supabase / supabase-flutter / 36609100064

93%

Build Type

push

github

Committed by web-flow

Commit Message

fix(supabase_flutter): don't throw on deep links with malformed percent-encoding (#1898)

## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

`SupabaseAuth._defaultIsAuthCallbackDeeplink` decodes every query and
fragment value with `uri.queryParameters` and `Uri.splitQueryString`.
Both throw `FormatException` when a value isn't valid percent-encoded
UTF-8, for example `myapp://callback/?code=%FF`. The check runs at the
top of `_handleDeeplink`, outside its `try` block, and the
incoming-links listener calls it with `unawaited`, so the error surfaces
as an uncaught async error for any deep link the app receives.

## What is the new behavior?

The default check reads only the parameter names, so a malformed value
can't make it throw. A link that carries one of the auth parameter names
is passed to `getSessionFromUrl`, and any failure there is reported by
the existing `try` block. Other links are ignored, as before. Behavior
for well-formed links is unchanged.

## Additional context

`test/deep_link_test.dart` has a new group that delivers three malformed
links (`?code=%FF`, `#access_token=%FF`, `#/route%C3`) through the
mocked app link channel. Each test fails on the previous code with an
uncaught `FormatException` and passes now. The rest of the
`supabase_flutter` test suite passes.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Malformed percent-encoded UTF-8 in authentication links is now handled
safely. Invalid links are ignored rather than triggering authentication
requests or creating a session.
* When session details are requested directly from a malformed callback
URL, a clear authentication error is returned.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Lukas Klingsbo <lukas.klingsbo@gmail.com>

Coverage Stats

19 of 19 new or added lines in 2 files covered. (100.0%)

1 existing line in 1 file now uncovered.

8798 of 9644 relevant lines covered (91.23%)

4.94 hits per line