Fix command auth escaping for apostrophes (#298)

Co-authored-by: Owen McGirr <o.a.mcgirr@gmail.com>

Author: enaboapps

src/SwitchifyPc.Core/Pairing/CommandAuth.cs

@@ -1,6 +1,7 @@
 using System.Globalization;
 using System.Security.Cryptography;
 using System.Text;
+using System.Text.Encodings.Web;
 using System.Text.Json;
 using SwitchifyPc.Protocol;
 
@@ -37,7 +38,7 @@ internal static string StableStringify(JsonElement value)
         {
             JsonValueKind.Object => StableObjectStringify(value),
             JsonValueKind.Array => $"[{string.Join(",", value.EnumerateArray().Select(StableStringify))}]",
-            JsonValueKind.String => JsonSerializer.Serialize(value.GetString()),
+            JsonValueKind.String => JsonSerializer.Serialize(value.GetString(), CanonicalJsonOptions),
             JsonValueKind.Number => NumberString(value),
             JsonValueKind.True => "true",
             JsonValueKind.False => "false",
@@ -59,7 +60,7 @@ private static string StableObjectStringify(JsonElement value)
             ",",
             value.EnumerateObject()
                 .OrderBy(property => property.Name, StringComparer.Ordinal)
-                .Select(property => $"{JsonSerializer.Serialize(property.Name)}:{StableStringify(property.Value)}")) + "}";
+                .Select(property => $"{JsonSerializer.Serialize(property.Name, CanonicalJsonOptions)}:{StableStringify(property.Value)}")) + "}";
     }
 
     private static string CommandResponseMode(JsonElement command)
@@ -101,6 +102,11 @@ private static string Base64UrlEncode(byte[] value)
             .Replace("+", "-", StringComparison.Ordinal)
             .Replace("/", "_", StringComparison.Ordinal);
     }
+
+    private static readonly JsonSerializerOptions CanonicalJsonOptions = new()
+    {
+        Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping
+    };
 }
 
 public sealed record AuthValidationResult

src/SwitchifyPc.Tests/CommandAuthTests.cs

@@ -122,6 +122,24 @@ public async Task RejectsOversizedPayloadsThroughProtocolValidation()
         Assert.Equal("invalid_payload", result.Reason);
     }
 
+    [Fact]
+    public async Task AcceptsApostropheTextPayloadWithAndroidCompatibleAuthProof()
+    {
+        CommandAuthValidator validator = new(CreateStore(), () => Now);
+
+        AuthValidationResult result = await validator.ValidateAsync(CreateTextCommand("apostrophe-1", "'", "W0OLnbhllDOCd0Gf_00WLpHRvfidYjHeY69nbcmTFYA"));
+
+        Assert.True(result.Ok, result.Reason);
+    }
+
+    [Fact]
+    public void EscapesTextPayloadsLikeAndroidProtocolAuth()
+    {
+        Assert.Equal("W0OLnbhllDOCd0Gf_00WLpHRvfidYjHeY69nbcmTFYA", CommandAuth.CreateCommandAuthProof(CreateTextCommand("apostrophe-1", "'"), Token));
+        Assert.Equal("UfVuw9DJjDofw7UeXBZcIFAu5V2YSkEfJ5p0h8_z2UY", CommandAuth.CreateCommandAuthProof(CreateTextCommand("backslash-1", "\\"), Token));
+        Assert.Equal("syal1vfAvjac7RNhm8S_2fj-Edk5k1KkGeIMc7eBelw", CommandAuth.CreateCommandAuthProof(CreateTextCommand("html-1", "<>&'"), Token));
+    }
+
     [Fact]
     public void MatchesKnownTypeScriptAuthFixtures()
     {
@@ -165,6 +183,20 @@ private static JsonElement CreateMouseMoveCommand(Dictionary<string, object?>? o
         }, overrides);
     }
 
+    private static JsonElement CreateTextCommand(string id, string text, string? authOverride = null)
+    {
+        return CreateSignedCommand(new Dictionary<string, object?>
+        {
+            ["version"] = ProtocolConstants.ProtocolVersion,
+            ["id"] = id,
+            ["deviceId"] = "android-1",
+            ["timestamp"] = Now,
+            ["type"] = "keyboard.typeText",
+            ["payload"] = new Dictionary<string, object?> { ["text"] = text },
+            ["auth"] = authOverride ?? ""
+        }, authOverride is null ? null : new Dictionary<string, object?> { ["auth"] = authOverride });
+    }
+
     private static JsonElement CreateSignedCommand(Dictionary<string, object?> command, Dictionary<string, object?>? overrides)
     {
         if (overrides is not null)