@dynamic-labs/sdk-react-core 0.19.0-alpha.23 → 0.19.0-alpha.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/CHANGELOG.md +7 -0
  2. package/package.cjs +1 -1
  3. package/package.js +1 -1
  4. package/package.json +8 -8
  5. package/src/lib/utils/hooks/useSocialAuth/useSocialAuth.cjs +7 -1
  6. package/src/lib/utils/hooks/useSocialAuth/useSocialAuth.js +7 -1
package/CHANGELOG.md CHANGED
@@ -1,4 +1,11 @@
1
1
 
2
+ ## [0.19.0-alpha.24](https://github.com/dynamic-labs/DynamicAuth/compare/v0.19.0-alpha.23...v0.19.0-alpha.24) (2023-10-24)
3
+
4
+
5
+ ### Bug Fixes
6
+
7
+ * check state from message receiver is same as generated oauth state ([#3675](https://github.com/dynamic-labs/DynamicAuth/issues/3675)) ([2407b6c](https://github.com/dynamic-labs/DynamicAuth/commit/2407b6cff09985bbd5b044e44ab600540a4c69cb))
8
+
2
9
  ## [0.19.0-alpha.23](https://github.com/dynamic-labs/DynamicAuth/compare/v0.19.0-alpha.22...v0.19.0-alpha.23) (2023-10-24)
3
10
 
4
11
 
package/package.cjs CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  Object.defineProperty(exports, '__esModule', { value: true });
4
4
 
5
- var version = "0.19.0-alpha.23";
5
+ var version = "0.19.0-alpha.24";
6
6
  var dependencies = {
7
7
  "@dynamic-labs/iconic": "0.1.34",
8
8
  "@dynamic-labs/sdk-api": "0.0.291",
package/package.js CHANGED
@@ -1,4 +1,4 @@
1
- var version = "0.19.0-alpha.23";
1
+ var version = "0.19.0-alpha.24";
2
2
  var dependencies = {
3
3
  "@dynamic-labs/iconic": "0.1.34",
4
4
  "@dynamic-labs/sdk-api": "0.0.291",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@dynamic-labs/sdk-react-core",
3
- "version": "0.19.0-alpha.23",
3
+ "version": "0.19.0-alpha.24",
4
4
  "repository": {
5
5
  "type": "git",
6
6
  "url": "https://github.com/dynamic-labs/DynamicAuth.git",
@@ -17,13 +17,13 @@
17
17
  "react-focus-lock": "2.9.2",
18
18
  "react-i18next": "^13.2.0",
19
19
  "yup": "0.32.11",
20
- "@dynamic-labs/logger": "0.19.0-alpha.23",
21
- "@dynamic-labs/multi-wallet": "0.19.0-alpha.23",
22
- "@dynamic-labs/rpc-providers": "0.19.0-alpha.23",
23
- "@dynamic-labs/types": "0.19.0-alpha.23",
24
- "@dynamic-labs/utils": "0.19.0-alpha.23",
25
- "@dynamic-labs/wallet-book": "0.19.0-alpha.23",
26
- "@dynamic-labs/wallet-connector-core": "0.19.0-alpha.23",
20
+ "@dynamic-labs/logger": "0.19.0-alpha.24",
21
+ "@dynamic-labs/multi-wallet": "0.19.0-alpha.24",
22
+ "@dynamic-labs/rpc-providers": "0.19.0-alpha.24",
23
+ "@dynamic-labs/types": "0.19.0-alpha.24",
24
+ "@dynamic-labs/utils": "0.19.0-alpha.24",
25
+ "@dynamic-labs/wallet-book": "0.19.0-alpha.24",
26
+ "@dynamic-labs/wallet-connector-core": "0.19.0-alpha.24",
27
27
  "eventemitter3": "5.0.1"
28
28
  },
29
29
  "devDependencies": {
package/src/lib/utils/hooks/useSocialAuth/useSocialAuth.cjs CHANGED
@@ -221,11 +221,17 @@ const useSocialAuth = ({ sessionTimeout, authMode, onSettled, onError, }) => {
221
221
  return;
222
222
  }
223
223
  clearListeners();
224
- const { code, error } = message;
224
+ const { code, error, state: authState } = message;
225
225
  if (error && error !== 'undefined') {
226
226
  handleError(types.SocialOAuthErrorCode.OAUTH_ERROR, `Failed to connect ${provider} social account: ${error}`);
227
227
  return;
228
228
  }
229
+ // check that the state we receive from message is the same state we calculated earlier
230
+ // this could be an attack
231
+ if (state !== authState) {
232
+ handleError(types.SocialOAuthErrorCode.OAUTH_ERROR, `Failed to connect ${provider} social account: Invalid random state`);
233
+ return;
234
+ }
229
235
  if (!code) {
230
236
  handleError(types.SocialOAuthErrorCode.NO_AUTH_CODE, `Failed to connect ${provider} social account: no authorization code`);
231
237
  return;
package/src/lib/utils/hooks/useSocialAuth/useSocialAuth.js CHANGED
@@ -217,11 +217,17 @@ const useSocialAuth = ({ sessionTimeout, authMode, onSettled, onError, }) => {
217
217
  return;
218
218
  }
219
219
  clearListeners();
220
- const { code, error } = message;
220
+ const { code, error, state: authState } = message;
221
221
  if (error && error !== 'undefined') {
222
222
  handleError(SocialOAuthErrorCode.OAUTH_ERROR, `Failed to connect ${provider} social account: ${error}`);
223
223
  return;
224
224
  }
225
+ // check that the state we receive from message is the same state we calculated earlier
226
+ // this could be an attack
227
+ if (state !== authState) {
228
+ handleError(SocialOAuthErrorCode.OAUTH_ERROR, `Failed to connect ${provider} social account: Invalid random state`);
229
+ return;
230
+ }
225
231
  if (!code) {
226
232
  handleError(SocialOAuthErrorCode.NO_AUTH_CODE, `Failed to connect ${provider} social account: no authorization code`);
227
233
  return;