Fixed notifications VAPID

src/web_push.rs

@@ -23,9 +23,30 @@ pub async fn load_config(db: &Database) -> Option<VapidConfig> {
             .map(|setting| setting.value.trim().to_string())
             .filter(|value| !value.is_empty())
     };
-    let public_key = value("vapid_public_key")?;
-    let private_key = value("vapid_private_key")?;
-    let subject = value("vapid_subject").unwrap_or_else(|| "mailto:admin@localhost".to_string());
+    let strip_assignment = |value: String, name: &str| {
+        value
+            .strip_prefix(&format!("{name}="))
+            .unwrap_or(&value)
+            .trim()
+            .to_string()
+    };
+    let public_key = strip_assignment(value("vapid_public_key")?, "WEB_PETTING_VAPID_PUBLIC_KEY");
+    let private_key =
+        strip_assignment(value("vapid_private_key")?, "WEB_PETTING_VAPID_PRIVATE_KEY");
+    let subject = strip_assignment(
+        value("vapid_subject").unwrap_or_else(|| "mailto:admin@localhost".to_string()),
+        "WEB_PETTING_VAPID_SUBJECT",
+    );
+    let public_bytes = URL_SAFE_NO_PAD.decode(&public_key).ok()?;
+    let private_bytes = URL_SAFE_NO_PAD.decode(&private_key).ok()?;
+    if public_bytes.len() != 65 || public_bytes.first() != Some(&4) || private_bytes.len() != 32 {
+        tracing::warn!(
+            public_key_bytes = public_bytes.len(),
+            private_key_bytes = private_bytes.len(),
+            "invalid VAPID configuration in database"
+        );
+        return None;
+    }
     Some(VapidConfig {
         public_key,
         private_key,