Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(643)

Unified Diff: remoting/webapp/third_party_token_fetcher.js

Issue 22611008: Remove third party auth redirect URI domain check. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Deal better with malformed urls Created 7 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: remoting/webapp/third_party_token_fetcher.js
diff --git a/remoting/webapp/third_party_token_fetcher.js b/remoting/webapp/third_party_token_fetcher.js
index a16246cd0109067ea9411bdb557c6b3a53fc30e5..ca14489e2ecbc5ebe00a749abad561169fd6e060 100644
--- a/remoting/webapp/third_party_token_fetcher.js
+++ b/remoting/webapp/third_party_token_fetcher.js
@@ -88,9 +88,9 @@ remoting.ThirdPartyTokenFetcher.prototype.parseRedirectUrl_ =
function(responseUrl) {
var token = '';
var sharedSecret = '';
- if (responseUrl &&
- responseUrl.search(this.redirectUri_ + '#') == 0) {
- var query = responseUrl.substring(this.redirectUri_.length + 1);
+
+ if (responseUrl && responseUrl.search('#') >= 0) {
+ var query = responseUrl.substring(responseUrl.search('#') + 1);
var parts = query.split('&');
/** @type {Object.<string>} */
var queryArgs = {};
@@ -100,8 +100,7 @@ remoting.ThirdPartyTokenFetcher.prototype.parseRedirectUrl_ =
}
// Check that 'state' contains the same XSRF token we sent in the request.
- var xsrfToken = queryArgs['state'];
- if (xsrfToken == this.xsrfToken_ &&
+ if ('state' in queryArgs && queryArgs['state'] == this.xsrfToken_ &&
'code' in queryArgs && 'access_token' in queryArgs) {
// Terminology note:
// In the OAuth code/token exchange semantics, 'code' refers to the value
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698