From 438b1e44c3f61796485e05ca06b29ef0e955b36f Mon Sep 17 00:00:00 2001 From: Redchar1992 Date: Wed, 12 Aug 2026 17:57:53 +0800 Subject: [PATCH] fix(github): always prompt users to select an account - force GitHub OAuth to show the account picker - add regression coverage for the authorization parameter --- apps/remix-ide/src/lib/github-oauth.js | 5 ++++- apps/remix-ide/test/audit-20260721-remediation-test.js | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/apps/remix-ide/src/lib/github-oauth.js b/apps/remix-ide/src/lib/github-oauth.js index 83fe36a94..deeab5fa5 100644 --- a/apps/remix-ide/src/lib/github-oauth.js +++ b/apps/remix-ide/src/lib/github-oauth.js @@ -64,7 +64,10 @@ export function connectWithGithubOAuth (opts = {}) { redirect_uri: GITHUB_OAUTH.redirectUri, scope: opts.scope || GITHUB_OAUTH.scope, state, - allow_signup: 'false' + allow_signup: 'false', + // Avoid silently reusing whichever GitHub account is active in the + // browser, especially on shared devices or with multiple sessions. + prompt: 'select_account' }).toString() const w = 720 diff --git a/apps/remix-ide/test/audit-20260721-remediation-test.js b/apps/remix-ide/test/audit-20260721-remediation-test.js index 8a0e6363e..2ffba0478 100644 --- a/apps/remix-ide/test/audit-20260721-remediation-test.js +++ b/apps/remix-ide/test/audit-20260721-remediation-test.js @@ -36,6 +36,7 @@ test('URL imports, wallet events, OAuth messages, and AI staging keep their secu t.ok(filePanel.indexOf('normalizeUrlImport(params.url)') !== -1, '#url is allow-listed before contentImport.resolve') t.ok(wallet.indexOf('event.source !== window || event.origin !== window.location.origin') !== -1, 'wallet postMessage requires the same window and origin') t.ok(oauth.indexOf('event.source !== popup') !== -1, 'OAuth completion must come from the popup that was opened') + t.ok(oauth.indexOf("prompt: 'select_account'") !== -1, 'OAuth must let users choose the GitHub account explicitly') t.ok(chat.indexOf("title: 'AI wants to stage all workspace changes'") !== -1, 'git_stage_all asks for confirmation') t.ok(chat.indexOf("title: 'AI wants to stage workspace files'") !== -1, 'git_stage asks for confirmation') t.end()