@smg-automotive/auth 6.7.1 → 6.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -19,25 +19,35 @@ var getOtherDomainHost = function (currentHost) {
19
19
  }
20
20
  return currentHost;
21
21
  };
22
- var isSafePath = function (path) {
23
- if (typeof path !== 'string')
22
+ var validateReturnTo = function (_a) {
23
+ var pathOrUrl = _a.pathOrUrl, host = _a.host, protocol = _a.protocol, otherDomainHost = _a.otherDomainHost, crossDomainLogout = _a.crossDomainLogout;
24
+ if (typeof pathOrUrl !== 'string')
24
25
  return false;
25
- if (path.length > 2048)
26
+ if (pathOrUrl.length > 2048)
26
27
  return false;
27
- if (!path.startsWith('/') || path.startsWith('//'))
28
- return false;
29
- // Limit chars in return to path to prevent injections
30
- // eslint-disable-next-line @typescript-eslint/naming-convention
31
- var SAFE_PATH_REGEX = /^\/[a-zA-Z0-9/_\-?.=]*$/;
32
28
  try {
33
- var decodedPath = decodeURIComponent(path);
34
- // Re-check after decode to block protocol-relative via %2F trick
29
+ var decodedPathOrUrl = decodeURIComponent(pathOrUrl);
30
+ var parsedUrlOrPath = new URL(decodedPathOrUrl.startsWith('http')
31
+ ? decodedPathOrUrl
32
+ : "".concat(protocol, "://").concat(host).concat(decodedPathOrUrl));
33
+ var decodedPath = parsedUrlOrPath.pathname;
34
+ if (crossDomainLogout && parsedUrlOrPath.host !== otherDomainHost) {
35
+ return false;
36
+ }
37
+ if (!crossDomainLogout && parsedUrlOrPath.host !== host) {
38
+ return false;
39
+ }
35
40
  if (!decodedPath.startsWith('/') || decodedPath.startsWith('//')) {
36
41
  return false;
37
42
  }
43
+ // Limit chars in return to path to prevent injections
44
+ // eslint-disable-next-line @typescript-eslint/naming-convention
45
+ var SAFE_PATH_REGEX = /^\/[a-zA-Z0-9/_\-?.=]*$/;
38
46
  return SAFE_PATH_REGEX.test(decodedPath);
39
47
  }
40
- catch (_a) {
48
+ catch (error) {
49
+ // eslint-disable-next-line no-console
50
+ console.warn('Error parsing URL or path:', error);
41
51
  return false;
42
52
  }
43
53
  };
@@ -69,12 +79,14 @@ var createLogoutHandler = function (_a) {
69
79
  }
70
80
  var returnTo = "/".concat(req.query.locale || languageConfig.default);
71
81
  var otherDomainHost = getOtherDomainHost(host);
72
- var otherDomainBaseUrl = "".concat(protocol, "://").concat(otherDomainHost);
73
- var isSafeRegularReturnTo = !!specifiedReturnTo && isSafePath(specifiedReturnTo);
74
- var isSafeCrossDomainReturnTo = crossDomainLogout &&
75
- specifiedReturnTo.startsWith(otherDomainBaseUrl) &&
76
- isSafePath(specifiedReturnTo.slice(otherDomainBaseUrl.length));
77
- if (isSafeRegularReturnTo || isSafeCrossDomainReturnTo) {
82
+ var isSafePath = validateReturnTo({
83
+ protocol: protocol,
84
+ host: host,
85
+ otherDomainHost: otherDomainHost,
86
+ pathOrUrl: specifiedReturnTo,
87
+ crossDomainLogout: crossDomainLogout,
88
+ });
89
+ if (isSafePath) {
78
90
  returnTo = specifiedReturnTo;
79
91
  }
80
92
  if (!crossDomainLogout && otherDomainHost && otherDomainHost !== host) {
@@ -1 +1 @@
1
- {"version":3,"file":"logout.js","sources":["../../../../../../src/apiRoutes/handlers/creators/logout.ts"],"sourcesContent":[null],"names":["getAuth0Config","getAuth0Instance"],"mappings":";;;;;AAQA,IAAM,qBAAqB,GAAG,UAAC,QAAgB,EAAA;IAC7C,IAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;AACjC,IAAA,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAA,CAAA,MAAA,CAAI,QAAQ,CAAE;AAE3C,IAAA,IAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IACtC,OAAO,GAAA,CAAA,MAAA,CAAI,IAAI,CAAE;AACnB,CAAC;AAED,IAAM,kBAAkB,GAAG,UAAC,WAAmB,EAAA;AAC7C,IAAA,IAAI,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvC,OAAO,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC;IAC1D;AACA,IAAA,IAAI,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvC,OAAO,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC;IAC1D;AACA,IAAA,OAAO,WAAW;AACpB,CAAC;AACD,IAAM,UAAU,GAAG,UAAC,IAAa,EAAA;IAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ;AAAE,QAAA,OAAO,KAAK;AAC1C,IAAA,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;AAAE,QAAA,OAAO,KAAK;AACpC,IAAA,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;AAAE,QAAA,OAAO,KAAK;;;IAIhE,IAAM,eAAe,GAAG,yBAAyB;AACjD,IAAA,IAAI;AACF,QAAA,IAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC;;AAE5C,QAAA,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;AAChE,YAAA,OAAO,KAAK;QACd;AAEA,QAAA,OAAO,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1C;AAAE,IAAA,OAAA,EAAA,EAAM;AACN,QAAA,OAAO,KAAK;IACd;AACF,CAAC;AAEM,IAAM,mBAAmB,GAC9B,UAAC,EAA6B,EAAA;AAA3B,IAAA,IAAA,SAAS,eAAA,EAAE,IAAI,GAAA,EAAA,CAAA,IAAA,EAAE,QAAQ,GAAA,EAAA,CAAA,QAAA;IAC5B,OAAA,UAAC,GAAmB,EAAE,GAAoB,EAAA;QAClC,IAAA,EAAA,GAMFA,oBAAc,CAAC,EAAE,SAAS,EAAA,SAAA,EAAE,CAAC,EAL/B,cAAc,GAAA,EAAA,CAAA,cAAA,EACd,eAAe,GAAA,EAAA,CAAA,eAAA,EACf,qBAAqB,GAAA,EAAA,CAAA,qBAAA,EACrB,sBAAsB,GAAA,EAAA,CAAA,sBAAA,EACtB,cAAc,GAAA,EAAA,CAAA,cACiB;AACzB,QAAA,IAAA,YAAY,GAAKC,iCAAgB,CAAC,EAAE,IAAI,EAAA,IAAA,EAAE,QAAQ,EAAA,QAAA,EAAE,SAAS,EAAA,SAAA,EAAE,CAAC,aAApD;AACpB,QAAA,IAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,QAAkB;QACtD,IAAM,eAAe,GAAa,EAAE;QACpC,IAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;QACnD,IAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM;AAE1D,QAAA,eAAe,CAAC,OAAO,CAAC,UAAC,UAAU,EAAA;AACjC,YAAA,eAAe,CAAC,IAAI,CAAC,UAAG,UAAU,EAAA,sBAAA,CAAsB,CAAC;AACzD,YAAA,eAAe,CAAC,IAAI,CAAC,UAAG,UAAU,EAAA,wBAAA,CAAwB,CAAC;AAC7D,QAAA,CAAC,CAAC;AAEF,QAAA,IAAM,kBAAkB,GAAG,qBAAqB,CAAC,IAAI,CAAC;AACtD,QAAA,IAAM,iBAAiB,GAAG,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;AACzE,QAAA,IAAM,0BAA0B,GAAG,kBAAkB,CAAC,MAAM,CAC1D,UAAC,iBAAiB,EAAA;AAChB,YAAA,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAC,UAAU,EAAA;AACvC,gBAAA,OAAO,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC;AACjD,YAAA,CAAC,CAAC;AACJ,QAAA,CAAC,CACF;AACD,QAAA,0BAA0B,CAAC,OAAO,CAAC,UAAC,UAAU,EAAA;YAC5C,eAAe,CAAC,IAAI,CAClB,EAAA,CAAA,MAAA,CAAG,UAAU,EAAA,+BAAA,CAAA,CAAA,MAAA,CAAgC,kBAAkB,EAAA,GAAA,CAAG,CACnE;AACH,QAAA,CAAC,CAAC;AAEF,QAAA,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE;AAC9B,YAAA,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,eAAe,CAAC;QAC9C;AAEA,QAAA,IAAI,QAAQ,GAAG,GAAA,CAAA,MAAA,CAAK,GAAG,CAAC,KAAK,CAAC,MAAmB,IAAI,cAAc,CAAC,OAAO,CAAE;AAC7E,QAAA,IAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC;AAChD,QAAA,IAAM,kBAAkB,GAAG,EAAA,CAAA,MAAA,CAAG,QAAQ,EAAA,KAAA,CAAA,CAAA,MAAA,CAAM,eAAe,CAAE;QAC7D,IAAM,qBAAqB,GACzB,CAAC,CAAC,iBAAiB,IAAI,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAM,yBAAyB,GAC7B,iBAAiB;AACjB,YAAA,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,CAAC;YAChD,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAChE,QAAA,IAAI,qBAAqB,IAAI,yBAAyB,EAAE;YACtD,QAAQ,GAAG,iBAAiB;QAC9B;QAEA,IAAI,CAAC,iBAAiB,IAAI,eAAe,IAAI,eAAe,KAAK,IAAI,EAAE;AACrE,YAAA,IAAM,gBAAgB,GAAG,EAAA,CAAA,MAAA,CAAG,QAAQ,EAAA,KAAA,CAAA,CAAA,MAAA,CAAM,IAAI,CAAE;YAChD,IAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC;YACxE,sBAAsB,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC;YAC7D,sBAAsB,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC;AAE9D,YAAA,IAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,cAAc,EACd,EAAA,CAAA,MAAA,CAAG,QAAQ,EAAA,KAAA,CAAA,CAAA,MAAA,CAAM,eAAe,CAAE,CACnC;YACD,oBAAoB,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC;AAC5D,YAAA,oBAAoB,CAAC,YAAY,CAAC,GAAG,CACnC,UAAU,EACV,sBAAsB,CAAC,QAAQ,EAAE,CAClC;YAED,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC;YAClD;QACF;AAEA,QAAA,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;AAC5B,YAAA,QAAQ,EAAA,QAAA;AACT,SAAA,CAAC;IACJ,CAAC;AA1ED;;;;"}
1
+ {"version":3,"file":"logout.js","sources":["../../../../../../src/apiRoutes/handlers/creators/logout.ts"],"sourcesContent":[null],"names":["getAuth0Config","getAuth0Instance"],"mappings":";;;;;AAQA,IAAM,qBAAqB,GAAG,UAAC,QAAgB,EAAA;IAC7C,IAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;AACjC,IAAA,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAA,CAAA,MAAA,CAAI,QAAQ,CAAE;AAE3C,IAAA,IAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IACtC,OAAO,GAAA,CAAA,MAAA,CAAI,IAAI,CAAE;AACnB,CAAC;AAED,IAAM,kBAAkB,GAAG,UAAC,WAAmB,EAAA;AAC7C,IAAA,IAAI,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvC,OAAO,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC;IAC1D;AACA,IAAA,IAAI,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvC,OAAO,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC;IAC1D;AACA,IAAA,OAAO,WAAW;AACpB,CAAC;AACD,IAAM,gBAAgB,GAAG,UAAC,EAYzB,EAAA;AAXC,IAAA,IAAA,SAAS,GAAA,EAAA,CAAA,SAAA,EACT,IAAI,GAAA,EAAA,CAAA,IAAA,EACJ,QAAQ,GAAA,EAAA,CAAA,QAAA,EACR,eAAe,GAAA,EAAA,CAAA,eAAA,EACf,iBAAiB,GAAA,EAAA,CAAA,iBAAA;IAQjB,IAAI,OAAO,SAAS,KAAK,QAAQ;AAAE,QAAA,OAAO,KAAK;AAC/C,IAAA,IAAI,SAAS,CAAC,MAAM,GAAG,IAAI;AAAE,QAAA,OAAO,KAAK;AAEzC,IAAA,IAAI;AACF,QAAA,IAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,CAAC;QACtD,IAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,gBAAgB,CAAC,UAAU,CAAC,MAAM;AAChC,cAAE;cACA,UAAG,QAAQ,EAAA,KAAA,CAAA,CAAA,MAAA,CAAM,IAAI,CAAA,CAAA,MAAA,CAAG,gBAAgB,CAAE,CAC/C;AACD,QAAA,IAAM,WAAW,GAAG,eAAe,CAAC,QAAQ;QAE5C,IAAI,iBAAiB,IAAI,eAAe,CAAC,IAAI,KAAK,eAAe,EAAE;AACjE,YAAA,OAAO,KAAK;QACd;QAEA,IAAI,CAAC,iBAAiB,IAAI,eAAe,CAAC,IAAI,KAAK,IAAI,EAAE;AACvD,YAAA,OAAO,KAAK;QACd;AAEA,QAAA,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;AAChE,YAAA,OAAO,KAAK;QACd;;;QAIA,IAAM,eAAe,GAAG,yBAAyB;AACjD,QAAA,OAAO,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1C;IAAE,OAAO,KAAK,EAAE;;AAEd,QAAA,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,CAAC;AACjD,QAAA,OAAO,KAAK;IACd;AACF,CAAC;AAEM,IAAM,mBAAmB,GAC9B,UAAC,EAA6B,EAAA;AAA3B,IAAA,IAAA,SAAS,eAAA,EAAE,IAAI,GAAA,EAAA,CAAA,IAAA,EAAE,QAAQ,GAAA,EAAA,CAAA,QAAA;IAC5B,OAAA,UAAC,GAAmB,EAAE,GAAoB,EAAA;QAClC,IAAA,EAAA,GAMFA,oBAAc,CAAC,EAAE,SAAS,EAAA,SAAA,EAAE,CAAC,EAL/B,cAAc,GAAA,EAAA,CAAA,cAAA,EACd,eAAe,GAAA,EAAA,CAAA,eAAA,EACf,qBAAqB,GAAA,EAAA,CAAA,qBAAA,EACrB,sBAAsB,GAAA,EAAA,CAAA,sBAAA,EACtB,cAAc,GAAA,EAAA,CAAA,cACiB;AACzB,QAAA,IAAA,YAAY,GAAKC,iCAAgB,CAAC,EAAE,IAAI,EAAA,IAAA,EAAE,QAAQ,EAAA,QAAA,EAAE,SAAS,EAAA,SAAA,EAAE,CAAC,aAApD;AACpB,QAAA,IAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,QAAkB;QACtD,IAAM,eAAe,GAAa,EAAE;QACpC,IAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;QACnD,IAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM;AAE1D,QAAA,eAAe,CAAC,OAAO,CAAC,UAAC,UAAU,EAAA;AACjC,YAAA,eAAe,CAAC,IAAI,CAAC,UAAG,UAAU,EAAA,sBAAA,CAAsB,CAAC;AACzD,YAAA,eAAe,CAAC,IAAI,CAAC,UAAG,UAAU,EAAA,wBAAA,CAAwB,CAAC;AAC7D,QAAA,CAAC,CAAC;AAEF,QAAA,IAAM,kBAAkB,GAAG,qBAAqB,CAAC,IAAI,CAAC;AACtD,QAAA,IAAM,iBAAiB,GAAG,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;AACzE,QAAA,IAAM,0BAA0B,GAAG,kBAAkB,CAAC,MAAM,CAC1D,UAAC,iBAAiB,EAAA;AAChB,YAAA,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAC,UAAU,EAAA;AACvC,gBAAA,OAAO,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC;AACjD,YAAA,CAAC,CAAC;AACJ,QAAA,CAAC,CACF;AACD,QAAA,0BAA0B,CAAC,OAAO,CAAC,UAAC,UAAU,EAAA;YAC5C,eAAe,CAAC,IAAI,CAClB,EAAA,CAAA,MAAA,CAAG,UAAU,EAAA,+BAAA,CAAA,CAAA,MAAA,CAAgC,kBAAkB,EAAA,GAAA,CAAG,CACnE;AACH,QAAA,CAAC,CAAC;AAEF,QAAA,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE;AAC9B,YAAA,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,eAAe,CAAC;QAC9C;AAEA,QAAA,IAAI,QAAQ,GAAG,GAAA,CAAA,MAAA,CAAK,GAAG,CAAC,KAAK,CAAC,MAAmB,IAAI,cAAc,CAAC,OAAO,CAAE;AAC7E,QAAA,IAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAChD,IAAM,UAAU,GAAG,gBAAgB,CAAC;AAClC,YAAA,QAAQ,EAAA,QAAA;AACR,YAAA,IAAI,EAAA,IAAA;AACJ,YAAA,eAAe,EAAA,eAAA;AACf,YAAA,SAAS,EAAE,iBAAiB;AAC5B,YAAA,iBAAiB,EAAA,iBAAA;AAClB,SAAA,CAAC;QACF,IAAI,UAAU,EAAE;YACd,QAAQ,GAAG,iBAAiB;QAC9B;QAEA,IAAI,CAAC,iBAAiB,IAAI,eAAe,IAAI,eAAe,KAAK,IAAI,EAAE;AACrE,YAAA,IAAM,gBAAgB,GAAG,EAAA,CAAA,MAAA,CAAG,QAAQ,EAAA,KAAA,CAAA,CAAA,MAAA,CAAM,IAAI,CAAE;YAChD,IAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC;YACxE,sBAAsB,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC;YAC7D,sBAAsB,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC;AAE9D,YAAA,IAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,cAAc,EACd,EAAA,CAAA,MAAA,CAAG,QAAQ,EAAA,KAAA,CAAA,CAAA,MAAA,CAAM,eAAe,CAAE,CACnC;YACD,oBAAoB,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC;AAC5D,YAAA,oBAAoB,CAAC,YAAY,CAAC,GAAG,CACnC,UAAU,EACV,sBAAsB,CAAC,QAAQ,EAAE,CAClC;YAED,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC;YAClD;QACF;AAEA,QAAA,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;AAC5B,YAAA,QAAQ,EAAA,QAAA;AACT,SAAA,CAAC;IACJ,CAAC;AA1ED;;;;"}
@@ -17,25 +17,35 @@ var getOtherDomainHost = function (currentHost) {
17
17
  }
18
18
  return currentHost;
19
19
  };
20
- var isSafePath = function (path) {
21
- if (typeof path !== 'string')
20
+ var validateReturnTo = function (_a) {
21
+ var pathOrUrl = _a.pathOrUrl, host = _a.host, protocol = _a.protocol, otherDomainHost = _a.otherDomainHost, crossDomainLogout = _a.crossDomainLogout;
22
+ if (typeof pathOrUrl !== 'string')
22
23
  return false;
23
- if (path.length > 2048)
24
+ if (pathOrUrl.length > 2048)
24
25
  return false;
25
- if (!path.startsWith('/') || path.startsWith('//'))
26
- return false;
27
- // Limit chars in return to path to prevent injections
28
- // eslint-disable-next-line @typescript-eslint/naming-convention
29
- var SAFE_PATH_REGEX = /^\/[a-zA-Z0-9/_\-?.=]*$/;
30
26
  try {
31
- var decodedPath = decodeURIComponent(path);
32
- // Re-check after decode to block protocol-relative via %2F trick
27
+ var decodedPathOrUrl = decodeURIComponent(pathOrUrl);
28
+ var parsedUrlOrPath = new URL(decodedPathOrUrl.startsWith('http')
29
+ ? decodedPathOrUrl
30
+ : "".concat(protocol, "://").concat(host).concat(decodedPathOrUrl));
31
+ var decodedPath = parsedUrlOrPath.pathname;
32
+ if (crossDomainLogout && parsedUrlOrPath.host !== otherDomainHost) {
33
+ return false;
34
+ }
35
+ if (!crossDomainLogout && parsedUrlOrPath.host !== host) {
36
+ return false;
37
+ }
33
38
  if (!decodedPath.startsWith('/') || decodedPath.startsWith('//')) {
34
39
  return false;
35
40
  }
41
+ // Limit chars in return to path to prevent injections
42
+ // eslint-disable-next-line @typescript-eslint/naming-convention
43
+ var SAFE_PATH_REGEX = /^\/[a-zA-Z0-9/_\-?.=]*$/;
36
44
  return SAFE_PATH_REGEX.test(decodedPath);
37
45
  }
38
- catch (_a) {
46
+ catch (error) {
47
+ // eslint-disable-next-line no-console
48
+ console.warn('Error parsing URL or path:', error);
39
49
  return false;
40
50
  }
41
51
  };
@@ -67,12 +77,14 @@ var createLogoutHandler = function (_a) {
67
77
  }
68
78
  var returnTo = "/".concat(req.query.locale || languageConfig.default);
69
79
  var otherDomainHost = getOtherDomainHost(host);
70
- var otherDomainBaseUrl = "".concat(protocol, "://").concat(otherDomainHost);
71
- var isSafeRegularReturnTo = !!specifiedReturnTo && isSafePath(specifiedReturnTo);
72
- var isSafeCrossDomainReturnTo = crossDomainLogout &&
73
- specifiedReturnTo.startsWith(otherDomainBaseUrl) &&
74
- isSafePath(specifiedReturnTo.slice(otherDomainBaseUrl.length));
75
- if (isSafeRegularReturnTo || isSafeCrossDomainReturnTo) {
80
+ var isSafePath = validateReturnTo({
81
+ protocol: protocol,
82
+ host: host,
83
+ otherDomainHost: otherDomainHost,
84
+ pathOrUrl: specifiedReturnTo,
85
+ crossDomainLogout: crossDomainLogout,
86
+ });
87
+ if (isSafePath) {
76
88
  returnTo = specifiedReturnTo;
77
89
  }
78
90
  if (!crossDomainLogout && otherDomainHost && otherDomainHost !== host) {
@@ -1 +1 @@
1
- {"version":3,"file":"logout.js","sources":["../../../../../../src/apiRoutes/handlers/creators/logout.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAQA,IAAM,qBAAqB,GAAG,UAAC,QAAgB,EAAA;IAC7C,IAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;AACjC,IAAA,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAA,CAAA,MAAA,CAAI,QAAQ,CAAE;AAE3C,IAAA,IAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IACtC,OAAO,GAAA,CAAA,MAAA,CAAI,IAAI,CAAE;AACnB,CAAC;AAED,IAAM,kBAAkB,GAAG,UAAC,WAAmB,EAAA;AAC7C,IAAA,IAAI,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvC,OAAO,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC;IAC1D;AACA,IAAA,IAAI,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvC,OAAO,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC;IAC1D;AACA,IAAA,OAAO,WAAW;AACpB,CAAC;AACD,IAAM,UAAU,GAAG,UAAC,IAAa,EAAA;IAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ;AAAE,QAAA,OAAO,KAAK;AAC1C,IAAA,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;AAAE,QAAA,OAAO,KAAK;AACpC,IAAA,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;AAAE,QAAA,OAAO,KAAK;;;IAIhE,IAAM,eAAe,GAAG,yBAAyB;AACjD,IAAA,IAAI;AACF,QAAA,IAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC;;AAE5C,QAAA,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;AAChE,YAAA,OAAO,KAAK;QACd;AAEA,QAAA,OAAO,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1C;AAAE,IAAA,OAAA,EAAA,EAAM;AACN,QAAA,OAAO,KAAK;IACd;AACF,CAAC;AAEM,IAAM,mBAAmB,GAC9B,UAAC,EAA6B,EAAA;AAA3B,IAAA,IAAA,SAAS,eAAA,EAAE,IAAI,GAAA,EAAA,CAAA,IAAA,EAAE,QAAQ,GAAA,EAAA,CAAA,QAAA;IAC5B,OAAA,UAAC,GAAmB,EAAE,GAAoB,EAAA;QAClC,IAAA,EAAA,GAMF,cAAc,CAAC,EAAE,SAAS,EAAA,SAAA,EAAE,CAAC,EAL/B,cAAc,GAAA,EAAA,CAAA,cAAA,EACd,eAAe,GAAA,EAAA,CAAA,eAAA,EACf,qBAAqB,GAAA,EAAA,CAAA,qBAAA,EACrB,sBAAsB,GAAA,EAAA,CAAA,sBAAA,EACtB,cAAc,GAAA,EAAA,CAAA,cACiB;AACzB,QAAA,IAAA,YAAY,GAAK,gBAAgB,CAAC,EAAE,IAAI,EAAA,IAAA,EAAE,QAAQ,EAAA,QAAA,EAAE,SAAS,EAAA,SAAA,EAAE,CAAC,aAApD;AACpB,QAAA,IAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,QAAkB;QACtD,IAAM,eAAe,GAAa,EAAE;QACpC,IAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;QACnD,IAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM;AAE1D,QAAA,eAAe,CAAC,OAAO,CAAC,UAAC,UAAU,EAAA;AACjC,YAAA,eAAe,CAAC,IAAI,CAAC,UAAG,UAAU,EAAA,sBAAA,CAAsB,CAAC;AACzD,YAAA,eAAe,CAAC,IAAI,CAAC,UAAG,UAAU,EAAA,wBAAA,CAAwB,CAAC;AAC7D,QAAA,CAAC,CAAC;AAEF,QAAA,IAAM,kBAAkB,GAAG,qBAAqB,CAAC,IAAI,CAAC;AACtD,QAAA,IAAM,iBAAiB,GAAG,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;AACzE,QAAA,IAAM,0BAA0B,GAAG,kBAAkB,CAAC,MAAM,CAC1D,UAAC,iBAAiB,EAAA;AAChB,YAAA,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAC,UAAU,EAAA;AACvC,gBAAA,OAAO,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC;AACjD,YAAA,CAAC,CAAC;AACJ,QAAA,CAAC,CACF;AACD,QAAA,0BAA0B,CAAC,OAAO,CAAC,UAAC,UAAU,EAAA;YAC5C,eAAe,CAAC,IAAI,CAClB,EAAA,CAAA,MAAA,CAAG,UAAU,EAAA,+BAAA,CAAA,CAAA,MAAA,CAAgC,kBAAkB,EAAA,GAAA,CAAG,CACnE;AACH,QAAA,CAAC,CAAC;AAEF,QAAA,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE;AAC9B,YAAA,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,eAAe,CAAC;QAC9C;AAEA,QAAA,IAAI,QAAQ,GAAG,GAAA,CAAA,MAAA,CAAK,GAAG,CAAC,KAAK,CAAC,MAAmB,IAAI,cAAc,CAAC,OAAO,CAAE;AAC7E,QAAA,IAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC;AAChD,QAAA,IAAM,kBAAkB,GAAG,EAAA,CAAA,MAAA,CAAG,QAAQ,EAAA,KAAA,CAAA,CAAA,MAAA,CAAM,eAAe,CAAE;QAC7D,IAAM,qBAAqB,GACzB,CAAC,CAAC,iBAAiB,IAAI,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAM,yBAAyB,GAC7B,iBAAiB;AACjB,YAAA,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,CAAC;YAChD,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAChE,QAAA,IAAI,qBAAqB,IAAI,yBAAyB,EAAE;YACtD,QAAQ,GAAG,iBAAiB;QAC9B;QAEA,IAAI,CAAC,iBAAiB,IAAI,eAAe,IAAI,eAAe,KAAK,IAAI,EAAE;AACrE,YAAA,IAAM,gBAAgB,GAAG,EAAA,CAAA,MAAA,CAAG,QAAQ,EAAA,KAAA,CAAA,CAAA,MAAA,CAAM,IAAI,CAAE;YAChD,IAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC;YACxE,sBAAsB,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC;YAC7D,sBAAsB,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC;AAE9D,YAAA,IAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,cAAc,EACd,EAAA,CAAA,MAAA,CAAG,QAAQ,EAAA,KAAA,CAAA,CAAA,MAAA,CAAM,eAAe,CAAE,CACnC;YACD,oBAAoB,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC;AAC5D,YAAA,oBAAoB,CAAC,YAAY,CAAC,GAAG,CACnC,UAAU,EACV,sBAAsB,CAAC,QAAQ,EAAE,CAClC;YAED,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC;YAClD;QACF;AAEA,QAAA,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;AAC5B,YAAA,QAAQ,EAAA,QAAA;AACT,SAAA,CAAC;IACJ,CAAC;AA1ED;;;;"}
1
+ {"version":3,"file":"logout.js","sources":["../../../../../../src/apiRoutes/handlers/creators/logout.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAQA,IAAM,qBAAqB,GAAG,UAAC,QAAgB,EAAA;IAC7C,IAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;AACjC,IAAA,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAA,CAAA,MAAA,CAAI,QAAQ,CAAE;AAE3C,IAAA,IAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IACtC,OAAO,GAAA,CAAA,MAAA,CAAI,IAAI,CAAE;AACnB,CAAC;AAED,IAAM,kBAAkB,GAAG,UAAC,WAAmB,EAAA;AAC7C,IAAA,IAAI,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvC,OAAO,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC;IAC1D;AACA,IAAA,IAAI,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvC,OAAO,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC;IAC1D;AACA,IAAA,OAAO,WAAW;AACpB,CAAC;AACD,IAAM,gBAAgB,GAAG,UAAC,EAYzB,EAAA;AAXC,IAAA,IAAA,SAAS,GAAA,EAAA,CAAA,SAAA,EACT,IAAI,GAAA,EAAA,CAAA,IAAA,EACJ,QAAQ,GAAA,EAAA,CAAA,QAAA,EACR,eAAe,GAAA,EAAA,CAAA,eAAA,EACf,iBAAiB,GAAA,EAAA,CAAA,iBAAA;IAQjB,IAAI,OAAO,SAAS,KAAK,QAAQ;AAAE,QAAA,OAAO,KAAK;AAC/C,IAAA,IAAI,SAAS,CAAC,MAAM,GAAG,IAAI;AAAE,QAAA,OAAO,KAAK;AAEzC,IAAA,IAAI;AACF,QAAA,IAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,CAAC;QACtD,IAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,gBAAgB,CAAC,UAAU,CAAC,MAAM;AAChC,cAAE;cACA,UAAG,QAAQ,EAAA,KAAA,CAAA,CAAA,MAAA,CAAM,IAAI,CAAA,CAAA,MAAA,CAAG,gBAAgB,CAAE,CAC/C;AACD,QAAA,IAAM,WAAW,GAAG,eAAe,CAAC,QAAQ;QAE5C,IAAI,iBAAiB,IAAI,eAAe,CAAC,IAAI,KAAK,eAAe,EAAE;AACjE,YAAA,OAAO,KAAK;QACd;QAEA,IAAI,CAAC,iBAAiB,IAAI,eAAe,CAAC,IAAI,KAAK,IAAI,EAAE;AACvD,YAAA,OAAO,KAAK;QACd;AAEA,QAAA,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;AAChE,YAAA,OAAO,KAAK;QACd;;;QAIA,IAAM,eAAe,GAAG,yBAAyB;AACjD,QAAA,OAAO,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1C;IAAE,OAAO,KAAK,EAAE;;AAEd,QAAA,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,CAAC;AACjD,QAAA,OAAO,KAAK;IACd;AACF,CAAC;AAEM,IAAM,mBAAmB,GAC9B,UAAC,EAA6B,EAAA;AAA3B,IAAA,IAAA,SAAS,eAAA,EAAE,IAAI,GAAA,EAAA,CAAA,IAAA,EAAE,QAAQ,GAAA,EAAA,CAAA,QAAA;IAC5B,OAAA,UAAC,GAAmB,EAAE,GAAoB,EAAA;QAClC,IAAA,EAAA,GAMF,cAAc,CAAC,EAAE,SAAS,EAAA,SAAA,EAAE,CAAC,EAL/B,cAAc,GAAA,EAAA,CAAA,cAAA,EACd,eAAe,GAAA,EAAA,CAAA,eAAA,EACf,qBAAqB,GAAA,EAAA,CAAA,qBAAA,EACrB,sBAAsB,GAAA,EAAA,CAAA,sBAAA,EACtB,cAAc,GAAA,EAAA,CAAA,cACiB;AACzB,QAAA,IAAA,YAAY,GAAK,gBAAgB,CAAC,EAAE,IAAI,EAAA,IAAA,EAAE,QAAQ,EAAA,QAAA,EAAE,SAAS,EAAA,SAAA,EAAE,CAAC,aAApD;AACpB,QAAA,IAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,QAAkB;QACtD,IAAM,eAAe,GAAa,EAAE;QACpC,IAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;QACnD,IAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM;AAE1D,QAAA,eAAe,CAAC,OAAO,CAAC,UAAC,UAAU,EAAA;AACjC,YAAA,eAAe,CAAC,IAAI,CAAC,UAAG,UAAU,EAAA,sBAAA,CAAsB,CAAC;AACzD,YAAA,eAAe,CAAC,IAAI,CAAC,UAAG,UAAU,EAAA,wBAAA,CAAwB,CAAC;AAC7D,QAAA,CAAC,CAAC;AAEF,QAAA,IAAM,kBAAkB,GAAG,qBAAqB,CAAC,IAAI,CAAC;AACtD,QAAA,IAAM,iBAAiB,GAAG,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;AACzE,QAAA,IAAM,0BAA0B,GAAG,kBAAkB,CAAC,MAAM,CAC1D,UAAC,iBAAiB,EAAA;AAChB,YAAA,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAC,UAAU,EAAA;AACvC,gBAAA,OAAO,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC;AACjD,YAAA,CAAC,CAAC;AACJ,QAAA,CAAC,CACF;AACD,QAAA,0BAA0B,CAAC,OAAO,CAAC,UAAC,UAAU,EAAA;YAC5C,eAAe,CAAC,IAAI,CAClB,EAAA,CAAA,MAAA,CAAG,UAAU,EAAA,+BAAA,CAAA,CAAA,MAAA,CAAgC,kBAAkB,EAAA,GAAA,CAAG,CACnE;AACH,QAAA,CAAC,CAAC;AAEF,QAAA,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE;AAC9B,YAAA,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,eAAe,CAAC;QAC9C;AAEA,QAAA,IAAI,QAAQ,GAAG,GAAA,CAAA,MAAA,CAAK,GAAG,CAAC,KAAK,CAAC,MAAmB,IAAI,cAAc,CAAC,OAAO,CAAE;AAC7E,QAAA,IAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAChD,IAAM,UAAU,GAAG,gBAAgB,CAAC;AAClC,YAAA,QAAQ,EAAA,QAAA;AACR,YAAA,IAAI,EAAA,IAAA;AACJ,YAAA,eAAe,EAAA,eAAA;AACf,YAAA,SAAS,EAAE,iBAAiB;AAC5B,YAAA,iBAAiB,EAAA,iBAAA;AAClB,SAAA,CAAC;QACF,IAAI,UAAU,EAAE;YACd,QAAQ,GAAG,iBAAiB;QAC9B;QAEA,IAAI,CAAC,iBAAiB,IAAI,eAAe,IAAI,eAAe,KAAK,IAAI,EAAE;AACrE,YAAA,IAAM,gBAAgB,GAAG,EAAA,CAAA,MAAA,CAAG,QAAQ,EAAA,KAAA,CAAA,CAAA,MAAA,CAAM,IAAI,CAAE;YAChD,IAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC;YACxE,sBAAsB,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC;YAC7D,sBAAsB,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC;AAE9D,YAAA,IAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,cAAc,EACd,EAAA,CAAA,MAAA,CAAG,QAAQ,EAAA,KAAA,CAAA,CAAA,MAAA,CAAM,eAAe,CAAE,CACnC;YACD,oBAAoB,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC;AAC5D,YAAA,oBAAoB,CAAC,YAAY,CAAC,GAAG,CACnC,UAAU,EACV,sBAAsB,CAAC,QAAQ,EAAE,CAClC;YAED,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC;YAClD;QACF;AAEA,QAAA,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;AAC5B,YAAA,QAAQ,EAAA,QAAA;AACT,SAAA,CAAC;IACJ,CAAC;AA1ED;;;;"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@smg-automotive/auth",
3
- "version": "6.7.1",
3
+ "version": "6.7.2",
4
4
  "description": "SMG Automotive auth package",
5
5
  "exports": {
6
6
  ".": {