[Bug] Auth callback page crashes on malformed error params and renders attacker-controlled text

[atul-upadhyay-7]

Summary

src/pages/AuthCallback.tsx parses OAuth error parameters unsafely:

1. It calls decodeURIComponent on a value already decoded by URLSearchParams, so a malformed fragment like % throws a URIError during the useState initializer. Since the page has no error boundary, the whole app unmounts to a blank white screen.
2. When parsing succeeds, the raw attacker-controlled error_description string is rendered verbatim inside the login flow — a perfect phishing surface.

Evidence

src/pages/AuthCallback.tsx lines 16-21:

const params = new URLSearchParams(window.location.search);
const err = params.get("error_description") || params.get("error");
return err ? decodeURIComponent(err.replace(/\+/g, " ")) : null;

and lines 64-67 render {error} directly.

Exploit

• https://<app>/auth/callback?error_description=% → white-screen crash of the SPA.
• https://<app>/auth/callback?error_description=Your%20session%20has%20been%20suspended.%20Re-enter%20your%20credentials%20below. → attacker-controlled message displayed inside a legitimate-looking sign-in page.

Impact

• Denial of service (blank app) via a crafted link.
• Phishing: users may trust attacker-controlled text on the real app origin.

Suggested Fix

1. Parse inside try/catch; drop the manual decodeURIComponent (params are already decoded); cap the length of any displayed value.
2. Map error values to fixed, generic messages instead of rendering the raw query-string content.
3. Keep the existing hardcoded fallback strings for timeouts and generic failures.