Passwords with quotes breaks the JSON

[fflorent]

Describe the bug

When installing the application, if the password contains quotes, it breaks the configuration json file (/home/yunohost.app/galene/groups/GROUP.json)

• Install Galene using a password containing quotes (like 1"2"3"4"5)
• After the installation, you should not be able to join the group filled during the installation
• Also you should get a broken JSON in /home/yunohost.app/galene/groups/GROUP.json due to the quotes not being escaped

Logs

mars 13 21:31:51 domain.tld systemd[1]: Started Galène: videoconferencing server.
mars 13 21:31:51 domain.tld galene[23076]: 2022/03/13 21:31:51 Starting built-in TURN server on XX.XX.XX.XX:1195
mars 13 21:31:51 domain.tld galene[23076]: 2022/03/13 21:31:51 data/config.json: invalid character '<character here>' after object key:value pair
mars 13 21:31:51 domain.tld galene[23076]: 2022/03/13 21:31:51 Group file /home/yunohost.app/galene/groups/skeptikon.json: invalid character '<character here>' after object key:value pair
mars 13 21:31:51 domain.tld galene[23076]: 2022/03/13 21:31:51 Relay test successful in 30.98294ms, RTT = 264.613µs
mars 13 21:37:22 domain.tld galene[23076]: 2022/03/13 21:37:22 group.Add: invalid character '<character here>' after object key:value pair

Thanks for your work! 🙏

[fflorent]

BTW, Galene supports the hash of the passwords: https://github.com/jech/galene/blob/e673cf1225e4eeefd8c8f658c00675c7fbe53868/README#L178-L193

Couldn't we fix this issue by hashing it?

[jech]

No need to hash: you just need to escape the quote in the JSON string.

https://datatracker.ietf.org/doc/html/rfc7159#section-7

Any JSON formatting library should do it for you automatically.

[fflorent]

No need to hash: you just need to escape the quote in the JSON string.

https://datatracker.ietf.org/doc/html/rfc7159#section-7

Any JSON formatting library should do it for you automatically.

Still, hashing passwords is a good practice, isn't it?

[jech]

Still, hashing passwords is a good practice, isn't it?

Hashing is certainly a good idea, and I'll be glad to give you a hand with implementing compatible hashing in the Yunohost's interface. However, I understand that Yunohost already has its own authentication system, and you should consider whether it's better to spend time on implementing hashing, or whether it's better to work on integrating Galene into Yunohost's existing authentication system. Please see #64 for more on the latter.