search

platformplatform / PlatformPlatform

Alpha state. A platform designed for building enterprise-grade, multi-tenant products using Azure, .NET, React, TypeScript, Infrastructure as Code, etc.
https://platformplatform.github.io
MIT License
257 stars 26 forks source link

User info in SPA HTML does not support UTF-8 #571

Closed gudmundurh closed 2 months ago

gudmundurh commented 2 months ago

Contact Details

No response

Detailed description?

Describe the bug The SPA HTML contains the userInfoEnv variable, which is serialized in C# using Encoding.UTF8 in SinglePageAppFallbackExtensions.GetHtmlWithEnvironment. However, when deserialising in the browser, Latin1 encoding is assumed in the call to atob:

const userInfoEnv: UserInfoEnv = JSON.parse(atob(userInfoEnvElement.content));

...resulting in:

image

The docs for atob state: Decodes a string into bytes using Latin-1 (ISO-8859), and encodes those bytes into a string using Base64.

Expected behavior

Deserialization should use UTF-8.

Additional context

Why the Base64 serialization, rather than just using JSON? That would simplify and avoid the problem.

Severity

Medium

Is this bug security related?

Code of Conduct