Throw helpful error if `privateKey` is set to only the first line, e.g. `-----BEGIN RSA PRIVATE KEY-----`

[gr2m]

Follow up to octokit/auth-app.js#465 (comment), reported by @reza-ebrahimi

The first line might be -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY-----, maybe we will support other variations in future. But they all have the format -----BEGIN * KEY-----

I would suggest we add a check like

if (/-----BEGIN * KEY-----/.test(privateKey?.trim()) {
  throw new Error("privateKey only contains the first line. Try replacing line breaks with \n")
}

[gr2m]

maybe we will support other variations in future

in particular I would love to see if we can support -----BEGIN OPENSSH PRIVATE KEY-----, which is the format that 1Password stores ssh keys in its latest version

[reza-ebrahimi]

Is there any schema or standard for private key content? Or probably an open source schema validator javascript / typescript library?

[reza-ebrahimi]

Not sure if directly related to PK validation, but I found these:

• The 'jsrsasign' (RSA-Sign JavaScript Library) is an opensource free cryptography library supporting RSA/RSAPSS/ECDSA/DSA signing/validation, ASN.1, PKCS#1/5/8 private/public key, X.509 certificate, CRL, OCSP, CMS SignedData, TimeStamp, CAdES and JSON Web Signature/Token in pure JavaScript.
• RSASSA-PSS signature validation failure
• CSR validation fail with own private key
• How to validate PGP public key written by a user?

[reza-ebrahimi]

A simpler approach with regex. The expression below will match strings (Regex test link):

^-----BEGIN.*PRIVATE KEY-----$

• starts with -----BEGIN
• end with PRIVATE KEY-----

[gr2m]

yeah good idea with the regex. I'd just add two spaces around .*

if (/^-----BEGIN .* PRIVATE KEY-----$/.test(privateKey.trim()) {
  throw new Error("privateKey only contains the first line. Try replacing line breaks with \n")
}

[gr2m]

Is there any schema or standard for private key content

We don't need a sophisticated private key validation library. This is about the very specific and common problem that only the first line is passed as the privateKey value

[reza-ebrahimi]

Created a PR: octokit/auth-app.js#482