ebb)) * changes for react native package ([2f20ac3](2f20ac3)) * create background queue to make API synchronous ([2524460](2524460)) * delete expired background queue tasks ([8dca8b7](8dca8b7)) * event tracking, identify customer ([customerio#29](https://github.com/nunofgs/customerio-android/issues/29)) ([5181268](5181268)) * get current FCM token on SDK startup ([dda443d](dda443d)) * in app sdk ([1036c80](1036c80)) * in-app feature no longer requires orgId ([customerio#163](https://github.com/nunofgs/customerio-android/issues/163)) ([fc2a08e](fc2a08e)) * manual screen tracking ([customerio#51](https://github.com/nunofgs/customerio-android/issues/51)) ([213a278](213a278)) * Push notification ([customerio#31](https://github.com/nunofgs/customerio-android/issues/31)) ([c639802](c639802)) * register device attributes when set ([0f5159e](0f5159e)) * Rich push support ([customerio#34](https://github.com/nunofgs/customerio-android/issues/34)) ([2480127](2480127)) * sdk initialization re-architecture ([9e21960](9e21960)) * set log level via SDK config ([81eea4e](81eea4e)) * support for custom device attributes and config ([customerio#77](https://github.com/nunofgs/customerio-android/issues/77)) ([a7dbaba](a7dbaba)) * updated client to support react native user agent ([7588526](7588526)) ### Bug Fixes * added alternative route to fetch screen name for automatic tracking ([customerio#92](https://github.com/nunofgs/customerio-android/issues/92)) ([37a20b5](37a20b5)) * added java compatibility in public constructors and methods ([2bb73be](2bb73be)) * added java compatibility in public constructors and methods ([acdec46](acdec46)) * added support for big decimal ([customerio#56](https://github.com/nunofgs/customerio-android/issues/56)) ([58c791b](58c791b)) * allow http requests in host app ([customerio#74](https://github.com/nunofgs/customerio-android/issues/74)) ([1035648](1035648)) * android 12 deep link fix ([fd7ae28](fd7ae28)) * cio sdk version attribute using client value ([bb90f35](bb90f35)) * code cleanup ([c651ee6](c651ee6)) * crash using invalid characters in HTTP header ([customerio#75](https://github.com/nunofgs/customerio-android/issues/75)) ([81a065e](81a065e)) * delete device token when clear identify ([72f9753](72f9753)) * deploy code script commands ([customerio#124](https://github.com/nunofgs/customerio-android/issues/124)) ([fe817d1](fe817d1)) * events are tracked to identified customer ([71634ed](71634ed)) * in-app messages instant delivery ([customerio#150](https://github.com/nunofgs/customerio-android/issues/150)) ([a6dcf3c](a6dcf3c)) * in-app messages stop delivering ([4027502](4027502)) * in-app system link causes app reopen ([6349081](6349081)) * moved shared wrapper code ([customerio#158](https://github.com/nunofgs/customerio-android/issues/158)) ([51af98f](51af98f)) * number parsing coverts to double ([customerio#57](https://github.com/nunofgs/customerio-android/issues/57)) ([72a80fe](72a80fe)) * parsing exception for expired tasks ([440bb13](440bb13)) * pro-guarding removal of enums ([customerio#39](https://github.com/nunofgs/customerio-android/issues/39)) ([dd27d35](dd27d35)) * queue attempts to run all tasks on each run ([e180dea](e180dea)) * register device tokens http request ([b1c6872](b1c6872)) * remove currentRoute parameter in in-app event listener ([customerio#159](https://github.com/nunofgs/customerio-android/issues/159)) ([688e4a5](688e4a5)) * rename in app listener keys ([customerio#164](https://github.com/nunofgs/customerio-android/issues/164)) ([f540eaf](f540eaf)) * set gist user token incase identifier exists ([customerio#162](https://github.com/nunofgs/customerio-android/issues/162)) ([44cc4d1](44cc4d1)) * timestamp conversion issue ([customerio#37](https://github.com/nunofgs/customerio-android/issues/37)) ([d986f54](d986f54)) * track opens fcm notification payload ([ab3cd18](ab3cd18)) * updated host endpoints ([customerio#53](https://github.com/nunofgs/customerio-android/issues/53)) ([efe2b9e](efe2b9e)) * updated json adapter usage to safe parsing ([f72280b](f72280b)) * upgrade dependencies ([customerio#146](https://github.com/nunofgs/customerio-android/issues/146)) ([6da8b8d](6da8b8d)) * user agent ([customerio#42](https://github.com/nunofgs/customerio-android/issues/42)) ([37af83e](37af83e)) * user agent client support in preferences repo ([454a18e](454a18e)) * version bump for gist sdk to resolve messaging not showing bug ([05dad42](05dad42))

fix: crash using invalid characters in HTTP header

24825d3

levibostian self-assigned this Mar 21, 2022

Shahroz16 reviewed Mar 21, 2022

View reviewed changes

levibostian added 3 commits March 21, 2022 15:53

Revert "fix: crash using invalid characters in HTTP header"

fc42e32

This reverts commit 24825d3.

change to using package name in user-agent instead of app name

730e75f

fix tests

c749b2a

jatinn approved these changes Mar 21, 2022

View reviewed changes

levibostian merged commit 81a065e into main Mar 21, 2022

levibostian deleted the levi/fix-user-agent-invalid-chars branch March 21, 2022 21:36

github-actions bot pushed a commit that referenced this pull request Mar 21, 2022

chore: deploy 1.0.4

1789ebf

## [1.0.4](1.0.3...1.0.4) (2022-03-21) ### Bug Fixes * crash using invalid characters in HTTP header ([#75](#75)) ([81a065e](81a065e))

ami-ci added the released label Mar 21, 2022

ami-ci added the released on @alpha label Mar 25, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: crash using invalid characters in HTTP header #75

fix: crash using invalid characters in HTTP header #75

levibostian commented Mar 21, 2022 •

edited

Loading

Shahroz16 Mar 21, 2022 •

edited

Loading

jatinn Mar 21, 2022

levibostian Mar 21, 2022 •

edited

Loading

levibostian Mar 21, 2022

levibostian Mar 21, 2022

ami-ci commented Mar 21, 2022

ami-ci commented Mar 25, 2022

fix: crash using invalid characters in HTTP header #75

fix: crash using invalid characters in HTTP header #75

Conversation

levibostian commented Mar 21, 2022 • edited Loading

Shahroz16 Mar 21, 2022 • edited Loading

Choose a reason for hiding this comment

jatinn Mar 21, 2022

Choose a reason for hiding this comment

levibostian Mar 21, 2022 • edited Loading

Choose a reason for hiding this comment

levibostian Mar 21, 2022

Choose a reason for hiding this comment

levibostian Mar 21, 2022

Choose a reason for hiding this comment

ami-ci commented Mar 21, 2022

ami-ci commented Mar 25, 2022

levibostian commented Mar 21, 2022 •

edited

Loading

Shahroz16 Mar 21, 2022 •

edited

Loading

levibostian Mar 21, 2022 •

edited

Loading