Protect all uses of JSON.parse against exceptions.

remoting/webapp/oauth2.js

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * @fileoverview
  * OAuth2 class that handles retrieval/storage of an OAuth2 token.
  *
  * Uses a content script to trampoline the OAuth redirect page back into the
  * extension context.  This works around the lack of native support for
@@ skipping 130 matching lines @@
  * @return {{token: string, expiration: number}} The current access token, or
  * an invalid token if not authenticated.
  */
 remoting.OAuth2.prototype.getAccessTokenInternal_ = function() {
   if (!window.localStorage.getItem(this.KEY_ACCESS_TOKEN_)) {
     // Always be able to return structured data.
     this.setAccessToken('', 0);
   }
   var accessToken = window.localStorage.getItem(this.KEY_ACCESS_TOKEN_);
   if (typeof accessToken == 'string') {
-    var result = JSON.parse(accessToken);
-    if ('token' in result && 'expiration' in result) {
+    var result = jsonParseSafe(accessToken);
+    if (result && 'token' in result && 'expiration' in result) {
       return /** @type {{token: string, expiration: number}} */ result;
     }
   }
   console.log('Invalid access token stored.');
   return {'token': '', 'expiration': 0};
 };
 
 /**
  * Returns true if the access token is expired, or otherwise invalid.
  *
@@ skipping 36 matching lines @@
 
 /**
  * Update state based on token response from the OAuth2 /token endpoint.
  *
  * @private
  * @param {XMLHttpRequest} xhr The XHR object for this request.
  * @return {void} Nothing.
  */
 remoting.OAuth2.prototype.processTokenResponse_ = function(xhr) {
   if (xhr.status == 200) {
-    var tokens = JSON.parse(xhr.responseText);
-    if ('refresh_token' in tokens) {
-      this.setRefreshToken(tokens['refresh_token']);
+    var tokens = jsonParseSafe(xhr.responseText);
+    if (tokens) {
+      if ('refresh_token' in tokens) {
+        this.setRefreshToken(tokens['refresh_token']);
+      }
+
+      // Offset by 120 seconds so that we can guarantee that the token
+      // we return will be valid for at least 2 minutes.
+      // If the access token is to be useful, this object must make some
+      // guarantee as to how long the token will be valid for.
+      // The choice of 2 minutes is arbitrary, but that length of time
+      // is part of the contract satisfied by callWithToken().
+      // Offset by a further 30 seconds to account for RTT issues.
+      this.setAccessToken(tokens['access_token'],
+          (tokens['expires_in'] - (120 + 30)) * 1000 + Date.now());
+    } else {
+      console.error('Invalid "token" response from server.');

[Wez, 2012/04/28 00:00:42]

nit: Lose the quotes around token.

[Jamie, 2012/04/28 00:15:41]

Ditto.

     }
-
-    // Offset by 120 seconds so that we can guarantee that the token
-    // we return will be valid for at least 2 minutes.
-    // If the access token is to be useful, this object must make some
-    // guarantee as to how long the token will be valid for.
-    // The choice of 2 minutes is arbitrary, but that length of time
-    // is part of the contract satisfied by callWithToken().
-    // Offset by a further 30 seconds to account for RTT issues.
-    this.setAccessToken(tokens['access_token'],
-        (tokens['expires_in'] - (120 + 30)) * 1000 + Date.now());
   } else {
-    console.log('Failed to get tokens. Status: ' + xhr.status +
-                ' response: ' + xhr.responseText);
+    console.error('Failed to get tokens. Status: ' + xhr.status +
+                  ' response: ' + xhr.responseText);
   }
 };
 
 /**
  * Asynchronously retrieves a new access token from the server.
  *
  * Will throw if !isAuthenticated().
  *
  * @param {function(XMLHttpRequest): void} onDone Callback to invoke on
  *     completion.
@@ skipping 165 matching lines @@
  * @return {?string} The email address, if it has been cached by a previous call
  *     to getEmail, otherwise null.
  */
 remoting.OAuth2.prototype.getCachedEmail = function() {
   var value = window.localStorage.getItem(this.KEY_EMAIL_);
   if (typeof value == 'string') {
     return value;
   }
   return null;
 };