Bug: OAuth callback crashes on malformed `state` due to unhandled `decodeURIComponent` error

Open Beginner friendly
#1,284 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
82/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
typescript
Domain
api, authentication

Research direction

Start at CallbackEndpoint.ts:44, where the OAuth callback decodes the state parameter inside Promise.all. Reproduce the endpoint request with the malformed state value from the issue and trace the response path. Done means malformed state no longer causes an unhandled URIError and returns a controlled 400 callback response.

Written by the indexing model from the issue text.

Description

bug
Description

The OAuth callback endpoint decodes the state query parameter without guarding against invalid percent-encoding, which can throw a URIError and break the entire callback flow.

Code reference: CallbackEndpoint.ts:44

At that line, decodeURIComponent(state) is called directly inside Promise.all. If state contains malformed encoding (e.g., a trailing % or an invalid UTF-8 sequence), decodeURIComponent throws a URIError and the endpoint fails before building a safe callback response.

Steps to Reproduce
  1. Trigger the callback endpoint with a malformed state value:
    /api/apps/public/{appId}/callback?code=valid_code&state=%E0%A4%A
  2. Observe server logs and response.
  3. The request fails before token exchange handling completes.
Expected Behavior

The endpoint should handle malformed state safely and return a controlled callback response (e.g., 400 with a user-friendly error page), not crash/fail via an unhandled decode error.

Actual Behavior

Malformed state causes decodeURIComponent to throw, which interrupts request handling and breaks the OAuth callback flow.

Impact
  • Login flow can fail unexpectedly for users.
  • Crafted callback URLs can cause repeated endpoint failures.
Suggested Fix Direction
  • Wrap state decoding in a try/catch block:
let decodedState: string;
try {
 decodedState = decodeURIComponent(state);
} catch (e) {
 return context.sendJson({ error: 'Invalid state parameter' }, 400);
}
  • Validate origin/state before use.
  • Return a controlled error response when state is invalid.

Note: This issue was identified while reviewing the OAuth callback implementation. A fix would improve robustness against both accidental and crafted malformed callback URLs.

Dominant language
JavaScript
Stars
165
Forks
381
Avg merge
1d 2h
Merged PRs (30d)
1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from RocketChat/EmbeddedChat

All issues in RocketChat/EmbeddedChat

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.