nebius/SWE-rebench-V2-PRs huggingface dataset:
Repository: auth0/auth0.js
Pull request #620 (2018-01-02 15:09:46)

Do not consider a load event valid if protocol is "about:" (v8)
Fix for https://github.com/auth0/auth0.js/issues/601


Patch:
diff --git a/src/web-auth/silent-authentication-handler.js b/src/web-auth/silent-authentication-handler.js
index ff670b7..205c626 100644
--- a/src/web-auth/silent-authentication-handler.js
+++ b/src/web-auth/silent-authentication-handler.js
@@ -53,7 +53,12 @@ SilentAuthenticationHandler.prototype.getEventValidator = function() {
             eventData.event.data.type && eventData.event.data.type === _this.postMessageDataType
           );
 
-        case 'load': // Fall through to default
+        case 'load':
+          if (eventData.sourceObject.contentWindow.location.protocol === 'about:') {
+            // Chrome is automatically loading the about:blank page, we ignore this.
+            return false;
+          }
+        // Fall through to default
         default:
           return true;
       }


Test patch:
diff --git a/test/web-auth/silent-authentication-handler.test.js b/test/web-auth/silent-authentication-handler.test.js
index dc1bd48..a41c49b 100644
--- a/test/web-auth/silent-authentication-handler.test.js
+++ b/test/web-auth/silent-authentication-handler.test.js
@@ -182,6 +182,13 @@ describe('handlers silent-authentication-handler', function() {
         validator.isValid({
           event: {
             type: 'load'
+          },
+          sourceObject: {
+            contentWindow: {
+              location: {
+                protocol: 'https:'
+              }
+            }
           }
         })
       ).to.be(true);
@@ -252,7 +259,38 @@ describe('handlers silent-authentication-handler', function() {
       });
       var validator = sah.getEventValidator();
 
-      expect(validator.isValid({ event: { type: 'load' } })).to.be(true);
+      expect(validator.isValid({
+        event: {
+          type: 'load'
+        },
+        sourceObject: {
+          contentWindow: {
+            location: {
+              protocol: 'https:'
+            }
+          }
+        }
+      })).to.be(true);
+    });
+
+    it('should negatively validate load event types for "about:" protocol', function() {
+      var sah = new SilentAuthenticationHandler({
+        postMessageDataType: false
+      });
+      var validator = sah.getEventValidator();
+
+      expect(validator.isValid({
+          event: {
+            type: 'load'
+          },
+          sourceObject: {
+            contentWindow: {
+              location: {
+                protocol: 'about:'
+              }
+            }
+          }
+      })).to.be(false);
     });
   });
 });
Repository: auth0/auth0.js
Pull request #635 (2018-01-24 17:36:07)

Fix undefined origin in popup mode


Patch:
diff --git a/src/web-auth/popup.js b/src/web-auth/popup.js
index d9897fc..fffaca2 100644
--- a/src/web-auth/popup.js
+++ b/src/web-auth/popup.js
@@ -199,7 +199,7 @@ Popup.prototype.loginWithCredentials = function(options, cb) {
   options.realm = options.realm || options.connection;
   options.popup = true;
   options = objectHelper
-    .merge(this.baseOptions, ['responseType', 'state', 'nonce'])
+    .merge(this.baseOptions, ['redirectUri', 'responseType', 'state', 'nonce'])
     .with(objectHelper.blacklist(options, ['popupHandler', 'connection']));
   options = this.transactionManager.process(options);
   this.crossOriginAuthentication.login(options, cb);


Test patch:
diff --git a/test/web-auth/popup.test.js b/test/web-auth/popup.test.js
index 010af6e..8b0a514 100644
--- a/test/web-auth/popup.test.js
+++ b/test/web-auth/popup.test.js
@@ -208,6 +208,7 @@ describe('auth0.WebAuth.popup', function() {
         foo: 'bar',
         realm: 'realm',
         responseType: 'id_token',
+        redirectUri: 'http://page.com/callback',
         popup: true
       };
       stub(CrossOriginAuthentication.prototype, 'login', function(options, cb) {
@@ -514,7 +515,8 @@ describe('auth0.WebAuth.popup', function() {
         scope: 'openid',
         realm: 'the_connection',
         popup: true,
-        responseType: 'token'
+        responseType: 'token',
+        redirectUri: 'http://page.com/callback'
       };
       stub(TransactionManager.prototype, 'process', function(options) {
         delete options.popupHandler;
Repository: auth0/auth0.js
Pull request #638 (2018-01-26 15:43:58)

Fixing ie/edge issue


Patch:
diff --git a/src/helper/object.js b/src/helper/object.js
index 468f623..4151f68 100644
--- a/src/helper/object.js
+++ b/src/helper/object.js
@@ -125,7 +125,7 @@ function getOriginFromUrl(url) {
   var doc = windowHelper.getDocument();
   var anchor = doc.createElement('a');
   anchor.href = url;
-  return anchor.origin;
+  return anchor.protocol + '//' + anchor.hostname;
 }
 
 module.exports = {


Test patch:
diff --git a/test/helper/object.test.js b/test/helper/object.test.js
index 915405d..aa6d316 100644
--- a/test/helper/object.test.js
+++ b/test/helper/object.test.js
@@ -524,7 +524,8 @@ describe('helpers', function() {
     });
     it('should use an anchor to parse the url and return the origin', function() {
       var anchor = {
-        origin: 'https://test.com'
+        protocol: 'https:',
+        hostname: 'test.com'
       };
       stub(windowHelper, 'getDocument', function() {
         return {
Repository: auth0/auth0.js
Pull request #664 (2018-02-14 20:54:56)

Use webAuth.login when calling signupAndLogin to support Univeral Login Page
IN order to make `webauth.client.signupAndLogin` support the HLP, we need to make it sure that we call the `webauth.login` after the signup, since this method will pick the right endpoint to login


Patch:
diff --git a/src/web-auth/redirect.js b/src/web-auth/redirect.js
index 6a1230a..f51481a 100644
--- a/src/web-auth/redirect.js
+++ b/src/web-auth/redirect.js
@@ -2,8 +2,8 @@ var CrossOriginAuthentication = require('./cross-origin-authentication');
 var Warn = require('../helper/warn');
 
 function Redirect(auth0, options) {
+  this.webAuth = auth0;
   this.baseOptions = options;
-  this.client = auth0.client;
   this.crossOriginAuthentication = new CrossOriginAuthentication(auth0, this.baseOptions);
 
   this.warn = new Warn({
@@ -43,11 +43,13 @@ Redirect.prototype.loginWithCredentials = function(options, cb) {
  */
 Redirect.prototype.signupAndLogin = function(options, cb) {
   var _this = this;
-  return this.client.dbConnection.signup(options, function(err) {
+  return this.webAuth.client.dbConnection.signup(options, function(err) {
     if (err) {
       return cb(err);
     }
-    return _this.loginWithCredentials(options, cb);
+    options.realm = options.realm || options.connection;
+    delete options.connection;
+    return _this.webAuth.login(options, cb);
   });
 };
 


Test patch:
diff --git a/test/web-auth/redirect.test.js b/test/web-auth/redirect.test.js
index 4c29300..6c39790 100644
--- a/test/web-auth/redirect.test.js
+++ b/test/web-auth/redirect.test.js
@@ -164,7 +164,13 @@ describe('auth0.WebAuth.redirect', function() {
           }
         });
       });
-      stub(this.auth0.redirect, 'loginWithCredentials', function(options, cb) {
+      stub(this.auth0, 'login', function(options, cb) {
+        expect(options).to.be.eql({
+          email: 'me@example.com',
+          password: '123456',
+          scope: 'openid',
+          realm: 'the_connection'
+        });
         done();
       });
Repository: auth0/auth0.js
Pull request #667 (2018-02-15 01:43:11)

Fix inconsistent cross origin error handling
We weren't applying the error mapping that we do in other errors.


Patch:
diff --git a/src/web-auth/cross-origin-authentication.js b/src/web-auth/cross-origin-authentication.js
index 4f04e60..4e540d9 100644
--- a/src/web-auth/cross-origin-authentication.js
+++ b/src/web-auth/cross-origin-authentication.js
@@ -4,6 +4,7 @@ var windowHelper = require('../helper/window');
 var objectHelper = require('../helper/object');
 var RequestBuilder = require('../helper/request-builder');
 var WebMessageHandler = require('./web-message-handler');
+var responseHandler = require('../helper/response-handler');
 
 function CrossOriginAuthentication(webAuth, options) {
   this.webAuth = webAuth;
@@ -70,7 +71,7 @@ CrossOriginAuthentication.prototype.login = function(options, cb) {
         error: 'request_error',
         error_description: JSON.stringify(err)
       };
-      return cb(errorObject);
+      return responseHandler(cb)(errorObject);
     }
     var popupMode = options.popup === true;
     options = objectHelper.blacklist(options, ['password', 'credentialType', 'otp', 'popup']);


Test patch:
diff --git a/test/web-auth/cross-origin-authentication.test.js b/test/web-auth/cross-origin-authentication.test.js
index 227f873..6a67d1c 100644
--- a/test/web-auth/cross-origin-authentication.test.js
+++ b/test/web-auth/cross-origin-authentication.test.js
@@ -252,7 +252,7 @@ describe('auth0.WebAuth.crossOriginAuthentication', function() {
                   response: {
                     body: {
                       error: 'any_error',
-                      error_description: 'any error'
+                      error_description: 'a super big error message description'
                     }
                   }
                 });
@@ -267,7 +267,11 @@ describe('auth0.WebAuth.crossOriginAuthentication', function() {
               anotherOption: 'foobar'
             },
             function(err) {
-              expect(err).to.be.eql({ error: 'any_error', error_description: 'any error' });
+              expect(err).to.be.eql({
+                original: { error: 'any_error', error_description: 'a super big error message description' },
+                code: 'any_error',
+                description: 'a super big error message description'
+              });
               expect(_this.webAuthSpy.authorize.called).to.be.eql(false);
               done();
             }
@@ -300,8 +304,12 @@ describe('auth0.WebAuth.crossOriginAuthentication', function() {
             },
             function(err) {
               expect(err).to.be.eql({
-                error: 'request_error',
-                error_description: '{"some":"error"}'
+                original: {
+                  error: 'request_error',
+                  error_description: '{"some":"error"}'
+                },
+                code: 'request_error',
+                description: '{"some":"error"}'
               });
               expect(_this.webAuthSpy.authorize.called).to.be.eql(false);
               done();
Repository: auth0/auth0.js
Pull request #692 (2018-03-03 16:18:03)

Remove `email` param in cross auth login
fix https://github.com/auth0/auth0.js/issues/691


Patch:
diff --git a/src/web-auth/cross-origin-authentication.js b/src/web-auth/cross-origin-authentication.js
index 974684c..99a0de7 100644
--- a/src/web-auth/cross-origin-authentication.js
+++ b/src/web-auth/cross-origin-authentication.js
@@ -43,9 +43,12 @@ CrossOriginAuthentication.prototype.login = function(options, cb) {
   var _this = this;
   var theWindow = windowHelper.getWindow();
   var url = urljoin(this.baseOptions.rootUrl, '/co/authenticate');
+  options.username = options.username || options.email;
+  delete options.email;
+
   var authenticateBody = {
     client_id: options.clientID || this.baseOptions.clientID,
-    username: options.username || options.email
+    username: options.username
   };
   if (options.password) {
     authenticateBody.password = options.password;


Test patch:
diff --git a/test/web-auth/cross-origin-authentication.test.js b/test/web-auth/cross-origin-authentication.test.js
index 17d7ed2..93e7ba9 100644
--- a/test/web-auth/cross-origin-authentication.test.js
+++ b/test/web-auth/cross-origin-authentication.test.js
@@ -44,7 +44,7 @@ describe('auth0.WebAuth.crossOriginAuthentication', function() {
         storage.setItem.restore();
       }
     });
-    it('should call /co/authenticate and redirect to /authorize with login_ticket', function() {
+    it('should call /co/authenticate and redirect to /authorize with login_ticket using `username`', function() {
       stub(request, 'post', function(url) {
         expect(url).to.be('https://me.auth0.com/co/authenticate');
         return new RequestMock({
@@ -79,6 +79,41 @@ describe('auth0.WebAuth.crossOriginAuthentication', function() {
         anotherOption: 'foobar'
       });
     });
+    it('should call /co/authenticate and redirect to /authorize with login_ticket using `email`', function() {
+      stub(request, 'post', function(url) {
+        expect(url).to.be('https://me.auth0.com/co/authenticate');
+        return new RequestMock({
+          body: {
+            client_id: '...',
+            credential_type: 'password',
+            username: 'me@example.com',
+            password: '123456'
+          },
+          headers: {
+            'Content-Type': 'application/json'
+          },
+          cb: function(cb) {
+            cb(null, {
+              body: {
+                login_ticket: 'a_login_ticket',
+                co_verifier: 'co_verifier',
+                co_id: 'co_id'
+              }
+            });
+          }
+        });
+      });
+      this.co.login({
+        email: 'me@example.com',
+        password: '123456',
+        anotherOption: 'foobar'
+      });
+      expect(this.webAuthSpy.authorize.getCall(0).args[0]).to.be.eql({
+        username: 'me@example.com',
+        loginTicket: 'a_login_ticket',
+        anotherOption: 'foobar'
+      });
+    });
     it('should call /co/authenticate and call `webMessageHandler.run` when popup:true', function(
       done
     ) {
Repository: auth0/auth0.js
Pull request #784 (2018-06-28 11:35:41)

Handle remove child error
Added a tiny verification for the parent node since some customers where seeing errors in which the node didn't exist.

ex.
The following line of code emit multiple errors at different situations:
`_window.document.body.removeChild(_this.iframe);`

The errors include:
Failed to execute 'removeChild' on 'Node': The node to be removed is not a child of this node.
The object can not be found here.
Node was not found


The error message is:
`Cannot read property 'body' of undefined``

ZENDESK Ticket: https://auth0.zendesk.com/agent/tickets/43507

luisrudge: Can you please write a test for this? Thanks!

Patch:
diff --git a/src/helper/iframe-handler.js b/src/helper/iframe-handler.js
index 98beb63..5dd570b 100644
--- a/src/helper/iframe-handler.js
+++ b/src/helper/iframe-handler.js
@@ -77,7 +77,6 @@ IframeHandler.prototype.timeoutHandler = function() {
 
 IframeHandler.prototype.destroy = function() {
   var _this = this;
-  var _window = windowHelper.getWindow();
 
   clearTimeout(this.timeoutHandle);
 
@@ -87,7 +86,10 @@ IframeHandler.prototype.destroy = function() {
       _this.proxyEventListener,
       false
     );
-    _window.document.body.removeChild(_this.iframe);
+
+    if (_this.iframe.parentNode) {
+      _this.iframe.parentNode.removeChild(_this.iframe);
+    }
   }, 0);
 };
 


Test patch:
diff --git a/test/helper/iframe-handler.test.js b/test/helper/iframe-handler.test.js
index 3c42875..64783ef 100644
--- a/test/helper/iframe-handler.test.js
+++ b/test/helper/iframe-handler.test.js
@@ -87,11 +87,6 @@ function stubWindow(eventType, data) {
         return iFrame;
       },
       body: {
-        removeChild: function(ele) {
-          expect(ele.id).to.be(iFrame.id);
-          expect(fauxWindow.mockObjectStore.iframe).to.be(iFrame);
-          fauxWindow.mockObjectStore.iframe = null;
-        },
         appendChild: function(ele) {
           expect(fauxWindow.mockObjectStore.iframe).to.be(null);
           expect(ele.id).to.be(iFrame.id);
@@ -278,7 +273,6 @@ describe('helpers iframeHandler', function() {
       setTimeout(function() {
         expect(callbackCalled).to.eql(true);
         expect(windowHelper.getWindow().eventListeners['message'].length).to.be(0);
-        expect(windowHelper.getWindow().mockObjectStore.iframe).to.be(null);
 
         done();
       }, 200);
@@ -351,5 +345,25 @@ describe('helpers iframeHandler', function() {
         done();
       }
     });
+
+    it('destroy() should call parentNode.removeChild when available', function(done) {
+      var iframe = stubWindow('message');
+      iframe.assimilate({
+        parentNode: {
+          removeChild: function() {
+            done();
+          }
+        }
+      });
+
+      var iframeHandler = new IframeHandler({
+        eventListenerType: 'message',
+        timeout: 1,
+        timeoutCallback: function() {},
+        callback: function() {}
+      });
+
+      iframeHandler.init();
+    });
   });
 });
Repository: auth0/auth0.js
Pull request #829 (2018-09-27 19:36:26)

Fix incorrect error wrapping for signup/change password errors
fix https://github.com/auth0/auth0.js/issues/826


Patch:
diff --git a/src/helper/response-handler.js b/src/helper/response-handler.js
index 9f3fc66..2317005 100644
--- a/src/helper/response-handler.js
+++ b/src/helper/response-handler.js
@@ -42,7 +42,8 @@ function wrapCallback(cb, options) {
       if (err.err) {
         err = err.err;
       }
-      errObj.code = err.error || err.code || err.error_code || err.status || null;
+
+      errObj.code = err.code || err.error || err.error_code || err.status || null;
       errObj.description =
         err.errorDescription ||
         err.error_description ||


Test patch:
diff --git a/test/helper/response-handler.test.js b/test/helper/response-handler.test.js
index d0d0d76..8aa31ab 100644
--- a/test/helper/response-handler.test.js
+++ b/test/helper/response-handler.test.js
@@ -131,6 +131,25 @@ describe('helpers responseHandler', function() {
     })(null, assert_err);
   });
 
+  it('should return normalized format 6', function(done) {
+    var assert_err = {};
+    assert_err.response = {};
+    assert_err.response.body = {
+      code: 'the_error_code',
+      error: 'The error description.'
+    };
+
+    responseHandler(function(err, data) {
+      expect(data).to.be(undefined);
+      expect(err).to.eql({
+        original: assert_err,
+        code: 'the_error_code',
+        description: 'The error description.'
+      });
+      done();
+    })(assert_err, null);
+  });
+
   it('should return the data', function(done) {
     var assert_data = {
       body: {
Repository: auth0/auth0.js
Pull request #835 (2018-10-05 15:31:49)

fix(TransactionManager): Set state to expire in 30 mins
Passed `expires` option does not override the default value.
I'd like to ask is it okay to store nonce for 30 mins? IMO, a very short time around 5 mins is enough.

sayuti-daniel: This has been introduced since `9.5.0` :smile: I'm curious to know why the cookie state is not removed instead of using expiration time. Do you mind explaining this? Thanks! :beers: 

Patch:
diff --git a/src/web-auth/transaction-manager.js b/src/web-auth/transaction-manager.js
index 0a3b18b..855ba71 100644
--- a/src/web-auth/transaction-manager.js
+++ b/src/web-auth/transaction-manager.js
@@ -54,7 +54,7 @@ TransactionManager.prototype.generateTransaction = function(
       state: state,
       lastUsedConnection: lastUsedConnection
     },
-    times.MINUTES_30
+    { expires: times.MINUTES_30 }
   );
   return {
     state: state,


Test patch:
diff --git a/test/web-auth/transaction-manager.test.js b/test/web-auth/transaction-manager.test.js
index 9c6b632..5f3834f 100644
--- a/test/web-auth/transaction-manager.test.js
+++ b/test/web-auth/transaction-manager.test.js
@@ -4,6 +4,7 @@ import { stub, spy } from 'sinon';
 import TransactionManager from '../../src/web-auth/transaction-manager';
 import random from '../../src/helper/random';
 import Storage from '../../src/helper/storage';
+import * as times from '../../src/helper/times';
 
 context('TransactionManager', function() {
   beforeEach(function() {
@@ -130,6 +131,12 @@ context('TransactionManager', function() {
         lastUsedConnection: 'lastUsedConnection'
       });
     });
+    it('stores state with expires option equal to 30 mins', function() {
+      this.tm.generateTransaction('appState', 'state', 'nonce', null);
+      expect(Storage.prototype.setItem.calledOnce).to.be(true);
+      expect(typeof Storage.prototype.setItem.lastCall.args[2]).to.be('object');
+      expect(Storage.prototype.setItem.lastCall.args[2]).to.be.eql({ expires: times.MINUTES_30 });
+    });
   });
   context('getStoredTransaction', function() {
     beforeEach(function() {
Repository: auth0/auth0.js
Pull request #851 (2018-10-24 03:53:45)

#847
Fix for issue #847 

ojas360: unexpected changes by ide.. reverted them

luisrudge: @ojas360 thanks! let's fix the check and add a test and I'll merge it! Thanks 🎉 
luisrudge: Thanks @ojas360 🎉 

Patch:
diff --git a/src/web-auth/index.js b/src/web-auth/index.js
index 8520afa..4438e25 100644
--- a/src/web-auth/index.js
+++ b/src/web-auth/index.js
@@ -437,7 +437,6 @@ WebAuth.prototype.renewAuth = function(options, cb) {
  *
  * @method checkSession
  * @param {Object} [options]
-
  * @param {String} [options.clientID] the Client ID found on your Application settings page
  * @param {String} [options.responseType] type of the response used by OAuth 2.0 flow. It can be any space separated list of the values `code`, `token`, `id_token`. {@link https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html}
  * @param {String} [options.state] value used to mitigate XSRF attacks. {@link https://auth0.com/docs/protocols/oauth2/oauth-state}
@@ -469,6 +468,10 @@ WebAuth.prototype.checkSession = function(options, cb) {
     params = this.transactionManager.process(params);
   }
 
+  if (!params.redirectUri) {
+    return cb({ error: 'error', error_description: "redirectUri can't be empty" });
+  }
+
   assert.check(params, { type: 'object', message: 'options parameter is not valid' });
   assert.check(cb, { type: 'function', message: 'cb parameter is not valid' });
 
@@ -791,4 +794,4 @@ WebAuth.prototype.passwordlessVerify = function(options, cb) {
   });
 };
 
-export default WebAuth;
+export default WebAuth;
\ No newline at end of file


Test patch:
diff --git a/test/web-auth/web-auth.test.js b/test/web-auth/web-auth.test.js
index 6202297..76d885a 100644
--- a/test/web-auth/web-auth.test.js
+++ b/test/web-auth/web-auth.test.js
@@ -2352,6 +2352,13 @@ describe('auth0.WebAuth', function() {
           error_description: "responseType can't be `code`"
         });
       });
+    });it('throws an error if redirectUri is empty', function() {
+      this.auth0.checkSession({ redirectUri: '' }, function(err) {
+        expect(err).to.be.eql({
+          error: 'error',
+          error_description: "redirectUri can't be empty"
+        });
+      });
     });
     it('does not throw an origin_mismatch error if redirectUri is empty', function() {
       objectHelper.getOriginFromUrl.restore();
@@ -2562,4 +2569,4 @@ describe('auth0.WebAuth', function() {
       webAuth.validateToken('token', 'nonce', function() {});
     });
   });
-});
+});
\ No newline at end of file