fleet

Files

T

Carloandjkatz01 3517ff661e iOS/iPadOS managed config: validator (#43963 ) (#44930 )

Part of #38790 (iOS / iPadOS managed app configuration).

Closes #43963.

Adds `ValidateAppleAppConfiguration` and the
`FleetVarsSupportedInAppleAppConfig` allow-list in
`server/fleet/vpp.go`. Walks the decoded plist (keys + string values) so
XML-entity-encoded `$FLEET_VAR_*` tokens can't slip past the disallow
check, and rejects non-XML plist formats (binary, OpenStep, GNUStep)
since Apple's `InstallApplication` only accepts XML.

Stacked PRs (review bottom up):
- #43963 validator (this PR)
- 43964 datastore
- 43965 service wiring
- 43969 gitops
- 43966 InstallApplication Configuration dict injection
- 43967 Fleet variable expansion
- 43968 send-paths audit

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added validation for Apple managed app configurations to allow only
supported Fleet variable placeholders, reject malformed plist formats,
and accept empty payloads.

* **Bug Fixes**
* Improved handling of app configuration payloads to ensure consistent
validation and error responses across Android and iOS flows.

* **Tests**
* Added comprehensive tests covering plist validation,
allowed/disallowed variables, and edge cases to increase reliability.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44930)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: jkatz01 <yehonatankatz@gmail.com>

2026-05-12 13:23:31 -04:00

acl

…

activity

Make activity list end-date filter consistent (#38437 )

2026-05-08 15:29:59 -04:00

api_endpoints

…

archtest

…

authz

Allow GitOps user to list software (#44721 )