Merge pull request #36585 from nextcloud/backport/36552/stable25

[stable25] fix(client-login-flow): Handle missing stateToken gracefully

Author: MichaIng

core/Controller/ClientFlowLoginV2Controller.php

@@ -149,7 +149,10 @@ public function showAuthPickerPage($user = ''): StandaloneTemplateResponse {
 	 * @NoCSRFRequired
 	 * @NoSameSiteCookieRequired
 	 */
-	public function grantPage(string $stateToken): StandaloneTemplateResponse {
+	public function grantPage(?string $stateToken): StandaloneTemplateResponse {
+		if ($stateToken === null) {
+			return $this->stateTokenMissingResponse();
+		}
 		if (!$this->isValidStateToken($stateToken)) {
 			return $this->stateTokenForbiddenResponse();
 		}
@@ -181,7 +184,11 @@ public function grantPage(string $stateToken): StandaloneTemplateResponse {
 	/**
 	 * @PublicPage
 	 */
-	public function apptokenRedirect(string $stateToken, string $user, string $password) {
+	public function apptokenRedirect(?string $stateToken, string $user, string $password) {
+		if ($stateToken === null) {
+			return $this->stateTokenMissingResponse();
+		}
+
 		if (!$this->isValidStateToken($stateToken)) {
 			return $this->stateTokenForbiddenResponse();
 		}
@@ -224,7 +231,10 @@ public function apptokenRedirect(string $stateToken, string $user, string $passw
 	 * @NoAdminRequired
 	 * @UseSession
 	 */
-	public function generateAppPassword(string $stateToken): Response {
+	public function generateAppPassword(?string $stateToken): Response {
+		if ($stateToken === null) {
+			return $this->stateTokenMissingResponse();
+		}
 		if (!$this->isValidStateToken($stateToken)) {
 			return $this->stateTokenForbiddenResponse();
 		}
@@ -297,6 +307,19 @@ private function isValidStateToken(string $stateToken): bool {
 		return hash_equals($currentToken, $stateToken);
 	}
 
+	private function stateTokenMissingResponse(): StandaloneTemplateResponse {
+		$response = new StandaloneTemplateResponse(
+			$this->appName,
+			'403',
+			[
+				'message' => $this->l10n->t('State token missing'),
+			],
+			'guest'
+		);
+		$response->setStatus(Http::STATUS_FORBIDDEN);
+		return $response;
+	}
+
 	private function stateTokenForbiddenResponse(): StandaloneTemplateResponse {
 		$response = new StandaloneTemplateResponse(
 			$this->appName,

tests/Core/Controller/ClientFlowLoginV2ControllerTest.php

@@ -188,6 +188,12 @@ public function testShowAuthPickerValidLoginToken() {
 		$this->controller->showAuthPickerPage();
 	}
 
+	public function testGrantPageNoStateToken(): void {
+		$result = $this->controller->grantPage(null);
+
+		$this->assertSame(Http::STATUS_FORBIDDEN, $result->getStatus());
+	}
+
 	public function testGrantPageInvalidStateToken() {
 		$this->session->method('get')
 			->willReturnCallback(function ($name) {