Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enforce authTokenSyncURL being a path and not a url. #8056

Merged
merged 1 commit into from
Mar 6, 2024

Conversation

hsubox76
Copy link
Contributor

@hsubox76 hsubox76 commented Mar 5, 2024

The _authTokenSyncURL property coming from the FIREBASE_DEFAULTS autoinit (for frameworks tooling) should only point to the same domain and be a relative path. Do not set the cookie if this is not a relative path (such as if it is a full url), as this could be a possible vulnerability.

See b/327386166

Copy link

changeset-bot bot commented Mar 5, 2024

🦋 Changeset detected

Latest commit: d8cac08

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages
Name Type
@firebase/auth Patch
@firebase/auth-compat Patch
firebase Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@hsubox76 hsubox76 requested a review from jamesdaniels March 5, 2024 18:44
@google-oss-bot
Copy link
Contributor

Size Report 1

Affected Products

  • @firebase/auth

    TypeBase (e60188d)Merge (0088e11)Diff
    browser177 kB177 kB+38 B (+0.0%)
    esm5231 kB231 kB+38 B (+0.0%)
    module177 kB177 kB+38 B (+0.0%)
  • @firebase/auth/internal

    TypeBase (e60188d)Merge (0088e11)Diff
    browser188 kB188 kB+38 B (+0.0%)
    esm5244 kB244 kB+38 B (+0.0%)
    module188 kB188 kB+38 B (+0.0%)
  • bundle

    TypeBase (e60188d)Merge (0088e11)Diff
    auth (GoogleFBTwitterGitHubPopup)101 kB101 kB+19 B (+0.0%)
  • firebase

    TypeBase (e60188d)Merge (0088e11)Diff
    firebase-auth.js147 kB147 kB+19 B (+0.0%)

Test Logs

  1. https://storage.googleapis.com/firebase-sdk-metric-reports/98RFFgD1tY.html
@google-oss-bot
Copy link
Contributor

Size Analysis Report 1

Affected Products

  • @firebase/auth

    • getAuth

      Size

      TypeBase (e60188d)Merge (0088e11)Diff
      size72.4 kB72.4 kB+19 B (+0.0%)
      size-with-ext-deps100 kB100 kB+19 B (+0.0%)

Test Logs

  1. https://storage.googleapis.com/firebase-sdk-metric-reports/iB521IhizP.html
@hsubox76 hsubox76 merged commit 245dd26 into master Mar 6, 2024
44 checks passed
@hsubox76 hsubox76 deleted the ch-defaults-fix-1 branch March 6, 2024 18:19
@google-oss-bot google-oss-bot mentioned this pull request Mar 11, 2024
@firebase firebase locked and limited conversation to collaborators Apr 6, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
4 participants