@inrupt/solid-client-authn-browser 1.13.0 → 1.13.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inrupt/solid-client-authn-browser",
-  "version": "1.13.0",
+  "version": "1.13.1",
   "license": "MIT",
   "types": "dist/index",
   "browser": "dist/index.js",
@@ -25,8 +25,8 @@
     "cross-fetch": "^3.1.5"
   },
   "dependencies": {
-    "@inrupt/oidc-client-ext": "^1.13.0",
-    "@inrupt/solid-client-authn-core": "^1.13.0",
+    "@inrupt/oidc-client-ext": "^1.13.1",
+    "@inrupt/solid-client-authn-core": "^1.13.1",
     "@types/lodash.clonedeep": "^4.5.6",
     "@types/node": "^18.0.3",
     "@types/uuid": "^8.3.0",
@@ -41,5 +41,5 @@
   "engines": {
     "node": "^14.0.0 || ^16.0.0"
   },
-  "gitHead": "72cd3486efd627d01c8f272a502639075cf16c7c"
+  "gitHead": "db1b8613648e96ef536374640421b318058551a3"
 }

package/src/ClientAuthentication.spec.ts

@@ -228,6 +228,58 @@ describe("ClientAuthentication", () => {
         nonEmptyStorage.get("clientKey", { secure: false })
       ).resolves.toBeUndefined();
     });
+
+    it("throws if the redirect IRI is a malformed URL", async () => {
+      const clientAuthn = getClientAuthentication();
+      await expect(() =>
+        clientAuthn.login(
+          {
+            sessionId: "someUser",
+            tokenType: "DPoP",
+            clientId: "coolApp",
+            redirectUrl: "not a valid URL",
+            oidcIssuer: "https://idp.com",
+          },
+          mockEmitter
+        )
+      ).rejects.toThrow();
+    });
+
+    it("throws if the redirect IRI contains a hash fragment, with a helpful message", async () => {
+      const clientAuthn = getClientAuthentication();
+      await expect(() =>
+        clientAuthn.login(
+          {
+            sessionId: "someUser",
+            tokenType: "DPoP",
+            clientId: "coolApp",
+            redirectUrl: "https://example.org/redirect#some-fragment",
+            oidcIssuer: "https://idp.com",
+          },
+          mockEmitter
+        )
+      ).rejects.toThrow("hash fragment");
+    });
+
+    it("does not normalize the redirect URL if provided by the user", async () => {
+      const clientAuthn = getClientAuthentication();
+      await clientAuthn.login(
+        {
+          sessionId: "mySession",
+          clientId: "coolApp",
+          // Note that the redirect IRI does not include a trailing slash.
+          redirectUrl: "https://example.org",
+          oidcIssuer: "https://idp.com",
+          tokenType: "Bearer",
+        },
+        mockEmitter
+      );
+      expect(defaultMocks.loginHandler.handle).toHaveBeenCalledWith(
+        expect.objectContaining({
+          redirectUrl: "https://example.org",
+        })
+      );
+    });
   });
 
   describe("fetch", () => {

package/src/ClientAuthentication.ts

@@ -34,6 +34,7 @@ import {
   ISessionInternalInfo,
   ILoginOptions,
   EVENTS,
+  isValidRedirectUrl,
 } from "@inrupt/solid-client-authn-core";
 import { removeOidcQueryParam } from "@inrupt/oidc-client-ext";
 import { EventEmitter } from "events";
@@ -72,11 +73,17 @@ export default class ClientAuthentication {
 
     // In the case of the user hitting the 'back' button in their browser, they
     // could return to a previous redirect URL that contains OIDC params that
-    // are now longer valid - so just to be safe, strip relevant params now.
-    const redirectUrl = removeOidcQueryParam(
-      options.redirectUrl ?? window.location.href
-    );
-
+    // are now longer valid. To be safe, strip relevant params now.
+    // If the user is providing a redirect IRI, it should not be modified, so
+    // normalization only applies if we default to the current location (which is
+    // a bad practice and should be discouraged).
+    const redirectUrl =
+      options.redirectUrl ?? removeOidcQueryParam(window.location.href);
+    if (!isValidRedirectUrl(redirectUrl)) {
+      throw new Error(
+        `${redirectUrl} is not a valid redirect URL, it is either a malformed IRI or it includes a hash fragment.`
+      );
+    }
     await this.loginHandler.handle({
       ...options,
       redirectUrl,

package/src/login/oidc/IssuerConfigFetcher.ts

@@ -33,7 +33,6 @@ import {
   IStorageUtility,
   ConfigurationError,
 } from "@inrupt/solid-client-authn-core";
-import { appendToUrlPathname } from "../../util/urlPath";
 
 export const WELL_KNOWN_OPENID_CONFIG = ".well-known/openid-configuration";
 
@@ -160,10 +159,7 @@ export default class IssuerConfigFetcher implements IIssuerConfigFetcher {
   async fetchConfig(issuer: string): Promise<IIssuerConfig> {
     let issuerConfig: IIssuerConfig;
 
-    const openIdConfigUrl = appendToUrlPathname(
-      issuer,
-      WELL_KNOWN_OPENID_CONFIG
-    );
+    const openIdConfigUrl = new URL(WELL_KNOWN_OPENID_CONFIG, issuer).href;
     const issuerConfigRequestBody = await window.fetch(openIdConfigUrl);
     // Check the validity of the fetched config
     try {

package/dist/util/urlPath.d.ts

@@ -1 +0,0 @@
-export declare function appendToUrlPathname(url: string, append: string): string;

package/dist/util/urlPath.js

@@ -1,11 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.appendToUrlPathname = void 0;
-function appendToUrlPathname(url, append) {
-    const parsedUrl = new URL(url);
-    const path = parsedUrl.pathname;
-    parsedUrl.pathname = `${path}${path.endsWith("/") ? "" : "/"}${append.startsWith("/") ? append.substring(1) : append}`;
-    return parsedUrl.toString();
-}
-exports.appendToUrlPathname = appendToUrlPathname;
-//# sourceMappingURL=urlPath.js.map

package/dist/util/urlPath.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"urlPath.js","sourceRoot":"","sources":["../../src/util/urlPath.ts"],"names":[],"mappings":";;;AAgCA,SAAgB,mBAAmB,CAAC,GAAW,EAAE,MAAc;IAC7D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC;IAChC,SAAS,CAAC,QAAQ,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAC1D,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MACjD,EAAE,CAAC;IAEH,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;AAC9B,CAAC;AARD,kDAQC"}

package/src/util/urlPath.spec.ts

@@ -1,55 +0,0 @@
-//
-// Copyright 2022 Inrupt Inc.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"), to deal in
-// the Software without restriction, including without limitation the rights to use,
-// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
-// Software, and to permit persons to whom the Software is furnished to do so,
-// subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in
-// all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
-// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
-// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
-// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-
-import { describe, it, expect } from "@jest/globals";
-import { appendToUrlPathname } from "./urlPath";
-
-describe("urlPath", () => {
-  it("should remove one slash if empty path", () => {
-    expect(appendToUrlPathname("https://ex.com/", "/test")).toBe(
-      "https://ex.com/test"
-    );
-
-    expect(
-      appendToUrlPathname("https://ex.com/", "////only-remove-one-slash")
-    ).toBe("https://ex.com////only-remove-one-slash");
-  });
-
-  it("should remove one slash if non-empty path", () => {
-    expect(appendToUrlPathname("https://ex.com/a/", "/test")).toBe(
-      "https://ex.com/a/test"
-    );
-
-    expect(
-      appendToUrlPathname("https://ex.com/a/", "////only-remove-one-slash")
-    ).toBe("https://ex.com/a////only-remove-one-slash");
-  });
-
-  it("should add a slash before appending slash", () => {
-    expect(appendToUrlPathname("https://ex.com", "test")).toBe(
-      "https://ex.com/test"
-    );
-
-    expect(appendToUrlPathname("https://ex.com/a", "test")).toBe(
-      "https://ex.com/a/test"
-    );
-  });
-});

package/src/util/urlPath.ts

@@ -1,41 +0,0 @@
-//
-// Copyright 2022 Inrupt Inc.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy
-// of this software and associated documentation files (the "Software"), to deal in
-// the Software without restriction, including without limitation the rights to use,
-// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
-// Software, and to permit persons to whom the Software is furnished to do so,
-// subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in
-// all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
-// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
-// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
-// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-
-/**
- * @hidden
- * @packageDocumentation
- */
-
-/**
- * Utility that appends the specified value to end of the specified URL's path.
- *
- * @param url  the URL to whose path we append the specified value
- * @param append  the value to append to the URL's path
- */
-export function appendToUrlPathname(url: string, append: string): string {
-  const parsedUrl = new URL(url);
-  const path = parsedUrl.pathname;
-  parsedUrl.pathname = `${path}${path.endsWith("/") ? "" : "/"}${
-    append.startsWith("/") ? append.substring(1) : append
-  }`;
-
-  return parsedUrl.toString();
-}