Skip to content

fix: [SDK-5330] reject null, empty, and NUL identity strings - #210

Closed
abdulraqeeb33 wants to merge 1 commit into
mainfrom
ar/sdk-5330
Closed

abdulraqeeb33 wants to merge 1 commit into
mainfrom
ar/sdk-5330

Conversation

@abdulraqeeb33

Copy link
Copy Markdown

Summary

Reject null, empty, and NUL identity strings before they are queued for the page SDK. Part of SDK-5327.

isMissing logs and returns. Whitespace is still allowed. An empty tag value is allowed, including one that contains a null byte. setLanguage("") is still the reset. A null byte in the language code is rejected.

The page SDK rejects the same values. This guard runs first so an older CDN script never receives them.

Test plan

  • vp test (5 tests passed), including empty and NUL login, a kept whitespace login, an empty tag value, a NUL tag key, and setLanguage("")
  • Not run in a browser. The guard returns before OneSignalDeferred.push

https://linear.app/onesignal/issue/SDK-5330

Made with Cursor

A blank or NUL external id was queued for the page SDK. Reject it before the deferred call, matching the other client SDKs.

Co-authored-by: Cursor <cursoragent@cursor.com>
@abdulraqeeb33
abdulraqeeb33 requested a review from a team October 7, 2026 17:28

@sherwinski sherwinski left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@abdulraqeeb33 You will need to make these updates to https://github.com/OneSignal/web-shim-codegen before they get generated in the downstream wrappers

@abdulraqeeb33

Copy link
Copy Markdown
Author

Moved the guard into the generator: OneSignal/web-shim-codegen#144

Closing this. Vue, Vue 3, and Angular will be generated from that.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants