Protect all uses of JSON.parse against exceptions.

remoting/webapp/oauth2.js

Index: remoting/webapp/oauth2.js
diff --git a/remoting/webapp/oauth2.js b/remoting/webapp/oauth2.js
index 5d61c4a71904e277a7fccbf0daa93603b9701992..2223d0a35d8520a2357627faab23276f744990e3 100644
--- a/remoting/webapp/oauth2.js
+++ b/remoting/webapp/oauth2.js
@@ -148,8 +148,8 @@ remoting.OAuth2.prototype.getAccessTokenInternal_ = function() {
   }
   var accessToken = window.localStorage.getItem(this.KEY_ACCESS_TOKEN_);
   if (typeof accessToken == 'string') {
-    var result = JSON.parse(accessToken);
-    if ('token' in result && 'expiration' in result) {
+    var result = jsonParseSafe(accessToken);
+    if (result && 'token' in result && 'expiration' in result) {
       return /** @type {{token: string, expiration: number}} */ result;
     }
   }
@@ -206,23 +206,27 @@ remoting.OAuth2.prototype.clearAccessToken = function() {
  */
 remoting.OAuth2.prototype.processTokenResponse_ = function(xhr) {
   if (xhr.status == 200) {
-    var tokens = JSON.parse(xhr.responseText);
-    if ('refresh_token' in tokens) {
-      this.setRefreshToken(tokens['refresh_token']);
-    }
+    var tokens = jsonParseSafe(xhr.responseText);
+    if (tokens) {
+      if ('refresh_token' in tokens) {
+        this.setRefreshToken(tokens['refresh_token']);
+      }
 
-    // Offset by 120 seconds so that we can guarantee that the token
-    // we return will be valid for at least 2 minutes.
-    // If the access token is to be useful, this object must make some
-    // guarantee as to how long the token will be valid for.
-    // The choice of 2 minutes is arbitrary, but that length of time
-    // is part of the contract satisfied by callWithToken().
-    // Offset by a further 30 seconds to account for RTT issues.
-    this.setAccessToken(tokens['access_token'],
-        (tokens['expires_in'] - (120 + 30)) * 1000 + Date.now());
+      // Offset by 120 seconds so that we can guarantee that the token
+      // we return will be valid for at least 2 minutes.
+      // If the access token is to be useful, this object must make some
+      // guarantee as to how long the token will be valid for.
+      // The choice of 2 minutes is arbitrary, but that length of time
+      // is part of the contract satisfied by callWithToken().
+      // Offset by a further 30 seconds to account for RTT issues.
+      this.setAccessToken(tokens['access_token'],
+          (tokens['expires_in'] - (120 + 30)) * 1000 + Date.now());
+    } else {
+      console.error('Invalid "token" response from server.');

[Wez, 2012/04/28 00:00:42]

nit: Lose the quotes around token.

[Jamie, 2012/04/28 00:15:41]

Ditto.

+    }
   } else {
-    console.log('Failed to get tokens. Status: ' + xhr.status +
-                ' response: ' + xhr.responseText);
+    console.error('Failed to get tokens. Status: ' + xhr.status +
+                  ' response: ' + xhr.responseText);
   }
 };