From 23a007d15771156411e6f5521082bf8ab6bb0b93 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?= Date: Fri, 26 Jun 2026 18:06:58 -0400 Subject: [PATCH] Require the OAuth state on the Codex callback (sec #4) The Codex flow guarded with `result.state && result.state !== state`, so a callback that simply omitted state skipped CSRF validation while a sign-in window was open. Match the Anthropic and Google flows: compare strictly, so a missing or mismatched state is rejected. PKCE already blocks code injection; this closes the login-CSRF gap. --- AgentCompany-New/src/main/services/oauth/openai-codex-flow.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AgentCompany-New/src/main/services/oauth/openai-codex-flow.ts b/AgentCompany-New/src/main/services/oauth/openai-codex-flow.ts index a26caba5..b4870972 100644 --- a/AgentCompany-New/src/main/services/oauth/openai-codex-flow.ts +++ b/AgentCompany-New/src/main/services/oauth/openai-codex-flow.ts @@ -103,7 +103,7 @@ export const openaiCodexFlow: OAuthFlow = { try { callbacks.onAuth({ url: buildAuthorizeUrl(challenge, state), instructions: "Complete the ChatGPT sign-in in your browser." }); const result = await server.waitForCode(); - if (result.state && result.state !== state) throw new Error("OAuth state mismatch."); + if (result.state !== state) throw new Error("OAuth state mismatch."); const tokens = await exchangeCode(result.code, verifier); const accountId = extractAccountId(tokens.access); if (!accountId) throw new Error("Could not read the ChatGPT account id from the token.");