Giscus session ID may be leaked when discussion is created

[Maronato]

When commenting/reacting on a page that doesn't have a discussion yet, the user's session ID is leaked in the page URL attached to the discussion.

This allows anyone to impersonate the user in the comments just by clicking the page URL provided in the discussion.

Reproducing

With Giscus installed on a website using a giscus component:

1. Clear your giscus session id from the browser if it is set (log out)
2. Access a page that does not have a matching discussion yet
3. Go to the comment section and log in
4. Immediately after, post a reaction or a comment

Giscus will create a new discussion and attach a link to the related page. The link will have the format: https://<host>/<page>?giscus=<user-session-id>

Anyone that clicks this link, will be redirected to the page and logged into giscus using the leaked session id, therefore being able to comment and react as the user who created the discussion.

Possible cause

I haven't gone too deep into the code, but it seems to be caused by the use of location.href in the body of the discussion.

location.href also contains search parameters, so after the user returns from the oauth login flow with the session id in the URL, it is used as the page origin and included in the discussion.

Notes

I faced this leak when using @giscus/react and possibly traced the issue back to this line.

The script client does not seem to be vulnerable to this issue since it removes the parameter from the url.

[laymonage]

🎉 This issue has been resolved in version @giscus/react-v1.0.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[laymonage]

@Maronato Thanks for the report, could you verify that the issue has been fixed in the latest release (v1.0.1)?

[dfeng]

From what I can tell, this update seems to have introduced some bugs:

• your github account no longer seems to persist, and when you navigate to a new page, it "resets", and you have to login again (despite the fact that I am already logged in – going back to 1.0.0, I didn't even need to login and it was signed in).
• I have some code that dynamically changes the theme. this no longer works with this version.

Reverting back to 1.0.0 resolves these problems.

[laymonage]

@dfeng could you check with the latest version (v1.1.1)? It should fix the issue.

[dfeng]

looks like it's working! cheers :)