fix: Validate string format of SDK key

pkgs/sdk/server/src/ConfigurationBuilder.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using LaunchDarkly.Logging;
+using LaunchDarkly.Sdk.Helpers;
 using LaunchDarkly.Sdk.Server.Hooks;
 using LaunchDarkly.Sdk.Server.Integrations;
 using LaunchDarkly.Sdk.Server.Interfaces;
@@ -53,9 +54,20 @@
 
         #region Internal constructors
 
+        /// <summary>
+        /// Sets the SDK key only if it passes validation rules.
+        /// </summary>
+        private void SetSdkKeyIfValid(string sdkKey)
+        {
+            if (ValidationUtils.ValidateSdkKeyFormat(sdkKey) == null)
+            {
+                _sdkKey = sdkKey;
+            }
+        }
+
         internal ConfigurationBuilder(string sdkKey)
         {
-            _sdkKey = sdkKey;
+            SetSdkKeyIfValid(sdkKey);
         }
 
         internal ConfigurationBuilder(Configuration copyFrom)
@@ -70,7 +82,8 @@
             _http = copyFrom.Http;
             _logging = copyFrom.Logging;
             _offline = copyFrom.Offline;
-            _sdkKey = copyFrom.SdkKey;
+            // The SDK key from Configuration should already be valid, but we validate just in case
+            SetSdkKeyIfValid(copyFrom.SdkKey);
             _serviceEndpointsBuilder = new ServiceEndpointsBuilder(copyFrom.ServiceEndpoints);
             _startWaitTime = copyFrom.StartWaitTime;
             _applicationInfo = copyFrom.ApplicationInfo;
@@ -317,15 +330,15 @@
 
         /// <summary>
         /// Sets the SDK key for your LaunchDarkly environment.
+        /// They key will not be updated if the provided key contains invalid characters.
         /// </summary>
         /// <param name="sdkKey">the SDK key</param>
         /// <returns>the same builder</returns>
         public ConfigurationBuilder SdkKey(string sdkKey)
         {
-            _sdkKey = sdkKey;
+            SetSdkKeyIfValid(sdkKey);
             return this;
         }
-
         /// <summary>
         /// Sets the SDK's service URIs, using a configuration builder obtained from
         /// <see cref="Components.ServiceEndpoints"/>.

pkgs/sdk/server/src/LdClient.cs

@@ -136,6 +136,12 @@
             _log = logConfig.LogAdapter.Logger(logConfig.BaseLoggerName ?? LogNames.DefaultBase);
             _log.Info("Starting LaunchDarkly client {0}",
                 AssemblyVersions.GetAssemblyVersionStringForType(typeof(LdClient)));
+
+            if (_configuration.SdkKey == null && !_configuration.offline)
+            {
+                _log.Error("The SDK key provided is invalid.");
+            }
+
             _evalLog = _log.SubLogger(LogNames.EvaluationSubLog);
 
             var taskExecutor = new TaskExecutor(this, _log);

pkgs/sdk/server/test/LdClientListenersTest.cs

@@ -62,7 +62,7 @@ public void ClientSendsFlagValueChangeEvents()
             var testData = TestData.DataSource();
             testData.Update(testData.Flag(flagKey).On(false));
 
-            var config = Configuration.Builder("").DataSource(testData)
+            var config = Configuration.Builder("sdk-key").DataSource(testData)
                 .Events(Components.NoEvents).Build();
 
             using (var client = new LdClient(config))
@@ -136,7 +136,7 @@ public void DataSourceStatusProviderSendsStatusUpdates()
             var config = BasicConfig()
                 .DataSource(testData)
                 .Build();
-            
+
             using (var client = new LdClient(config))
             {
                 var statuses = new EventSink<DataSourceStatus>();

pkgs/shared/common/src/Helpers/ValidationUtils.cs

@@ -10,6 +10,33 @@ public static class ValidationUtils
     {
         private static readonly Regex ValidCharsRegex = new Regex("^[-a-zA-Z0-9._]+\\z");
 
+        /// <summary>
+        /// Validates that a string does not contain invalid characters or exceed the max length of 8192 characters.
+        /// </summary>
+        /// <param name="sdkKey">the SDK key to validate.</param>
+        /// <returns>Null if the input is valid, otherwise an error string describing the issue.</returns>
+        public static string ValidateSdkKeyFormat(string sdkKey)
+        {
+
+            // For offline mode, we allow a null or empty SDK key and it is not invalid.
+            if (string.IsNullOrEmpty(sdkKey))
+            {
+                return null;
+            }
+
+            if (sdkKey.Length > 8192)
+            {
+                return "SDK key cannot be longer than 1024 characters.";
+            }
+
+            if (!ValidCharsRegex.IsMatch(sdkKey))
+            {
+                return "SDK key contains invalid characters.";
+            }
+
+            return null;
+        }
+
         /// <summary>
         /// Validates that a string is non-empty, not too longer for our systems, and only contains
         /// alphanumeric characters, hyphens, periods, and underscores.