StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>Looking at the un-minified javascript from foursquare.com/oauth2/authenticate we've tracked down the bug. The problem code comes from the following function:</p> <pre><code>fourSq.auth.Autologin = { maybeFacebookAutologin: function () { window.fourSq.config.enableFacebookAutologin && (!$.cookie("disableFacebookAutologin") && !fourSq.api.models.companion.user.UserUtil.isLoggedIn()) && fourSq.facebook.getFacebookApi(function (a) { a.getLoginStatus(function (b) { if (b === fourSq.facebook.FacebookApi.State.CONNECTED) { var c = (b = location.href.match(/[\?&]continue=([^&]+)/) || location.href.match(/https?:\/\/[^\/]+(.+)/)) ? b[1] : "/"; a.loginWithPermissions(void 0, function () { var a = fourSq.stats.Action.build(fourSq.stats.action.Action.AUTOLOGIN); fourSq.stats.logActionWithDelay(a, function () { $.cookie("disableFacebookAutologin", "1", { expires: 1, path: "/" }); fourSq.util.redirect("/facebook-login?continue\x3d" + c) }) }) } }) }) } }; </code></pre> <p>The problem line is</p> <p><code>fourSq.util.redirect("/facebook-login?continue\x3d" + c)</code> <strong>which does not escape c</strong>.</p> <p>This leads to a situation like this (simplified URL for the sake of exposition):</p> <p><code>http://foursquare.com/facebook-login?continue=/cool/beans?foo=bar&baz=bam</code>.</p> <p>See the issue? All query parameters in the continue URL (except the first one) are instead intepreted as query parameters to /facebook-login! </p> <p>The correct code should be:</p> <pre><code>fourSq.util.redirect("/facebook-login?continue\x3d" + encodeURIComponent(c)) </code></pre> <p>Which will generate the correct output:</p> <p><a href="http://foursquare.com/facebook-login?continue=%2Fcool%2Fbeans%3Ffoo%3Dbar%26baz%3Dbam" rel="nofollow">http://foursquare.com/facebook-login?continue=%2Fcool%2Fbeans%3Ffoo%3Dbar%26baz%3Dbam</a></p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload