@W-18777800: [qr code scan][ios] we should prevent a successful login of client A by scanning QR code of client B (Code Review Updates)

Author: JohnsonEricAtSalesforce

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/OAuth/SFOAuthCoordinator+Internal.h

@@ -33,6 +33,21 @@ typedef NS_ENUM(NSUInteger, SFOAuthTokenEndpointFlow) {
 };
 NS_ASSUME_NONNULL_BEGIN
 
+@interface SFOAuthCoordinatorFrontdoorBridge: NSObject
+
+/// For Salesforce Identity UI Bridge API support, an overriding front door bridge URL to use in place of the default initial URL.
+@property (nonatomic, strong, nullable) NSURL *overrideWithFrontDoorBridgeUrl;
+
+/// For Salesforce Identity UI Bridge API support, the optional web server flow code verififer accompaning the front door bridge URL.  This can only be used with `overrideWithfrontDoorBridgeUrl`.
+@property (nonatomic, strong, nullable) NSString *overrideWithCodeVerifier;
+
+/// For Salesforce Identity UI Bridge API support, indicates if overriding front door bridge URL has a consumer key value that matches the app config, which is also known as the boot config.
+@property (nonatomic, assign) BOOL overridingFrontDoorBridgeUrlMatchesConsumerKey;
+
+- initWithFrontdoorBridgeUrl:(NSURL *)frontdoorBridgeUrl codeVerifier:(NSString *)codeVerifier;
+
+@end
+
 @interface SFOAuthCoordinator ()
 
 @property (assign) BOOL authenticating;
@@ -48,14 +63,7 @@ NS_ASSUME_NONNULL_BEGIN
 @property (nonatomic, strong ,nullable) SFOAuthCredentials *spAppCredentials;
 @property (nonatomic, weak, nullable) SFSDKAuthSession *authSession;
 
-/// For Salesforce Identity UI Bridge API support, an overriding front door bridge URL to use in place of the default initial URL.
-@property (nonatomic, strong, nullable) NSURL *overrideWithFrontDoorBridgeUrl;
-
-/// For Salesforce Identity UI Bridge API support, the optional web server flow code verififer accompaning the front door bridge URL.  This can only be used with `overrideWithfrontDoorBridgeUrl`.
-@property (nonatomic, strong, nullable) NSString *overrideWithCodeVerifier;
-
-/// For Salesforce Identity UI Bridge API support, indicates if overriding front door bridge URL has a consumer key value that matches the app config, which is also known as the boot config.
-@property (nonatomic, assign) BOOL overridingFrontDoorBridgeUrlMatchesConsumerKey;
+@property (nonatomic, strong, nullable) SFOAuthCoordinatorFrontdoorBridge *frontdoorBridge;
 
 @property (nonatomic, strong, nullable) NSString *loginHint;
 

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/OAuth/SFOAuthCoordinator.m

@@ -347,7 +347,7 @@ - (void)notifyDelegateOfFailure:(NSError*)error authInfo:(SFOAuthInfo *)info
         });
     }
     self.authInfo = nil;
-    [self resetFrontDoorBridgeUrl];
+    [self resetFrontDoorBridge];
 }
 
 - (void)notifyDelegateOfSuccess:(SFOAuthInfo *)authInfo
@@ -357,7 +357,7 @@ - (void)notifyDelegateOfSuccess:(SFOAuthInfo *)authInfo
         [self.delegate oauthCoordinatorDidAuthenticate:self authInfo:authInfo];
     }
     self.authInfo = nil;
-    [self resetFrontDoorBridgeUrl];
+    [self resetFrontDoorBridge];
 }
 
 - (void)notifyDelegateOfBeginAuthentication
@@ -553,8 +553,8 @@ - (void)loadWebViewWithUrlString:(NSString *)urlString cookie:(BOOL)enableCookie
     [SFSDKCoreLogger d:[self class] format:@"%@ Loading web view for '%@' auth flow, with URL: %@", NSStringFromSelector(_cmd), self.authInfo.authTypeDescription, [urlToLoad sfsdk_redactedAbsoluteString:@[ @"sid" ]]];
     dispatch_async(dispatch_get_main_queue(), ^{
         // If a valid overriding Salesforce Identity API UI Bridge front door bridge is present, load it.
-        if (self.overrideWithFrontDoorBridgeUrl) {
-            [self.view loadRequest:[NSURLRequest requestWithURL:self.overrideWithFrontDoorBridgeUrl]];
+        if (self.frontdoorBridge.overrideWithFrontDoorBridgeUrl) {
+            [self.view loadRequest:[NSURLRequest requestWithURL:self.frontdoorBridge.overrideWithFrontDoorBridgeUrl]];
 
         } else {
             [self.view loadRequest:request];
@@ -580,7 +580,7 @@ - (void)beginTokenEndpointFlow {
         [SFSDKCoreLogger i:[self class] format:@"%@: Initiating authorization code flow.", NSStringFromSelector(_cmd)];
         request.approvalCode = self.approvalCode;
         // Choose either the default generated code verifier or the code verifier matching the overriding Salesforce Identity API UI Bridge front door bridge.
-        request.codeVerifier = self.overrideWithCodeVerifier ? self.overrideWithCodeVerifier : self.codeVerifier;
+        request.codeVerifier = self.frontdoorBridge.overrideWithCodeVerifier ? self.frontdoorBridge.overrideWithCodeVerifier : self.codeVerifier;
         [self.authClient accessTokenForApprovalCode:request completion:^(SFSDKOAuthTokenEndpointResponse * response) {
              __strong typeof (weakSelf) strongSelf = weakSelf;
             [strongSelf handleResponse:response];
@@ -791,10 +791,8 @@ - (NSString *)approvalURLForEndpoint:(NSString *)authorizeEndpoint
  * Resets all state related to Salesforce Identity API UI Bridge front door bridge URL log in to its default
  * inactive state.
  */
--(void) resetFrontDoorBridgeUrl {
-    self.overridingFrontDoorBridgeUrlMatchesConsumerKey = YES;
-    self.overrideWithFrontDoorBridgeUrl = nil;
-    self.overrideWithCodeVerifier = nil;
+-(void) resetFrontDoorBridge {
+    self.frontdoorBridge = nil;
 }
 
 - (NSString *)scopeQueryParamString {
@@ -819,7 +817,7 @@ - (void)webView:(WKWebView *)webView decidePolicyForNavigationAction:(WKNavigati
     NSString *requestUrl = [url absoluteString];
     if ([self isRedirectURL:requestUrl]) {
         // Determine if presence of override parameters require the user agent flow.
-        BOOL overrideWithUserAgentFlow = self.overrideWithFrontDoorBridgeUrl && !self.overrideWithCodeVerifier;
+        BOOL overrideWithUserAgentFlow = self.frontdoorBridge.overrideWithFrontDoorBridgeUrl && !self.frontdoorBridge.overrideWithCodeVerifier;
         if ( [[SalesforceSDKManager sharedManager] useWebServerAuthentication] && !overrideWithUserAgentFlow) {
             [self handleWebServerResponse:url]; // Web server flow/URLs with query string parameters.
         } else {
@@ -983,3 +981,30 @@ - (NSString *)brandedAuthorizeURL{
 }
 
 @end
+
+@implementation SFOAuthCoordinatorFrontdoorBridge
+
+- initWithFrontdoorBridgeUrl:(NSURL *)frontdoorBridgeUrl codeVerifier:(NSString *)codeVerifier {
+    self = [super init];
+    
+    NSURLComponents * frontdoorBridgeUrlComponents = [NSURLComponents
+                                                      componentsWithURL: frontdoorBridgeUrl
+                                                      resolvingAgainstBaseURL:YES];
+    NSArray<NSURLQueryItem *> * frontdoorBridgeUrlQueryItems = frontdoorBridgeUrlComponents.queryItems;
+    NSString * startUrlString = [frontdoorBridgeUrlQueryItems filteredArrayUsingPredicate:[NSPredicate predicateWithFormat:@"name == 'startURL'"]][0].value;
+    NSURL * startUrl = [[NSURL alloc] initWithString:startUrlString];
+    NSURLComponents * startUrlComponents = [NSURLComponents componentsWithURL: startUrl resolvingAgainstBaseURL: YES];
+    NSArray<NSURLQueryItem *> * startUrlQueryItems = startUrlComponents.queryItems;
+    NSString * frontdoorBridgeUrlClientId = [startUrlQueryItems filteredArrayUsingPredicate:[NSPredicate predicateWithFormat:@"name == 'client_id'"]][0].value;
+    
+    self.overridingFrontDoorBridgeUrlMatchesConsumerKey = [frontdoorBridgeUrlClientId isEqualToString:[[SalesforceSDKManager sharedManager] appConfig].remoteAccessConsumerKey];
+
+    if (self.overridingFrontDoorBridgeUrlMatchesConsumerKey) {
+        self.overrideWithCodeVerifier = codeVerifier;
+        self.overrideWithFrontDoorBridgeUrl = frontdoorBridgeUrl;
+    }
+    
+    return self;
+}
+
+@end

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/UserAccount/SFUserAccountManager.m

@@ -68,6 +68,7 @@
 #import "SFSDKIDPAuthCodeLoginRequestCommand.h"
 #import <SalesforceSDKCommon/SFJsonUtils.h>
 #import "SFSDKOAuth2+Internal.h"
+#import "SFSDKResourceUtils.h"
 
 // Notifications
 NSNotificationName SFUserAccountManagerDidChangeUserNotification       = @"SFUserAccountManagerDidChangeUserNotification";
@@ -598,11 +599,9 @@ - (BOOL)authenticateWithRequest:(SFSDKAuthRequest *)request
 
     // Only allow use of front door bridge URLs with matching consumer keys.
     if (frontDoorBridgeUrl != nil) {
-        authSession.oauthCoordinator.overridingFrontDoorBridgeUrlMatchesConsumerKey = [self validateBootConfigConsumerKeyMatches:frontDoorBridgeUrl];
-        if (authSession.oauthCoordinator.overridingFrontDoorBridgeUrlMatchesConsumerKey) {
-            authSession.oauthCoordinator.overrideWithCodeVerifier = codeVerifier;
-            authSession.oauthCoordinator.overrideWithFrontDoorBridgeUrl = frontDoorBridgeUrl;
-        }
+        authSession.oauthCoordinator.frontdoorBridge = [[SFOAuthCoordinatorFrontdoorBridge alloc]
+                                                        initWithFrontdoorBridgeUrl:frontDoorBridgeUrl
+                                                        codeVerifier:codeVerifier];
     }
     authSession.oauthCoordinator.loginHint = loginHint;
     NSString *sceneId = authSession.sceneId;
@@ -922,10 +921,10 @@ - (void)oauthCoordinator:(SFOAuthCoordinator *)coordinator didBeginAuthenticatio
     void (^authViewDisplayBlock)(void) = ^{
 
         self.authViewHandler.authViewDisplayBlock(viewHolder);
-        if (!coordinator.overridingFrontDoorBridgeUrlMatchesConsumerKey) {
+        if (coordinator.frontdoorBridge && !coordinator.frontdoorBridge.overridingFrontDoorBridgeUrlMatchesConsumerKey) {
             UIAlertController* alertController = [UIAlertController
                                                   alertControllerWithTitle:@"Error"
-                                                  message:@"Cannot use another app's login QR Code.  Please log in to this app."
+                                                  message:[SFSDKResourceUtils localizedString:@"frontdoorLoginUrlConsumerKeyMismatchErrorText"]
                                                   preferredStyle:UIAlertControllerStyleAlert];
             [alertController addAction:[UIAlertAction actionWithTitle:@"OK" style:UIAlertActionStyleDefault handler:nil]];
             [loginViewController
@@ -2128,21 +2127,6 @@ - (void)fireNotificationForSwitchUserFrom:(SFUserAccount *)fromUser to:(SFUserAc
                                                                  }];
 }
 
-- (BOOL)validateBootConfigConsumerKeyMatches:(NSURL *)frontdoorBridgeUrl {
-    
-    NSURLComponents * frontdoorBridgeUrlComponents = [NSURLComponents
-                                                      componentsWithURL: frontdoorBridgeUrl
-                                                      resolvingAgainstBaseURL:YES];
-    NSArray<NSURLQueryItem *> * frontdoorBridgeUrlQueryItems = frontdoorBridgeUrlComponents.queryItems;
-    NSString * startUrlString = [frontdoorBridgeUrlQueryItems filteredArrayUsingPredicate:[NSPredicate predicateWithFormat:@"name == 'startURL'"]][0].value;
-    NSURL * startUrl = [[NSURL alloc] initWithString:startUrlString];
-    NSURLComponents * startUrlComponents = [NSURLComponents componentsWithURL: startUrl resolvingAgainstBaseURL: YES];
-    NSArray<NSURLQueryItem *> * startUrlQueryItems = startUrlComponents.queryItems;
-    NSString * frontdoorBridgeUrlClientId = [startUrlQueryItems filteredArrayUsingPredicate:[NSPredicate predicateWithFormat:@"name == 'client_id'"]][0].value;
-    
-    return [frontdoorBridgeUrlClientId isEqualToString:[[SalesforceSDKManager sharedManager] appConfig].remoteAccessConsumerKey];
-}
-
 #pragma mark - User Change Notifications
 
 - (void)notifyUserDataChange:(NSString *)notificationName withUser:(SFUserAccount *)user andChange:(SFUserAccountDataChange)change {

shared/resources/SalesforceSDKResources.bundle/en.lproj/Localizable.strings

@@ -43,15 +43,16 @@
 "bioPromtpCancel" = "Use Password";
 
 // OAuth flow
-"authAlertContinueButton"="Continue";
+"authAlertContinueButton" = "Continue";
 "authAlertErrorTitle" = "Server Error";
 "authAlertOkButton" = "OK";
-"authAlertCancelButton"="Cancel";
+"authAlertCancelButton" = "Cancel";
 "authAlertRetryButton" = "Retry";
 "authAlertDismissButton" = "Dismiss";
 "authAlertConnectionErrorFormatString" = "Can't connect to the server: %@";
 "authAlertVersionMismatchError" = "Your app has been updated, and you will need to log in again to continue using the app.";
-"authAlertBrowserFlowTitle"="Log In";
+"authAlertBrowserFlowTitle" = "Log In";
+"frontdoorLoginUrlConsumerKeyMismatchErrorText" = "Cannot use another app's login QR Code.  Please log in to this app.";
 
 // LoginViewController
 "TITLE_LOGIN" = "Log In";
@@ -66,7 +67,7 @@
 "LOGIN_SERVER_NAME_PLACEHOLDER" = "Optional";
 "DONE_BUTTON" = "Done";
 
-//Account Switcher
+// Account Switcher
 "ACCOUNT_SWITCHER_TITLE" = "Manage Accounts";
 "LOG_OUT" = "Log Out";
 "ADD_NEW_ACCOUNT" = "Add New Account";
@@ -106,12 +107,12 @@
 "devInfoOKKey" = "OK";
 "devInfoCancelKey" = "Cancel";
 
-//IDP User Selection Screen
+// IDP User Selection Screen
 "idpSelectUserLabel" = "Select your account to log in to";
 "idpAddNewAccountLabel" = "Add new account";
 "idpSelectUserTitleLabel" = "Select user";
 
-//IDP Login Selection Screen
+// IDP Login Selection Screen
 "idpLoginFlowInfoLabel" = "Select the flow to use for log in";
 "idpLoginLocalFlowDescriptionLabel" = "Local - Host App will be used for authentication";
 "idpLoginIdpFlowDescriptionLabel" = "IDP - Identity Provider App will be launched for authentication";