Skip to content

Commit

Permalink
feat: add redirect query name
Browse files Browse the repository at this point in the history
  • Loading branch information
Larkooo committed Aug 25, 2024
1 parent 2a3e49c commit c655ffb
Showing 1 changed file with 13 additions and 10 deletions.
23 changes: 13 additions & 10 deletions packages/keychain/src/pages/session.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ import base64url from "base64url";
type SessionQueryParams = Record<string, string> & {
callback_uri?: string;
redirect_uri?: string;
redirect_query_name?: string;
};

/**
Expand Down Expand Up @@ -77,12 +78,18 @@ export default function CreateRemoteSession() {

if (queries.redirect_uri) {
router.replace(
`${decodeURIComponent(queries.redirect_uri)}?session=${base64url.encode(
credentialsJson,
)}`,
`${decodeURIComponent(queries.redirect_uri)}?${
queries.redirect_query_name ?? "session"
}=${base64url.encode(credentialsJson)}`,

Check warning

Code scanning / CodeQL

Client-side URL redirect Medium

Untrusted URL redirection depends on a
user-provided value
.

Check failure

Code scanning / CodeQL

Client-side cross-site scripting High

Cross-site scripting vulnerability due to
user-provided value
.
);
}
}, [router, queries.callback_uri, queries.redirect_uri, controller]);
}, [
router,
queries.callback_uri,
queries.redirect_uri,
queries.redirect_query_name,
controller,
]);

// Handler when user clicks the Create button
const onConnect = useCallback(
Expand All @@ -91,12 +98,8 @@ export default function CreateRemoteSession() {
throw new Error("Session not found");
}

if (!queries.callback_uri) {
throw new Error("Callback URI is missing");
}

if (!queries.redirect_uri) {
throw new Error("Redirect URI is missing");
if (!queries.callback_uri && !queries.redirect_uri) {
throw new Error("Expected either callback_uri or redirect_uri");
}

onCallback();
Expand Down

0 comments on commit c655ffb

Please sign in to comment.