Merge pull request #14289 from mozilla/243-uplift-3

243.3 uplift

Author: biancadanforth

packages/fxa-content-server/app/scripts/views/mixins/third-party-auth-mixin.js

@@ -167,13 +167,25 @@ export default {
     // To finish the oauth flow, we will need to stash away the response from
     // Google (contains state and code) and redirect back to the original FxA login page.
     const searchParams = Url.searchParams(this.window.location.search);
-    Storage.factory('localStorage', this.window).set(
-      'fxa_third_party_params',
-      searchParams
-    );
-
     const redirectUrl = decodeURIComponent(searchParams.state);
-    this.navigateAway(redirectUrl);
+
+    try {
+      const url = new URL(redirectUrl);
+
+      if (url.origin === this.window.location.origin) {
+        Storage.factory('localStorage', this.window).set(
+          'fxa_third_party_params',
+          searchParams
+        );
+
+        this.navigateAway(redirectUrl);
+        return;
+      }
+    } catch (e) {
+      // noop. navigate to home below.
+    }
+
+    this.navigateAway('/');
   },
 
   async completeSignIn() {
@@ -190,7 +202,7 @@ export default {
         this.clearStoredParams();
 
         this.logFlowEvent(`${provider}.signin-complete`);
-        
+
         this.metrics.flush();
 
         return this.signIn(updatedAccount);

packages/fxa-content-server/app/tests/spec/views/mixins/third-party-auth-mixin.js

@@ -211,13 +211,31 @@ describe('views/mixins/third-party-auth-mixin', function () {
     assert.isTrue(mockForm.submit.calledOnce);
   });
 
-  it('handleOauthResponse', () => {
-    windowMock.location.search = '?state=localhost';
-    sinon.stub(view, 'navigateAway');
+  describe('handleOauthResponse', () => {
+    it('navigates away', () => {
+      const redirectUrl = encodeURIComponent(
+        `${windowMock.location.origin}/go/there`
+      );
+      windowMock.location.search = `?state=${redirectUrl}`;
+      sinon.stub(view, 'navigateAway');
+
+      view.handleOauthResponse();
 
-    view.handleOauthResponse();
+      assert.isTrue(
+        view.navigateAway.calledOnceWith(
+          `${windowMock.location.origin}/go/there`
+        )
+      );
+    });
 
-    assert.isTrue(view.navigateAway.calledOnceWith('localhost'));
+    it('navigates home', () => {
+      windowMock.location.search = '?state=quux';
+      sinon.stub(view, 'navigateAway');
+
+      view.handleOauthResponse();
+
+      assert.isTrue(view.navigateAway.calledOnceWith('/'));
+    });
   });
 
   it('completeSignIn', async () => {