Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Looking at the un-minified javascript from foursquare.com/oauth2/authenticate we've tracked down the bug. The problem code comes from the following function:</p> <pre><code>fourSq.auth.Autologin = { maybeFacebookAutologin: function () { window.fourSq.config.enableFacebookAutologin &amp;&amp; (!$.cookie("disableFacebookAutologin") &amp;&amp; !fourSq.api.models.companion.user.UserUtil.isLoggedIn()) &amp;&amp; fourSq.facebook.getFacebookApi(function (a) { a.getLoginStatus(function (b) { if (b === fourSq.facebook.FacebookApi.State.CONNECTED) { var c = (b = location.href.match(/[\?&amp;]continue=([^&amp;]+)/) || location.href.match(/https?:\/\/[^\/]+(.+)/)) ? b[1] : "/"; a.loginWithPermissions(void 0, function () { var a = fourSq.stats.Action.build(fourSq.stats.action.Action.AUTOLOGIN); fourSq.stats.logActionWithDelay(a, function () { $.cookie("disableFacebookAutologin", "1", { expires: 1, path: "/" }); fourSq.util.redirect("/facebook-login?continue\x3d" + c) }) }) } }) }) } }; </code></pre> <p>The problem line is</p> <p><code>fourSq.util.redirect("/facebook-login?continue\x3d" + c)</code> <strong>which does not escape c</strong>.</p> <p>This leads to a situation like this (simplified URL for the sake of exposition):</p> <p><code>http://foursquare.com/facebook-login?continue=/cool/beans?foo=bar&amp;baz=bam</code>.</p> <p>See the issue? All query parameters in the continue URL (except the first one) are instead intepreted as query parameters to /facebook-login! </p> <p>The correct code should be:</p> <pre><code>fourSq.util.redirect("/facebook-login?continue\x3d" + encodeURIComponent(c)) </code></pre> <p>Which will generate the correct output:</p> <p><a href="http://foursquare.com/facebook-login?continue=%2Fcool%2Fbeans%3Ffoo%3Dbar%26baz%3Dbam" rel="nofollow">http://foursquare.com/facebook-login?continue=%2Fcool%2Fbeans%3Ffoo%3Dbar%26baz%3Dbam</a></p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload