firebase / firebase-tools

The Firebase Command Line Tools
MIT License
4.02k stars 933 forks source link

Newlines in firebase auth:export are not escaped #3881

Open IchordeDionysos opened 2 years ago

IchordeDionysos commented 2 years ago

Environment info

firebase-tools: v9.21.0

Platform: macOS

Test case

Firebase Auth has to be enabled for the issue to appear, but apart from that the issue can be reproduced using the 3 steps below.

Steps to reproduce

  1. Create a new user like this:

    admin.auth().createUser({
    displayName: 'Foo\nBar'
    });
  2. Use the Firebase CLI to export all users to a file:

    firebase auth:export ./accounts.csv --format CSV --project old-project
  3. Use the Firebase CLI to import all users from the accounts.csv file:

    firebase auth:import ./accounts.csv --project=new-project

Expected behavior

The exported users from Auth simply import to a different Firebase project using the CLI.

Actual behavior

I am getting the following error: The import fails with an error like this: Error: Line 2 (...) has invalid data format: Password hash should be base64 encoded.

After investigating the data a bit I noticed some interesting data regarding all name fields: A user added via Google Login had a newline (\n) in their "Name" (column 6) and "Google Display Name" (column 10), which resulted in the CSV also including a line break!

So the accounts.csv looked something like this: 123123123,foo.bar@example.com,true,passwordHash==,salt==,Foo Bar,https://example.com/images.png,foo.bar@example.com,Foo Bar,https://example.com/images.png,,,,,,,,,,,,,1111,1111,,false,,

Because of this new line in the name fields, the resulting CSV is incorrect and the importer assumed that the second line was a new entry even though it still was connected to the previous user.

yuchenshi commented 2 years ago

Hi, thanks for filing this issue! We are unable to promise any timeline for this, but if others also have this issue, adding a +1 on this issue can help us prioritize adding this to the roadmap.

As a workaround, please use --format JSON for now, which does not suffer from CSV formatting issues but works equally well for auth:import.

(Googler-only internal tracking bug: b/205620419/)