Harden auth storage and sign-in guards#23
Conversation
Keep GitHub sign-in data in session storage instead of persisting it to local extension storage, and clear legacy auth data on access. Add a stricter device-flow URL check before opening GitHub tabs, restore avatar URL sanitization in the optimized renderer, and tighten the extension CSP to match the allowed image sources. Update tests and user-facing security copy to reflect the new session- only auth behavior.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the security and privacy of GitHub authentication within the extension. By transitioning to session-only storage for authentication tokens and implementing robust URL validation, the risk of persistent token exposure and malicious redirects is mitigated. Additionally, stricter content security policies and image sanitization further harden the extension against potential vulnerabilities, providing users with a more secure experience. Highlights
Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces significant security enhancements by moving the GitHub authentication session from persistent local storage to session-only storage, which is a great improvement. The changes include removing the now-obsolete encryption utilities and adding logic to clear legacy storage keys. I appreciate the additional hardening, such as validating the device-flow URL to prevent open redirects and tightening the Content Security Policy for images. The code is well-structured, and the tests have been updated to cover the new functionality. I have one suggestion to improve the robustness of the new storage helper function.
| return new Promise((resolve) => { | ||
| chrome.storage.local.remove(LEGACY_AUTH_STORAGE_KEYS, () => { | ||
| legacyAuthStorageChecked = true; | ||
| resolve(); | ||
| }); | ||
| }); |
There was a problem hiding this comment.
For consistency with other storage helpers in this file (e.g., getLocalItem, setLocalItem), it's good practice to check for chrome.runtime.lastError in the callback and reject the promise if an error occurs. This ensures that storage operation failures are propagated and can be handled by the caller.
return new Promise((resolve, reject) => {
chrome.storage.local.remove(LEGACY_AUTH_STORAGE_KEYS, () => {
if (chrome.runtime?.lastError) {
return reject(new Error(chrome.runtime.lastError.message));
}
legacyAuthStorageChecked = true;
resolve();
});
});1 participant
Summary
Testing
Notes