fix: Add validation to reject known-bad hash values (#356)

Author: MykhailoNester

crowdin/src/main/java/com/crowdin/platform/CrowdinConfig.kt

@@ -5,6 +5,7 @@ import android.util.Log
 import com.crowdin.platform.data.model.ApiAuthConfig
 import com.crowdin.platform.data.model.AuthConfig
 import com.crowdin.platform.data.remote.NetworkType
+import java.util.Locale
 
 /**
  * Contains configuration properties for initializing Crowdin.
@@ -108,7 +109,10 @@ class CrowdinConfig private constructor() {
         fun build(): CrowdinConfig {
             val config = CrowdinConfig()
             config.isPersist = isPersist
-            require(distributionHash.isNotEmpty()) { "Crowdin: `distributionHash` cannot be empty" }
+            require(isValidDistributionHash(distributionHash)) {
+                "Crowdin: `distributionHash` is misconfigured (got \"$distributionHash\"). " +
+                    "Ensure you pass a valid distribution hash from your Crowdin project settings."
+            }
 
             config.distributionHash = distributionHash
 
@@ -181,4 +185,11 @@ class CrowdinConfig private constructor() {
             private const val MIN_PERIODIC_INTERVAL_MILLIS = 15 * 60 * 1000L // 15 minutes.
         }
     }
+
+    companion object {
+        internal fun isValidDistributionHash(hash: String): Boolean {
+            val lower = hash.trim().lowercase(Locale.ROOT)
+            return lower.isNotEmpty() && lower != "null" && lower != "undefined" && lower != "false" && !lower.contains("/")
+        }
+    }
 }

crowdin/src/main/java/com/crowdin/platform/data/remote/CrowdingRepository.kt

@@ -4,6 +4,7 @@ import android.content.res.Configuration
 import android.util.Log
 import androidx.annotation.WorkerThread
 import com.crowdin.platform.Crowdin
+import com.crowdin.platform.CrowdinConfig
 import com.crowdin.platform.data.LanguageDataCallback
 import com.crowdin.platform.data.model.LanguageDetails
 import com.crowdin.platform.data.model.ManifestData
@@ -30,6 +31,15 @@ internal abstract class CrowdingRepository(
         languageDataCallback: LanguageDataCallback?,
         function: (ManifestData) -> Unit,
     ) {
+        if (!CrowdinConfig.isValidDistributionHash(distributionHash)) {
+            val msg =
+                "Crowdin: distribution hash is invalid (\"$distributionHash\"). " +
+                    "Manifest request skipped. Check your CrowdinConfig."
+            Log.e(Crowdin.CROWDIN_TAG, msg)
+            languageDataCallback?.onFailure(Throwable(msg))
+            return
+        }
+
         Log.v(
             Crowdin.CROWDIN_TAG,
             "${javaClass.simpleName}. Loading resource manifest from Api started. Hash: $distributionHash",

crowdin/src/test/java/com/crowdin/platform/CrowdinConfigTest.kt

@@ -17,12 +17,66 @@ class CrowdinConfigTest {
                 .withDistributionHash(distributionHash)
                 .build()
             Assert.fail("SDK initialization with empty `distribution hash` not valid.")
-        } catch (exception: IllegalArgumentException) {
+        } catch (_: IllegalArgumentException) {
             // Then
             // exception expected
         }
     }
 
+    @Test
+    fun whenDistributionHashIsNull_shouldThrowException() {
+        listOf("null", "NULL", "Null").forEach { hash ->
+            try {
+                CrowdinConfig.Builder().withDistributionHash(hash).build()
+                Assert.fail("SDK initialization with `distributionHash` = \"$hash\" should not be valid.")
+            } catch (_: IllegalArgumentException) {
+                // expected
+            }
+        }
+    }
+
+    @Test
+    fun whenDistributionHashIsFalse_shouldThrowException() {
+        listOf("false", "FALSE", "False").forEach { hash ->
+            try {
+                CrowdinConfig.Builder().withDistributionHash(hash).build()
+                Assert.fail("SDK initialization with `distributionHash` = \"$hash\" should not be valid.")
+            } catch (_: IllegalArgumentException) {
+                // expected
+            }
+        }
+    }
+
+    @Test
+    fun whenDistributionHashIsUndefined_shouldThrowException() {
+        listOf("undefined", "UNDEFINED").forEach { hash ->
+            try {
+                CrowdinConfig.Builder().withDistributionHash(hash).build()
+                Assert.fail("SDK initialization with `distributionHash` = \"$hash\" should not be valid.")
+            } catch (_: IllegalArgumentException) {
+                // expected
+            }
+        }
+    }
+
+    @Test
+    fun whenDistributionHashContainsSlash_shouldThrowException() {
+        listOf("/hash", "hash/", "/").forEach { hash ->
+            try {
+                CrowdinConfig.Builder().withDistributionHash(hash).build()
+                Assert.fail("SDK initialization with `distributionHash` = \"$hash\" should not be valid.")
+            } catch (_: IllegalArgumentException) {
+                // expected
+            }
+        }
+    }
+
+    @Test
+    fun whenDistributionHashIsValid_shouldBuildSuccessfully() {
+        val config = CrowdinConfig.Builder().withDistributionHash("abc123-valid-hash").build()
+        Assert.assertEquals("abc123-valid-hash", config.distributionHash)
+    }
+
     @Test
     fun whenSourceLanguageEmptyWithRealTimeEnabled_shouldThrowException() {
         // Given
@@ -37,7 +91,7 @@ class CrowdinConfigTest {
                 .withSourceLanguage(sourceLanguage)
                 .build()
             Assert.fail("SDK initialization with empty `sourceLanguage` when realTime updates enabled - not valid.")
-        } catch (exception: IllegalArgumentException) {
+        } catch (_: IllegalArgumentException) {
             // Then
             // exception expected
         }
@@ -57,7 +111,7 @@ class CrowdinConfigTest {
                 .withSourceLanguage(sourceLanguage)
                 .build()
             Assert.fail("SDK initialization with empty `sourceLanguage` when screenshots enabled - not valid.")
-        } catch (exception: IllegalArgumentException) {
+        } catch (_: IllegalArgumentException) {
             // Then
             // exception expected
         }
@@ -76,7 +130,7 @@ class CrowdinConfigTest {
                 .withAuthConfig(authConfig)
                 .build()
             Assert.fail("SDK initialization with empty `AuthConfig` values - not valid.")
-        } catch (exception: IllegalArgumentException) {
+        } catch (_: IllegalArgumentException) {
             // Then
             // exception expected
         }