Validate VAPID keys are URL safe Base64 (#657)

Fixes #656

Author: sw1tchdev

src/vapid-helper.js

@@ -93,6 +93,10 @@ function validatePublicKey(publicKey) {
     + 'encoded string.');
   }
 
+  if (!urlBase64.validate(publicKey)) {
+    throw new Error('Vapid public key must be a URL safe Base 64 (without "=")');
+  }
+
   publicKey = urlBase64.decode(publicKey);
 
   if (publicKey.length !== 65) {
@@ -110,6 +114,10 @@ function validatePrivateKey(privateKey) {
     + 'encoded string.');
   }
 
+  if (!urlBase64.validate(privateKey)) {
+    throw new Error('Vapid private key must be a URL safe Base 64 (without "=")');
+  }
+
   privateKey = urlBase64.decode(privateKey);
 
   if (privateKey.length !== 32) {

test/test-vapid-helper.js

@@ -12,7 +12,9 @@ const VALID_AUDIENCE = 'https://example.com';
 const VALID_SUBJECT_MAILTO = 'mailto: [email protected]';
 const VALID_SUBJECT_URL = 'https://exampe.com/contact';
 const VALID_PUBLIC_KEY = urlBase64.encode(Buffer.alloc(65));
+const VALID_UNSAFE_BASE64_PUBLIC_KEY = Buffer.alloc(65).toString('base64');
 const VALID_PRIVATE_KEY = urlBase64.encode(Buffer.alloc(32));
+const VALID_UNSAFE_BASE64_PRIVATE_KEY = Buffer.alloc(32).toString('base64');
 const VALID_CONTENT_ENCODING = webPush.supportedContentEncodings.AES_GCM;
 const VALID_EXPIRATION = Math.floor(Date.now() / 1000) + (60 * 60 * 12);
 
@@ -123,6 +125,14 @@ suite('Test Vapid Helpers', function() {
       function() {
         vapidHelper.getVapidHeaders(VALID_AUDIENCE, VALID_SUBJECT_MAILTO, VALID_PUBLIC_KEY, VALID_PRIVATE_KEY, 'invalid encoding type');
       },
+      function () {
+        // Public key with unsafe base64
+        vapidHelper.getVapidHeaders(VALID_AUDIENCE, VALID_SUBJECT_MAILTO, VALID_UNSAFE_BASE64_PUBLIC_KEY, VALID_PRIVATE_KEY, VALID_CONTENT_ENCODING);
+      },
+      function () {
+        // Private key with unsafe base64
+        vapidHelper.getVapidHeaders(VALID_AUDIENCE, VALID_SUBJECT_MAILTO, VALID_PUBLIC_KEY, VALID_UNSAFE_BASE64_PRIVATE_KEY, VALID_CONTENT_ENCODING);
+      },
       function () {
         // String with text, is not accepted as a valid expiration value
         vapidHelper.getVapidHeaders(VALID_AUDIENCE, VALID_SUBJECT_MAILTO, VALID_PUBLIC_KEY, VALID_PRIVATE_KEY, VALID_CONTENT_ENCODING, 'Not valid expiration: Must be a number, this is a string with text');