@firebase/auth 1.6.1 → 1.6.2-20240312134553

package/dist/tsdoc-metadata.json

@@ -0,0 +1,11 @@
+// This file is read by tools that parse documentation comments conforming to the TSDoc standard.
+// It should be published with your NPM package.  It should not be tracked by Git.
+{
+  "tsdocVersion": "0.12",
+  "toolPackages": [
+    {
+      "packageName": "@microsoft/api-extractor",
+      "packageVersion": "0.1.2"
+    }
+  ]
+}

package/dist/web-extension-cjs/index.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var register = require('./register-c32ea7e9.js');
+var register = require('./register-7b923d98.js');
 var app = require('@firebase/app');
 var util = require('@firebase/util');
 require('tslib');

package/dist/web-extension-cjs/internal.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var register = require('./register-c32ea7e9.js');
+var register = require('./register-7b923d98.js');
 var util = require('@firebase/util');
 require('tslib');
 var app = require('@firebase/app');
@@ -2750,9 +2750,11 @@ function getAuth(app$1 = app.getApp()) {
             browserSessionPersistence
         ]
     });
-    const authTokenSyncUrl = util.getExperimentalSetting('authTokenSyncURL');
-    if (authTokenSyncUrl) {
-        const mintCookie = mintCookieFactory(authTokenSyncUrl);
+    const authTokenSyncPath = util.getExperimentalSetting('authTokenSyncURL');
+    // Don't allow urls (XSS possibility), only paths on the same domain
+    // (starting with a single '/')
+    if (authTokenSyncPath && authTokenSyncPath.match(/^\/[^\/].*/)) {
+        const mintCookie = mintCookieFactory(authTokenSyncPath);
         register.beforeAuthStateChanged(auth, mintCookie, () => mintCookie(auth.currentUser));
         register.onIdTokenChanged(auth, user => mintCookie(user));
     }