oidc-spa 8.6.6 → 8.6.8

package/src/core/tokenExfiltrationDefense.ts

@@ -4,6 +4,7 @@ import {
     substitutePlaceholderByRealToken
 } from "./tokenPlaceholderSubstitution";
 import { getIsHostnameAuthorized } from "../tools/isHostnameAuthorized";
+import { getIsLikelyDevServer } from "../tools/isLikelyDevServer";
 
 type Params = {
     resourceServersAllowedHostnames: string[] | undefined;
@@ -33,237 +34,271 @@ function patchFetchApiToSubstituteTokenPlaceholder(params: {
     const { resourceServersAllowedHostnames } = params;
 
     const fetch_actual = window.fetch;
+    //@ts-expect-error
+    const fetchLater_actual: typeof fetch_actual | undefined = window.fetchLater;
 
-    window.fetch = async function fetch(input, init) {
-        const request = input instanceof Request ? input : new Request(input, init);
+    const createFetchOrFetchLater = (params: { isFetchLater: boolean }) => {
+        const { isFetchLater } = params;
 
-        let didSubstitute = false;
+        const fn: typeof fetch_actual = async (input, init) => {
+            const request = input instanceof Request ? input : new Request(input, init);
 
-        let url: string;
+            let didSubstitute = false;
 
-        {
-            const url_before = `${request.url}`;
+            let url: string;
 
-            url = substitutePlaceholderByRealToken(url_before);
+            {
+                const url_before = `${request.url}`;
 
-            if (url !== url_before) {
-                didSubstitute = true;
+                url = substitutePlaceholderByRealToken(url_before);
+
+                if (url !== url_before) {
+                    didSubstitute = true;
+                }
             }
-        }
 
-        prevent_fetching_of_hashed_js_assets: {
-            const { pathname } = new URL(url, window.location.href);
+            prevent_fetching_of_hashed_js_assets: {
+                const { pathname } = new URL(url, window.location.href);
 
-            if (!viteHashedJsAssetPathRegExp.test(pathname)) {
-                break prevent_fetching_of_hashed_js_assets;
+                if (!viteHashedJsAssetPathRegExp.test(pathname)) {
+                    break prevent_fetching_of_hashed_js_assets;
+                }
+
+                throw new Error("oidc-spa: Blocked request to hashed js static asset.");
             }
 
-            throw new Error("oidc-spa: Blocked request to hashed js static asset.");
-        }
+            const headers = new Headers();
+            request.headers.forEach((value, key) => {
+                const nextValue = substitutePlaceholderByRealToken(value);
 
-        const headers = new Headers();
-        request.headers.forEach((value, key) => {
-            const nextValue = substitutePlaceholderByRealToken(value);
+                if (nextValue !== value) {
+                    didSubstitute = true;
+                }
 
-            if (nextValue !== value) {
-                didSubstitute = true;
-            }
+                headers.set(key, nextValue);
+            });
 
-            headers.set(key, nextValue);
-        });
+            let body: BodyInit | undefined;
 
-        let body: BodyInit | undefined;
+            handle_body: {
+                from_init: {
+                    if (!init) {
+                        break from_init;
+                    }
 
-        handle_body: {
-            from_init: {
-                if (!init) {
-                    break from_init;
-                }
+                    if (!init.body) {
+                        break from_init;
+                    }
 
-                if (!init.body) {
-                    break from_init;
-                }
+                    if (input instanceof Request && input.body !== null) {
+                        break from_init;
+                    }
 
-                if (input instanceof Request && input.body !== null) {
-                    break from_init;
-                }
+                    if (typeof init.body === "string") {
+                        body = substitutePlaceholderByRealToken(init.body);
 
-                if (typeof init.body === "string") {
-                    body = substitutePlaceholderByRealToken(init.body);
+                        if (init.body !== body) {
+                            didSubstitute = true;
+                        }
 
-                    if (init.body !== body) {
-                        didSubstitute = true;
+                        break handle_body;
                     }
 
-                    break handle_body;
-                }
+                    if (init.body instanceof URLSearchParams) {
+                        let didUrlSearchParamsSubstitute = false;
+                        const next = new URLSearchParams();
+
+                        init.body.forEach((value, key) => {
+                            const nextValue = substitutePlaceholderByRealToken(value);
 
-                if (init.body instanceof URLSearchParams) {
-                    let didUrlSearchParamsSubstitute = false;
-                    const next = new URLSearchParams();
+                            if (nextValue !== value) {
+                                didUrlSearchParamsSubstitute = true;
+                            }
 
-                    init.body.forEach((value, key) => {
-                        const nextValue = substitutePlaceholderByRealToken(value);
+                            next.append(key, nextValue);
+                        });
 
-                        if (nextValue !== value) {
-                            didUrlSearchParamsSubstitute = true;
+                        if (didUrlSearchParamsSubstitute) {
+                            didSubstitute = true;
                         }
 
-                        next.append(key, nextValue);
-                    });
+                        body = didUrlSearchParamsSubstitute ? next : init.body;
 
-                    if (didUrlSearchParamsSubstitute) {
-                        didSubstitute = true;
+                        break handle_body;
                     }
 
-                    body = didUrlSearchParamsSubstitute ? next : init.body;
+                    if (init.body instanceof FormData) {
+                        let didFormDataSubstitute = false;
+                        const next = new FormData();
 
-                    break handle_body;
-                }
+                        init.body.forEach((value, key) => {
+                            if (typeof value === "string") {
+                                const nextValue = substitutePlaceholderByRealToken(value);
 
-                if (init.body instanceof FormData) {
-                    let didFormDataSubstitute = false;
-                    const next = new FormData();
+                                if (nextValue !== value) {
+                                    didFormDataSubstitute = true;
+                                }
 
-                    init.body.forEach((value, key) => {
-                        if (typeof value === "string") {
-                            const nextValue = substitutePlaceholderByRealToken(value);
+                                next.append(key, nextValue);
 
-                            if (nextValue !== value) {
-                                didFormDataSubstitute = true;
+                                return;
                             }
 
-                            next.append(key, nextValue);
+                            next.append(key, value);
+                        });
 
-                            return;
+                        if (didFormDataSubstitute) {
+                            didSubstitute = true;
                         }
 
-                        next.append(key, value);
-                    });
+                        body = didFormDataSubstitute ? next : init.body;
 
-                    if (didFormDataSubstitute) {
-                        didSubstitute = true;
+                        break handle_body;
                     }
 
-                    body = didFormDataSubstitute ? next : init.body;
+                    if (init.body instanceof Blob) {
+                        break from_init;
+                    }
 
+                    body = init.body;
                     break handle_body;
                 }
 
-                if (init.body instanceof Blob) {
-                    break from_init;
+                if (request.body === null) {
+                    body = undefined;
+                    break handle_body;
                 }
 
-                body = init.body;
-                break handle_body;
-            }
+                const shouldInspectBody = (() => {
+                    let ct = headers.get("Content-Type");
 
-            if (request.body === null) {
-                body = undefined;
-                break handle_body;
-            }
+                    if (ct === null) {
+                        return false;
+                    }
 
-            const shouldInspectBody = (() => {
-                let ct = headers.get("Content-Type");
+                    ct = ct.toLocaleLowerCase();
 
-                if (ct === null) {
-                    return false;
-                }
+                    if (
+                        !ct.startsWith("application/json") &&
+                        !ct.startsWith("application/x-www-form-urlencoded")
+                    ) {
+                        return false;
+                    }
 
-                ct = ct.toLocaleLowerCase();
+                    const len_str = headers.get("Content-Length");
 
-                if (
-                    !ct.startsWith("application/json") &&
-                    !ct.startsWith("application/x-www-form-urlencoded")
-                ) {
-                    return false;
-                }
+                    if (len_str === null) {
+                        // NOTE: This will have performance implications for large bodies
+                        // but we have no other way to know the size
+                        return true;
+                    }
+
+                    const len = parseInt(len_str, 10);
 
-                const len_str = headers.get("Content-Length");
+                    if (!Number.isFinite(len) || len > 100_000) {
+                        return false;
+                    }
 
-                if (len_str === null) {
-                    // NOTE: This will have performance implications for large bodies
-                    // but we have no other way to know the size
                     return true;
+                })();
+
+                if (!shouldInspectBody) {
+                    body = request.body;
+                    break handle_body;
                 }
 
-                const len = parseInt(len_str, 10);
+                const bodyText = await request.clone().text();
+                const nextBodyText = substitutePlaceholderByRealToken(bodyText);
 
-                if (!Number.isFinite(len) || len > 100_000) {
-                    return false;
+                if (nextBodyText !== bodyText) {
+                    didSubstitute = true;
                 }
 
-                return true;
-            })();
-
-            if (!shouldInspectBody) {
-                body = request.body;
-                break handle_body;
+                body = nextBodyText;
             }
 
-            const bodyText = await request.clone().text();
-            const nextBodyText = substitutePlaceholderByRealToken(bodyText);
-
-            if (nextBodyText !== bodyText) {
-                didSubstitute = true;
-            }
+            block_authed_request_to_unauthorized_hostnames: {
+                if (!didSubstitute) {
+                    break block_authed_request_to_unauthorized_hostnames;
+                }
 
-            body = nextBodyText;
-        }
+                const { hostname } = new URL(url, window.location.href);
 
-        block_authed_request_to_unauthorized_hostnames: {
-            if (!didSubstitute) {
-                break block_authed_request_to_unauthorized_hostnames;
-            }
+                if (
+                    getIsHostnameAuthorized({
+                        allowedHostnames: resourceServersAllowedHostnames,
+                        extendAuthorizationToParentDomain: true,
+                        hostname
+                    })
+                ) {
+                    break block_authed_request_to_unauthorized_hostnames;
+                }
 
-            const { hostname } = new URL(url, window.location.href);
+                throw new Error(
+                    [
+                        `oidc-spa: Blocked authed request to ${hostname}.`,
+                        `To authorize this request add "${hostname}" to`,
+                        "`resourceServersAllowedHostnames`."
+                    ].join(" ")
+                );
+            }
+
+            const nextInit: RequestInit = {
+                method: request.method,
+                headers,
+                body,
+                mode: request.mode,
+                credentials: request.credentials,
+                cache: request.cache,
+                redirect: request.redirect,
+                referrer: request.referrer,
+                referrerPolicy: request.referrerPolicy,
+                integrity: request.integrity,
+                keepalive: request.keepalive,
+                signal: request.signal
+            };
+
+            {
+                //@ts-expect-error
+                const duplex = init?.duplex ?? (input instanceof Request ? input.duplex : undefined);
 
-            if (
-                getIsHostnameAuthorized({
-                    allowedHostnames: resourceServersAllowedHostnames,
-                    extendAuthorizationToParentDomain: true,
-                    hostname
-                })
-            ) {
-                break block_authed_request_to_unauthorized_hostnames;
+                if (duplex !== undefined) {
+                    //@ts-expect-error
+                    nextInit.duplex = duplex;
+                }
             }
 
-            throw new Error(
-                [
-                    `oidc-spa: Blocked authed request to ${hostname}.`,
-                    `To authorize this request add "${hostname}" to`,
-                    "`resourceServersAllowedHostnames`."
-                ].join(" ")
-            );
-        }
+            fetch_later: {
+                if (!isFetchLater) {
+                    break fetch_later;
+                }
 
-        const nextInit: RequestInit = {
-            method: request.method,
-            headers,
-            body,
-            mode: request.mode,
-            credentials: request.credentials,
-            cache: request.cache,
-            redirect: request.redirect,
-            referrer: request.referrer,
-            referrerPolicy: request.referrerPolicy,
-            integrity: request.integrity,
-            keepalive: request.keepalive,
-            signal: request.signal
-        };
+                assert(fetchLater_actual !== undefined);
 
-        {
-            //@ts-expect-error
-            const duplex = init?.duplex ?? (input instanceof Request ? input.duplex : undefined);
+                const activateAfter =
+                    //@ts-expect-error
+                    init?.activateAfter ?? (input instanceof Request ? input.activateAfter : undefined);
 
-            if (duplex !== undefined) {
-                //@ts-expect-error
-                nextInit.duplex = duplex;
+                if (activateAfter !== undefined) {
+                    //@ts-expect-error
+                    nextInit.activateAfter = activateAfter;
+                }
+
+                return fetchLater_actual(url, nextInit);
             }
-        }
 
-        return fetch_actual(url, nextInit);
+            return fetch_actual(url, nextInit);
+        };
+
+        return fn;
     };
+
+    window.fetch = createFetchOrFetchLater({ isFetchLater: false });
+    // @ts-expect-error
+    if (window.fetchLater) {
+        // @ts-expect-error
+        window.fetchLater = createFetchOrFetchLater({ isFetchLater: true });
+    }
 }
 
 function patchXMLHttpRequestApiToSubstituteTokenPlaceholder(params: {
@@ -330,6 +365,11 @@ function patchXMLHttpRequestApiToSubstituteTokenPlaceholder(params: {
     XMLHttpRequest.prototype.send = function send(body) {
         const state = stateByInstance.get(this);
 
+        // NOTE: Vite's dev server instantiates a websocket before earlyInit runs.
+        if (state === undefined && getIsLikelyDevServer()) {
+            return send_actual.call(this, body);
+        }
+
         assert(state !== undefined, "32323484");
 
         let nextBody = body;

package/src/tools/isLikelyDevServer.ts

@@ -1,11 +1,19 @@
+import { isBrowser } from "./isBrowser";
+
 let isLikelyDevServer_cache: boolean | undefined = undefined;
 
+const hasRefreshReg = isBrowser && "$RefreshReg$" in window;
+
 export function getIsLikelyDevServer(): boolean {
     if (isLikelyDevServer_cache !== undefined) {
         return isLikelyDevServer_cache;
     }
 
     const isLikelyDevServer = (() => {
+        if (hasRefreshReg) {
+            return true;
+        }
+
         const origin = window.location.origin;
 
         if (/^https?:\/\/localhost/.test(origin)) {

package/tools/isLikelyDevServer.js

@@ -1,12 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getIsLikelyDevServer = getIsLikelyDevServer;
+const isBrowser_1 = require("./isBrowser");
 let isLikelyDevServer_cache = undefined;
+const hasRefreshReg = isBrowser_1.isBrowser && "$RefreshReg$" in window;
 function getIsLikelyDevServer() {
     if (isLikelyDevServer_cache !== undefined) {
         return isLikelyDevServer_cache;
     }
     const isLikelyDevServer = (() => {
+        if (hasRefreshReg) {
+            return true;
+        }
         const origin = window.location.origin;
         if (/^https?:\/\/localhost/.test(origin)) {
             return true;

package/tools/isLikelyDevServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"isLikelyDevServer.js","sourceRoot":"","sources":["../src/tools/isLikelyDevServer.ts"],"names":[],"mappings":";;AAEA,oDA0BC;AA5BD,IAAI,uBAAuB,GAAwB,SAAS,CAAC;AAE7D,SAAgB,oBAAoB;IAChC,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,uBAAuB,CAAC;IACnC,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAEtC,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC,EAAE,CAAC;IAEL,uBAAuB,GAAG,iBAAiB,CAAC;IAE5C,OAAO,iBAAiB,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"isLikelyDevServer.js","sourceRoot":"","sources":["../src/tools/isLikelyDevServer.ts"],"names":[],"mappings":";;AAMA,oDA8BC;AApCD,2CAAwC;AAExC,IAAI,uBAAuB,GAAwB,SAAS,CAAC;AAE7D,MAAM,aAAa,GAAG,qBAAS,IAAI,cAAc,IAAI,MAAM,CAAC;AAE5D,SAAgB,oBAAoB;IAChC,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,uBAAuB,CAAC;IACnC,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE;QAC5B,IAAI,aAAa,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAEtC,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC,EAAE,CAAC;IAEL,uBAAuB,GAAG,iBAAiB,CAAC;IAE5C,OAAO,iBAAiB,CAAC;AAC7B,CAAC"}