Skip to content

Commit 113fd66

Browse files
committed
Check nonce regex
1 parent 31a11ed commit 113fd66

File tree

1 file changed

+16
-4
lines changed

1 file changed

+16
-4
lines changed

WooCommerce/Classes/Authentication/SiteCredentialLoginUseCase.swift

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ private extension SiteCredentialLoginUseCase {
159159
throw SiteCredentialLoginError.invalidLoginResponse
160160
}
161161

162-
let isNonceUrl = response.url?.absoluteString.contains(Constants.wporgNoncePath) == true
162+
let isNonceUrl = response.url?.absoluteString.hasSuffix(Constants.wporgNoncePath) == true
163163

164164
switch response.statusCode {
165165
case 404:
@@ -169,9 +169,10 @@ private extension SiteCredentialLoginUseCase {
169169
throw SiteCredentialLoginError.inaccessibleLoginPage
170170
}
171171
case 200:
172-
if isNonceUrl {
173-
// Means success
174-
// But maybe we can also validate the nonce format like Android https://github.com/woocommerce/woocommerce-android/blob/ea4a48355b5ca4d49dc27e91566aaed304ab5916/libs/fluxc/src/main/java/org/wordpress/android/fluxc/network/rest/wpapi/NonceRestClient.kt#L120
172+
if isNonceUrl,
173+
let nonceString = String(data: data, encoding: .utf8),
174+
nonceString.isValidNonce() {
175+
// success!
175176
return
176177
} else {
177178
// 200 for the login URL, which means a failure
@@ -277,4 +278,15 @@ private extension String {
277278
func hasInvalidCredentialsPattern() -> Bool {
278279
contains("document.querySelector('form').classList.add('shake')")
279280
}
281+
282+
/// Validates if the string matches the expected nonce format.
283+
/// A valid nonce should contain at least 2 alphanumeric characters.
284+
///
285+
func isValidNonce() -> Bool {
286+
guard let regex = try? Regex("^[0-9a-zA-Z]{2,}$") else {
287+
DDLogError("⚠️ Invalid regex pattern")
288+
return false
289+
}
290+
return wholeMatch(of: regex) != nil
291+
}
280292
}

0 commit comments

Comments
 (0)