Repository: auth0/auth0.js (js)

Issue:
Uncaught exception in WebMessageHandler's eventValidator when event.data is null
### Describe the problem

In https://github.com/auth0/auth0.js/blob/master/src/web-auth/web-message-handler.js#L17 there's a check for the `event_type` as `eventData.event.data.type`, but in the case that the event doesn't contain a `data` property, this throws an uncaught exception.

This seems to happen at least with the Google Tag Manager module of Cookiebot, whose event ends up in the validator of auth0-js. This event doesn't contain a `data` property, which makes the validator throw. 

### What was the expected behavior?

The exception should be handled gracefully in case the validated event doesn't contain a `data` property.

### Environment

- **Version of Auth0.js used:** 9.14.2
- **Which browsers have you tested in?** Chrome 87.0.4280.141, Firefox 84.0.2
- **Other modules/plugins/libraries that might be involved:** Cookiebot GTM (Google Tag Manager) module


Pull request:
Add check around accessing event.data in web-message-handler
### References

Fixes #1154

### Testing

Please describe how this can be tested by reviewers. Be specific about anything not tested and reasons why. If this library has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors.

- [X] This change adds unit test coverage
- [ ] This change adds integration test coverage

### Checklist

- [X] I have read the [Auth0 general contribution guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md)
- [X] I have read the [Auth0 Code of Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md)
- [X] All tests and linters described in the [Develop section](https://github.com/auth0/auth0.js#develop) run without errors


Patch:
diff --git a/src/web-auth/web-message-handler.js b/src/web-auth/web-message-handler.js
index 783a5ed..bafb0b9 100644
--- a/src/web-auth/web-message-handler.js
+++ b/src/web-auth/web-message-handler.js
@@ -13,7 +13,8 @@ function runWebMessageFlow(authorizeUrl, options, callback) {
     timeout: options.timeout,
     eventValidator: {
       isValid: function(eventData) {
-        return (
+        return !!(
+          eventData.event.data &&
           eventData.event.data.type === 'authorization_response' &&
           options.state === eventData.event.data.response.state
         );


Test patch:
diff --git a/test/web-auth/web-auth.test.js b/test/web-auth/web-auth.test.js
index 0a90cf2..37df2b7 100644
--- a/test/web-auth/web-auth.test.js
+++ b/test/web-auth/web-auth.test.js
@@ -2976,6 +2976,13 @@ describe('auth0.WebAuth', function() {
       });
       this.auth0.checkSession({ state: '123' }, function(err, data) {});
     });
+    it('eventValidator gracefully handles null data object', function(done) {
+      sinon.stub(IframeHandler.prototype, 'init').callsFake(function() {
+        expect(this.eventValidator.isValid({ event: {} })).to.be(false);
+        done();
+      });
+      this.auth0.checkSession({ state: '123' }, function() {});
+    });
     it('timeoutCallback calls callback with error response', function(done) {
       sinon.stub(IframeHandler.prototype, 'init').callsFake(function() {
         this.timeoutCallback();