🛡️ Sentinel: Fix insecure postMessage wildcard in OAuth2 redirects#10
🛡️ Sentinel: Fix insecure postMessage wildcard in OAuth2 redirects#10AGI-Corporation wants to merge 4 commits intomainfrom
Conversation
- Replace wildcard '*' with specific target origins in window.postMessage calls. - Implement strict origin verification in the frontend OAuth2 message listener. - Use JSON.stringify for safe payload serialization in the server-side redirect response. - Fix typo in redirect success message. Co-authored-by: AGI-Corporation <186229839+AGI-Corporation@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
📝 WalkthroughWalkthroughThe changes enhance OAuth2 cross-origin messaging security by replacing wildcard and partial-origin checks with exact origin matching across client and server components. This includes updated postMessage calls and stricter origin validation when receiving OAuth2 code messages. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
- Replace wildcard '*' with specific target origins in window.postMessage calls. - Implement strict origin verification in the frontend OAuth2 message listener. - Use JSON.stringify for safe payload serialization in the server-side redirect response. - Fix typo in redirect success message. Co-authored-by: AGI-Corporation <186229839+AGI-Corporation@users.noreply.github.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/react-ui/src/lib/oauth2-utils.ts`:
- Around line 76-81: In the message event handler (the function named handler
passed to window.addEventListener in oauth2-utils.ts) tighten the condition to
ensure the message comes from the specific popup by adding an event.source ===
currentPopup check, and replace the unsafe event.data['code'] access with a
defensive check like typeof event.data === 'object' && event.data !== null &&
'code' in event.data; keep the existing redirectUrl and expectedOrigin checks so
the full gating becomes redirectUrl && event.source === currentPopup &&
event.origin === expectedOrigin && typeof event.data === 'object' && event.data
!== null && 'code' in event.data before resolving/consuming the code and
removing the listener.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 46d1cd8a-085d-4944-b6d9-71c9f81bfe78
📒 Files selected for processing (4)
.jules/sentinel.mdpackages/react-ui/src/app/routes/redirect.tsxpackages/react-ui/src/lib/oauth2-utils.tspackages/server/api/src/app/app.ts
| window.addEventListener('message', function handler(event) { | ||
| const expectedOrigin = new URL(redirectUrl).origin; | ||
| if ( | ||
| redirectUrl && | ||
| redirectUrl.startsWith(event.origin) && | ||
| event.origin === expectedOrigin && | ||
| event.data['code'] |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n packages/react-ui/src/lib/oauth2-utils.tsRepository: AGI-Corporation/Route.X
Length of output: 3309
Add event.source === currentPopup check to bind the message to the correct popup window.
The current code accepts messages from any same-origin window. If multiple OAuth2 flows execute in sequence, a stale popup from the previous flow—or another tab on the same domain—could satisfy the origin check and resolve the promise with an unrelated authorization code. The listener should verify that the message originates from the popup window opened for this specific flow.
Additionally, add defensive property checks for event.data['code'] to avoid unsafe access (replace with typeof event.data === 'object' && event.data !== null && 'code' in event.data).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/react-ui/src/lib/oauth2-utils.ts` around lines 76 - 81, In the
message event handler (the function named handler passed to
window.addEventListener in oauth2-utils.ts) tighten the condition to ensure the
message comes from the specific popup by adding an event.source === currentPopup
check, and replace the unsafe event.data['code'] access with a defensive check
like typeof event.data === 'object' && event.data !== null && 'code' in
event.data; keep the existing redirectUrl and expectedOrigin checks so the full
gating becomes redirectUrl && event.source === currentPopup && event.origin ===
expectedOrigin && typeof event.data === 'object' && event.data !== null &&
'code' in event.data before resolving/consuming the code and removing the
listener.
- Replace wildcard '*' with specific target origins in window.postMessage calls. - Implement strict origin verification in the frontend OAuth2 message listener. - Use JSON.stringify for safe payload serialization in the server-side redirect response. - Fix typo in redirect success message. Co-authored-by: AGI-Corporation <186229839+AGI-Corporation@users.noreply.github.com>
- Replace wildcard '*' with specific target origins in window.postMessage calls. - Implement strict origin verification in the frontend OAuth2 message listener. - Use JSON.stringify for safe payload serialization in the server-side redirect response. - Fix typo in redirect success message. Co-authored-by: AGI-Corporation <186229839+AGI-Corporation@users.noreply.github.com>
1 participant
🚨 Severity: HIGH
💡 Vulnerability: Use of wildcard ('*') as target origin in window.postMessage during OAuth2 redirects.
🎯 Impact: Sensitive OAuth2 authorization codes could be leaked to malicious origins if a user is tricked into opening the redirect page from an untrusted site.
🔧 Fix:
✅ Verification:
PR created automatically by Jules for task 13943745947564606606 started by @AGI-Corporation
Summary by CodeRabbit