diff --git a/lib/web/auth/oauth2/index.js b/lib/web/auth/oauth2/index.js index 2cdcc3499..b96fd1aea 100644 --- a/lib/web/auth/oauth2/index.js +++ b/lib/web/auth/oauth2/index.js @@ -20,7 +20,7 @@ class OAuth2CustomStrategy extends Strategy { userProfile (accessToken, done) { this._oauth2.get(this._userProfileURL, accessToken, function (err, body, res) { - let json + let json, profile if (err) { return done(new InternalOAuthError('Failed to fetch user profile', err)) @@ -33,7 +33,11 @@ class OAuth2CustomStrategy extends Strategy { } checkAuthorization(json, done) - const profile = parseProfile(json) + try { + profile = parseProfile(json) + } catch (ex) { + return done('Failed to identify user profile information', null) + } profile.provider = 'oauth2' done(null, profile) @@ -97,7 +101,7 @@ function checkAuthorization (data, done) { OAuth2CustomStrategy.prototype.userProfile = function (accessToken, done) { this._oauth2.get(this._userProfileURL, accessToken, function (err, body, res) { - let json + let json, profile if (err) { return done(new InternalOAuthError('Failed to fetch user profile', err)) @@ -110,7 +114,11 @@ OAuth2CustomStrategy.prototype.userProfile = function (accessToken, done) { } checkAuthorization(json, done) - const profile = parseProfile(json) + try { + profile = parseProfile(json) + } catch (ex) { + return done('Failed to identify user profile information', null) + } profile.provider = 'oauth2' done(null, profile) diff --git a/public/docs/release-notes.md b/public/docs/release-notes.md index b3acff839..38d1307a1 100644 --- a/public/docs/release-notes.md +++ b/public/docs/release-notes.md @@ -1,5 +1,10 @@ # Release Notes +## 1.x.x UNRELEASED + +### Bugfixes +- Fix a crash when cannot read user profile in Oauth + ## 1.10.0 2024-09-01 This release fixes a security issue when using MySQL/MariaDB. We recommend upgrading as soon as possible, when you use diff --git a/yarn.lock b/yarn.lock index c83f096ea..faa8c0c0c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2938,26 +2938,6 @@ __metadata: languageName: node linkType: hard -"body-parser@npm:1.20.2": - version: 1.20.2 - resolution: "body-parser@npm:1.20.2" - dependencies: - bytes: "npm:3.1.2" - content-type: "npm:~1.0.5" - debug: "npm:2.6.9" - depd: "npm:2.0.0" - destroy: "npm:1.2.0" - http-errors: "npm:2.0.0" - iconv-lite: "npm:0.4.24" - on-finished: "npm:2.4.1" - qs: "npm:6.11.0" - raw-body: "npm:2.5.2" - type-is: "npm:~1.6.18" - unpipe: "npm:1.0.0" - checksum: 10/3cf171b82190cf91495c262b073e425fc0d9e25cc2bf4540d43f7e7bbca27d6a9eae65ca367b6ef3993eea261159d9d2ab37ce444e8979323952e12eb3df319a - languageName: node - linkType: hard - "body-parser@npm:1.20.3": version: 1.20.3 resolution: "body-parser@npm:1.20.3"