Avoid saving FXA login sessions (#3190)

MozillaReality · Apr 20, 2020 · d9a7eec · d9a7eec
1 parent 0192ce9
commit d9a7eec
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 7 deletions.
diff --git a/app/src/common/shared/org/mozilla/vrbrowser/browser/Services.kt b/app/src/common/shared/org/mozilla/vrbrowser/browser/Services.kt
@@ -30,8 +30,8 @@ import org.mozilla.geckoview.GeckoResult
 import org.mozilla.geckoview.GeckoSession
 import org.mozilla.vrbrowser.R
 import org.mozilla.vrbrowser.browser.engine.EngineProvider
-import org.mozilla.vrbrowser.utils.SystemUtils
 import org.mozilla.vrbrowser.telemetry.GleanMetricsService
+import org.mozilla.vrbrowser.utils.SystemUtils
 
 
 class Services(val context: Context, places: Places): GeckoSession.NavigationDelegate {
@@ -128,10 +128,22 @@ class Services(val context: Context, places: Places): GeckoSession.NavigationDel
                 val state = parsedUri.getQueryParameter("state") as String
                 val action = parsedUri.getQueryParameter("action") as String
 
+                val geckoResult = GeckoResult<AllowOrDeny>()
+
                 // Notify the state machine about our success.
-                accountManager.finishAuthenticationAsync(FxaAuthData(action.toAuthType(), code = code, state = state))
+                val result = accountManager.finishAuthenticationAsync(FxaAuthData(action.toAuthType(), code = code, state = state))
+                CoroutineScope(Dispatchers.Main).launch {
+                    if (!result.await()) {
+                        android.util.Log.e(LOGTAG, "Authentication finish error.")
+                        geckoResult.complete(AllowOrDeny.DENY)
+
+                    } else {
+                        android.util.Log.e(LOGTAG, "Authentication successfully completed.")
+                        geckoResult.complete(AllowOrDeny.ALLOW)
+                    }
+                }
 
-                return GeckoResult.ALLOW
+                return geckoResult
             }
             return GeckoResult.DENY
         }

diff --git a/app/src/common/shared/org/mozilla/vrbrowser/ui/widgets/Windows.java b/app/src/common/shared/org/mozilla/vrbrowser/ui/widgets/Windows.java
@@ -39,7 +39,9 @@
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
+import java.util.function.Predicate;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 import mozilla.components.concept.sync.AccountObserver;
 import mozilla.components.concept.sync.AuthType;
@@ -60,6 +62,11 @@ public class Windows implements TrayListener, TopBarWidget.Delegate, TitleBarWid
     private static final int TAB_SENT_NOTIFICATION_ID = 1;
     private static final int BOOKMARK_ADDED_NOTIFICATION_ID = 2;
 
+    // Restore URLs blacklist
+    private static final List<String> SAVE_BLACKLIST = Stream.of(
+      "https://accounts.firefox.com/oauth/"
+    ).collect(Collectors.toList());
+
     class WindowState {
         WindowPlacement placement;
         int textureWidth;
@@ -185,11 +192,17 @@ public void saveState() {
             state.privateMode = mPrivateMode;
             state.focusedWindowPlacement = mFocusedWindow.isFullScreen() ?  mFocusedWindow.getWindowPlacementBeforeFullscreen() : mFocusedWindow.getWindowPlacement();
             ArrayList<Session> sessions = SessionStore.get().getSortedSessions(false);
-            state.tabs = sessions.stream().map(Session::getSessionState).collect(Collectors.toCollection(ArrayList::new));
+            state.tabs = sessions.stream()
+                    .map(Session::getSessionState)
+                    .filter(sessionState -> SAVE_BLACKLIST.stream().noneMatch(uri -> sessionState.mUri.startsWith(uri)))
+                    .collect(Collectors.toCollection(ArrayList::new));
             for (WindowWidget window : mRegularWindows) {
-                WindowState windowState = new WindowState();
-                windowState.load(window, state, sessions.indexOf(window.getSession()));
-                state.regularWindowsState.add(windowState);
+                if (window.getSession() != null &&
+                        SAVE_BLACKLIST.stream().noneMatch(uri -> window.getSession().getCurrentUri().startsWith(uri))) {
+                    WindowState windowState = new WindowState();
+                    windowState.load(window, state, sessions.indexOf(window.getSession()));
+                    state.regularWindowsState.add(windowState);
+                }
             }
             Gson gson = new GsonBuilder().setPrettyPrinting().create();
             gson.toJson(state, writer);