Skip to content

fix: prevent OAuth callback error XSS - #5

Merged
mstuart merged 1 commit into
mainfrom
fix/oauth-callback-xss
Aug 23, 2026
Merged

fix: prevent OAuth callback error XSS#5
mstuart merged 1 commit into
mainfrom
fix/oauth-callback-xss

Conversation

@mstuart

@mstuart mstuart commented Aug 23, 2026

Copy link
Copy Markdown
Owner

Summary

  • stop reflecting provider-controlled OAuth error text into the loopback HTML response
  • preserve the provider error detail in the terminal-side VitalsError
  • cover malicious markup and a legitimate authorization-code callback

Verification

  • npm run check
  • npm run typecheck
  • npm test (230 tests)
  • npm run build
  • packed tarball install plus vitals --help
  • packaged callback rejected URL-encoded script markup without rendering it

@mstuart
mstuart merged commit a04db6d into main Aug 23, 2026
5 checks passed
@mstuart
mstuart deleted the fix/oauth-callback-xss branch August 23, 2026 06:46
mstuart added a commit that referenced this pull request Aug 24, 2026
Co-authored-by: Mark Stuart <mstuart@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant