s434730/RandomSec
3
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Use state to keep redirect URI constant

Browse Source
This commit is contained in:
Antonin Delpeuch 2019-12-31 10:21:07 +01:00
parent fe5871bd51
commit 6dc79d965d
3 changed files with 20 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
extensions/gdata/module/MOD-INF/controller.js
View File

@ -102,8 +102,7 @@ function process(path, request, response) {
send(request, response, "authorize.vt", context); send(request, response, "authorize.vt", context);
} else if (path == "authorized") { } else if (path == "authorized") {
var context = {}; var context = {};
context.winname = request.getParameter("winname"); context.state = request.getParameter("state");
context.callback = request.getParameter("cb");
(function() { (function() {
var tokenAndExpiresInSeconds = Packages.com.google.refine.extension.gdata.GoogleAPIExtension.getTokenFromCode(module,request); var tokenAndExpiresInSeconds = Packages.com.google.refine.extension.gdata.GoogleAPIExtension.getTokenFromCode(module,request);

6
extensions/gdata/module/authorized.vt
View File

@ -40,8 +40,10 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
<span id="gdata-authorized"></span> <span id="gdata-authorized"></span>
<script> <script>
var windowName = "$winname"; var state = JSON.parse(window.atob("$state"));
var callbackName = "$callback";
var windowName = state.winname;
var callbackName = state.cb;
var w = window.open("", windowName); var w = window.open("", windowName);
var callback = w[callbackName]; var callback = w[callbackName];

22
extensions/gdata/src/com/google/refine/extension/gdata/GoogleAPIExtension.java
View File

@ -4,6 +4,7 @@ import java.io.IOException;
import java.net.MalformedURLException; import java.net.MalformedURLException;
import java.net.URL; import java.net.URL;
import java.util.Arrays; import java.util.Arrays;
import java.util.Base64;
import java.util.regex.Matcher; import java.util.regex.Matcher;
import java.util.regex.Pattern; import java.util.regex.Pattern;
@ -26,14 +27,13 @@ import com.google.api.services.sheets.v4.Sheets;
import com.google.api.services.sheets.v4.SheetsScopes; import com.google.api.services.sheets.v4.SheetsScopes;
import com.google.refine.ProjectManager; import com.google.refine.ProjectManager;
import com.google.refine.preference.PreferenceStore; import com.google.refine.preference.PreferenceStore;
import com.google.refine.util.ParsingUtilities;
import edu.mit.simile.butterfly.ButterflyModule; import edu.mit.simile.butterfly.ButterflyModule;
abstract public class GoogleAPIExtension { abstract public class GoogleAPIExtension {
protected static final String SERVICE_APP_NAME = "OpenRefine-Google-Service"; protected static final String SERVICE_APP_NAME = "OpenRefine-Google-Service";
private static final String CLIENT_ID = "455686949425-d237cmorii0ge8if7it5r1qijce6caf0.apps.googleusercontent.com"; private static final String CLIENT_ID = "";
private static final String CLIENT_SECRET = "wm5qVtjp3VDfuAx2P2qm6GJb"; private static final String CLIENT_SECRET = "";
/** Global instance of the HTTP transport. */ /** Global instance of the HTTP transport. */
protected static final HttpTransport HTTP_TRANSPORT = new NetHttpTransport(); protected static final HttpTransport HTTP_TRANSPORT = new NetHttpTransport();
@ -53,24 +53,30 @@ abstract public class GoogleAPIExtension {
static public String getAuthorizationUrl(ButterflyModule module, HttpServletRequest request) static public String getAuthorizationUrl(ButterflyModule module, HttpServletRequest request)
throws MalformedURLException { throws MalformedURLException {
String authorizedUrl = makeRedirectUrl(module, request); String authorizedUrl = makeRedirectUrl(module, request);
String state = makeState(module, request);
GoogleAuthorizationCodeRequestUrl url = new GoogleAuthorizationCodeRequestUrl( GoogleAuthorizationCodeRequestUrl url = new GoogleAuthorizationCodeRequestUrl(
CLIENT_ID, CLIENT_ID,
authorizedUrl, // execution continues at authorized on redirect authorizedUrl, // execution continues at authorized on redirect
Arrays.asList(SCOPES)); Arrays.asList(SCOPES));
url.setState(state);
return url.toString(); return url.toString();
} }
private static String makeState(ButterflyModule module, HttpServletRequest request) {
String winname = request.getParameter("winname");
String cb = request.getParameter("cb");
String json = "{\"winname\":\""+winname.replaceAll("\"", "\\\"")
+"\",\"cb\":\""+cb.replaceAll("\"", "\\\"")+"\"}";
return new String(Base64.getEncoder().encode(json.getBytes()));
}
private static String makeRedirectUrl(ButterflyModule module, HttpServletRequest request) private static String makeRedirectUrl(ButterflyModule module, HttpServletRequest request)
throws MalformedURLException { throws MalformedURLException {
StringBuffer sb = new StringBuffer(module.getMountPoint().getMountPoint()); StringBuffer sb = new StringBuffer(module.getMountPoint().getMountPoint());
sb.append("authorized?winname="); sb.append("authorized");
sb.append(ParsingUtilities.encode(request.getParameter("winname")));
sb.append("&cb=");
sb.append(ParsingUtilities.encode(request.getParameter("cb")));
URL thisUrl = new URL(request.getRequestURL().toString()); URL thisUrl = new URL(request.getRequestURL().toString());
URL authorizedUrl = new URL(thisUrl, sb.toString()); URL authorizedUrl = new URL(thisUrl, sb.toString());