fix(security): validate extension callback state

This commit is contained in:
zarzet
2026-08-29 18:53:33 +07:00
parent 29db940d63
commit 63d29d2ed4
10 changed files with 236 additions and 51 deletions
+4 -4
View File
@@ -2,7 +2,7 @@ import Foundation
struct ExtensionCallbackRoute: Equatable {
let code: String
let extensionId: String
let state: String
let isSessionGrant: Bool
}
@@ -36,17 +36,17 @@ enum ExtensionCallbackParser {
?? queryItems.first { $0.name == "code" }?.value?
.trimmingCharacters(in: .whitespacesAndNewlines)
?? ""
let extensionId =
let state =
queryItems.first { $0.name == "state" }?.value?
.trimmingCharacters(in: .whitespacesAndNewlines)
?? ""
guard !code.isEmpty, !extensionId.isEmpty else {
guard !code.isEmpty, !state.isEmpty else {
return nil
}
return ExtensionCallbackRoute(
code: code,
extensionId: extensionId,
state: state,
isSessionGrant: isSessionGrant
)
}