oidc-spa 8.5.1 → 8.5.3

package/src/core/tokenExfiltrationDefense.ts

@@ -51,7 +51,10 @@ function patchFetchApiToSubstituteTokenPlaceholder(params: {
 
         const headers = new Headers();
         request.headers.forEach((value, key) => {
-            const nextValue = substitutePlaceholderByRealToken(value);
+            const nextValue = substitutePlaceholderByRealToken({
+                text: value,
+                doEncodeUriComponent: false
+            });
 
             if (nextValue !== value) {
                 didSubstitute = true;
@@ -77,7 +80,10 @@ function patchFetchApiToSubstituteTokenPlaceholder(params: {
                 }
 
                 if (typeof init.body === "string") {
-                    body = substitutePlaceholderByRealToken(init.body);
+                    body = substitutePlaceholderByRealToken({
+                        text: init.body,
+                        doEncodeUriComponent: false
+                    });
 
                     if (init.body !== body) {
                         didSubstitute = true;
@@ -91,7 +97,10 @@ function patchFetchApiToSubstituteTokenPlaceholder(params: {
                     const next = new URLSearchParams();
 
                     init.body.forEach((value, key) => {
-                        const nextValue = substitutePlaceholderByRealToken(value);
+                        const nextValue = substitutePlaceholderByRealToken({
+                            text: value,
+                            doEncodeUriComponent: false
+                        });
 
                         if (nextValue !== value) {
                             didUrlSearchParamsSubstitute = true;
@@ -115,7 +124,10 @@ function patchFetchApiToSubstituteTokenPlaceholder(params: {
 
                     init.body.forEach((value, key) => {
                         if (typeof value === "string") {
-                            const nextValue = substitutePlaceholderByRealToken(value);
+                            const nextValue = substitutePlaceholderByRealToken({
+                                text: value,
+                                doEncodeUriComponent: false
+                            });
 
                             if (nextValue !== value) {
                                 didFormDataSubstitute = true;
@@ -188,7 +200,10 @@ function patchFetchApiToSubstituteTokenPlaceholder(params: {
             }
 
             const bodyText = await request.clone().text();
-            const nextBodyText = substitutePlaceholderByRealToken(bodyText);
+            const nextBodyText = substitutePlaceholderByRealToken({
+                text: bodyText,
+                doEncodeUriComponent: false
+            });
 
             if (nextBodyText !== bodyText) {
                 didSubstitute = true;
@@ -197,6 +212,18 @@ function patchFetchApiToSubstituteTokenPlaceholder(params: {
             body = nextBodyText;
         }
 
+        let url: string;
+
+        {
+            const url_before = request.url;
+
+            url = substitutePlaceholderByRealToken({ text: url_before, doEncodeUriComponent: true });
+
+            if (url !== url_before) {
+                didSubstitute = true;
+            }
+        }
+
         block_authed_request_to_unauthorized_hostnames: {
             if (!didSubstitute) {
                 break block_authed_request_to_unauthorized_hostnames;
@@ -223,7 +250,7 @@ function patchFetchApiToSubstituteTokenPlaceholder(params: {
             );
         }
 
-        return fetch_actual(request.url, {
+        const nextInit: RequestInit = {
             method: request.method,
             headers,
             body,
@@ -236,7 +263,19 @@ function patchFetchApiToSubstituteTokenPlaceholder(params: {
             integrity: request.integrity,
             keepalive: request.keepalive,
             signal: request.signal
-        });
+        };
+
+        {
+            //@ts-expect-error
+            const duplex = init?.duplex ?? (input instanceof Request ? input.duplex : undefined);
+
+            if (duplex !== undefined) {
+                //@ts-expect-error
+                nextInit.duplex = duplex;
+            }
+        }
+
+        return fetch_actual(url, nextInit);
     };
 }
 
@@ -249,29 +288,7 @@ function patchXMLHttpRequestApiToSubstituteTokenPlaceholder(params: {
     const send_actual = XMLHttpRequest.prototype.send;
     const setRequestHeader_actual = XMLHttpRequest.prototype.setRequestHeader;
 
-    type XhrData = {
-        url: string;
-        didSubstitute: boolean;
-    };
-
-    const xhrDataSymbol = Symbol("oidc-spa XMLHttpRequest data");
-
-    const getXhrData = (xhr: XMLHttpRequest): XhrData => {
-        const xhr_any = xhr as any;
-
-        if (xhr_any[xhrDataSymbol] !== undefined) {
-            return xhr_any[xhrDataSymbol];
-        }
-
-        const data: XhrData = {
-            url: "",
-            didSubstitute: false
-        };
-
-        xhr_any[xhrDataSymbol] = data;
-
-        return data;
-    };
+    const stateByInstance = new WeakMap<XMLHttpRequest, { url: string; didSubstitute: boolean }>();
 
     XMLHttpRequest.prototype.open = function open(
         method: string,
@@ -280,10 +297,27 @@ function patchXMLHttpRequestApiToSubstituteTokenPlaceholder(params: {
         username?: string | null,
         password?: string | null
     ) {
-        const xhrData = getXhrData(this);
+        const state = { url: "", didSubstitute: false };
+
+        {
+            const url_str = typeof url === "string" ? url : url.href;
+            state.url = substitutePlaceholderByRealToken({ text: url_str, doEncodeUriComponent: true });
+            if (url_str !== state.url) {
+                state.didSubstitute = true;
+            }
+        }
+
+        stateByInstance.set(this, state);
+
+        prevent_fetching_of_hashed_js_assets: {
+            const { pathname } = new URL(state.url, window.location.href);
+
+            if (!viteHashedJsAssetPathRegExp.test(pathname)) {
+                break prevent_fetching_of_hashed_js_assets;
+            }
 
-        xhrData.url = typeof url === "string" ? url : url.href;
-        xhrData.didSubstitute = false;
+            throw new Error("oidc-spa: Blocked request to hashed static asset.");
+        }
 
         if (async === undefined) {
             return open_actual.bind(this)(method, url);
@@ -293,47 +327,45 @@ function patchXMLHttpRequestApiToSubstituteTokenPlaceholder(params: {
     };
 
     XMLHttpRequest.prototype.setRequestHeader = function setRequestHeader(name, value) {
-        const xhrData = getXhrData(this);
-        const nextValue = substitutePlaceholderByRealToken(value);
+        const state = stateByInstance.get(this);
+
+        assert(state !== undefined, "29440283");
+
+        const nextValue = substitutePlaceholderByRealToken({ text: value, doEncodeUriComponent: false });
 
         if (nextValue !== value) {
-            xhrData.didSubstitute = true;
+            state.didSubstitute = true;
         }
 
         return setRequestHeader_actual.call(this, name, nextValue);
     };
 
     XMLHttpRequest.prototype.send = function send(body) {
-        const xhrData = getXhrData(this);
-
-        prevent_fetching_of_hashed_js_assets: {
-            const { pathname } = new URL(xhrData.url, window.location.href);
+        const state = stateByInstance.get(this);
 
-            if (!viteHashedJsAssetPathRegExp.test(pathname)) {
-                break prevent_fetching_of_hashed_js_assets;
-            }
-
-            throw new Error("oidc-spa: Blocked request to hashed static asset.");
-        }
+        assert(state !== undefined, "32323484");
 
         let nextBody = body;
 
         if (typeof body === "string") {
-            const nextBodyText = substitutePlaceholderByRealToken(body);
+            const nextBodyText = substitutePlaceholderByRealToken({
+                text: body,
+                doEncodeUriComponent: false
+            });
 
             if (nextBodyText !== body) {
-                xhrData.didSubstitute = true;
+                state.didSubstitute = true;
             }
 
             nextBody = nextBodyText;
         }
 
         block_authed_request_to_unauthorized_hostnames: {
-            if (!xhrData.didSubstitute) {
+            if (!state.didSubstitute) {
                 break block_authed_request_to_unauthorized_hostnames;
             }
 
-            const { hostname } = new URL(xhrData.url, window.location.href);
+            const { hostname } = new URL(state.url, window.location.href);
 
             if (
                 getIsHostnameAuthorized({
@@ -377,43 +409,9 @@ function patchWebSocketApiToSubstituteTokenPlaceholder(params: {
 
     const WebSocketPatched = function WebSocket(url: string | URL, protocols?: string | string[]) {
         const urlStr = typeof url === "string" ? url : url.href;
-        const nextUrl = substitutePlaceholderByRealToken(urlStr);
+        const nextUrl = substitutePlaceholderByRealToken({ text: urlStr, doEncodeUriComponent: true });
         let didSubstitute = nextUrl !== urlStr;
 
-        const nextProtocols = (() => {
-            if (protocols === undefined) {
-                return protocols;
-            }
-
-            if (typeof protocols === "string") {
-                const next = substitutePlaceholderByRealToken(protocols);
-
-                if (next !== protocols) {
-                    didSubstitute = true;
-                }
-
-                return next;
-            }
-
-            let didProtocolsSubstitute = false;
-
-            const next = protocols.map(protocol => {
-                const nextProtocol = substitutePlaceholderByRealToken(protocol);
-
-                if (nextProtocol !== protocol) {
-                    didProtocolsSubstitute = true;
-                }
-
-                return nextProtocol;
-            });
-
-            if (didProtocolsSubstitute) {
-                didSubstitute = true;
-            }
-
-            return next;
-        })();
-
         const { hostname, pathname } = new URL(nextUrl, window.location.href);
 
         block_authed_request_to_unauthorized_hostnames: {
@@ -440,7 +438,7 @@ function patchWebSocketApiToSubstituteTokenPlaceholder(params: {
             );
         }
 
-        const ws = new WebSocket_actual(nextUrl, nextProtocols as Parameters<typeof WebSocket>[1]);
+        const ws = new WebSocket_actual(nextUrl, protocols as Parameters<typeof WebSocket>[1]);
 
         wsDataByWs.set(ws, {
             url: nextUrl,
@@ -476,7 +474,10 @@ function patchWebSocketApiToSubstituteTokenPlaceholder(params: {
         let nextData = data;
 
         if (typeof data === "string") {
-            const nextDataText = substitutePlaceholderByRealToken(data);
+            const nextDataText = substitutePlaceholderByRealToken({
+                text: data,
+                doEncodeUriComponent: false
+            });
 
             if (nextDataText !== data) {
                 wsData.didSubstitute = true;
@@ -537,7 +538,7 @@ function patchEventSourceApiToSubstituteTokenPlaceholder(params: {
         eventSourceInitDict?: EventSourceInit
     ) {
         const urlStr = typeof url === "string" ? url : url.href;
-        const nextUrl = substitutePlaceholderByRealToken(urlStr);
+        const nextUrl = substitutePlaceholderByRealToken({ text: urlStr, doEncodeUriComponent: true });
         const didSubstitute = nextUrl !== urlStr;
 
         const { hostname } = new URL(nextUrl, window.location.href);
@@ -598,7 +599,7 @@ function patchNavigatorSendBeaconApiToSubstituteTokenPlaceholder(params: {
 
     navigator.sendBeacon = function sendBeacon(url: string | URL, data?: BodyInit | null) {
         const urlStr = typeof url === "string" ? url : url.href;
-        const nextUrl = substitutePlaceholderByRealToken(urlStr);
+        const nextUrl = substitutePlaceholderByRealToken({ text: urlStr, doEncodeUriComponent: true });
         let didSubstitute = nextUrl !== urlStr;
 
         const { hostname } = new URL(nextUrl, window.location.href);
@@ -606,7 +607,7 @@ function patchNavigatorSendBeaconApiToSubstituteTokenPlaceholder(params: {
         let nextData = data;
 
         if (typeof data === "string") {
-            const next = substitutePlaceholderByRealToken(data);
+            const next = substitutePlaceholderByRealToken({ text: data, doEncodeUriComponent: false });
 
             if (next !== data) {
                 didSubstitute = true;
@@ -618,7 +619,10 @@ function patchNavigatorSendBeaconApiToSubstituteTokenPlaceholder(params: {
             const next = new URLSearchParams();
 
             data.forEach((value, key) => {
-                const nextValue = substitutePlaceholderByRealToken(value);
+                const nextValue = substitutePlaceholderByRealToken({
+                    text: value,
+                    doEncodeUriComponent: false
+                });
 
                 if (nextValue !== value) {
                     didUrlSearchParamsSubstitute = true;
@@ -637,7 +641,10 @@ function patchNavigatorSendBeaconApiToSubstituteTokenPlaceholder(params: {
 
             data.forEach((value, key) => {
                 if (typeof value === "string") {
-                    const nextValue = substitutePlaceholderByRealToken(value);
+                    const nextValue = substitutePlaceholderByRealToken({
+                        text: value,
+                        doEncodeUriComponent: false
+                    });
 
                     if (nextValue !== value) {
                         didFormDataSubstitute = true;
@@ -705,6 +712,7 @@ function runMonkeyPatchingPrevention() {
         "ServiceWorkerRegistration",
         "ServiceWorker",
         "FormData",
+        "WeakMap",
         "Blob",
         "String",
         "Object",

package/src/core/tokenPlaceholderSubstitution.ts

@@ -66,7 +66,12 @@ export function getTokensPlaceholders(params: { configId: string; tokens: Tokens
     };
 }
 
-export function substitutePlaceholderByRealToken(text: string): string {
+export function substitutePlaceholderByRealToken(params: {
+    text: string;
+    doEncodeUriComponent: boolean;
+}): string {
+    const { text, doEncodeUriComponent } = params;
+
     let text_modified = text;
 
     for (const [tokenType, regExp] of [
@@ -89,15 +94,19 @@ export function substitutePlaceholderByRealToken(text: string): string {
                 );
             }
 
-            switch (tokenType) {
-                case "access_token":
-                    return entry.tokens.accessToken;
-                case "id_token":
-                    return entry.tokens.idToken;
-                case "refresh_token":
-                    assert(entry.tokens.refreshToken !== undefined, "204392284");
-                    return entry.tokens.refreshToken;
-            }
+            const token = (() => {
+                switch (tokenType) {
+                    case "access_token":
+                        return entry.tokens.accessToken;
+                    case "id_token":
+                        return entry.tokens.idToken;
+                    case "refresh_token":
+                        assert(entry.tokens.refreshToken !== undefined, "204392284");
+                        return entry.tokens.refreshToken;
+                }
+            })();
+
+            return doEncodeUriComponent ? encodeURIComponent(token) : token;
         });
     }