cros: Terminate if merge session fails for online sign-in

chrome/browser/chromeos/login/session/user_session_manager.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/session/user_session_manager.h"
 
 #include <stddef.h>
 
 #include <set>
 #include <string>
@@ skipping 849 matching lines @@
   // error. http://crbug.com/295245
   if (!connection_error) {
     // We are in one of "done" states here.
     user_manager::UserManager::Get()->SaveUserOAuthStatus(
         user_manager::UserManager::Get()->GetActiveUser()->GetAccountId(),
         user_status);
   }
 
   login_manager->RemoveObserver(this);
 
+  // Terminate user session if merge session fails for an online sign-in.
+  // Otherwise, auth token dependent code would be in an invalid state.
+  // Important piece such as policy code might be broken because of this and
+  // subject to an exploit. See http://crbug.com/677312.
+  const bool is_online_signin =
+      user_context_.GetAuthFlow() == UserContext::AUTH_FLOW_GAIA_WITH_SAML ||
+      user_context_.GetAuthFlow() == UserContext::AUTH_FLOW_GAIA_WITHOUT_SAML;
+  if (is_online_signin && state == OAuth2LoginManager::SESSION_RESTORE_FAILED) {
+    LOG(ERROR)
+        << "Session restore failed for online sign-in, terminating session.";
+    chrome::AttemptUserExit();
+    return;
+  }
+
   if (exit_after_session_restore_ &&
       (state  == OAuth2LoginManager::SESSION_RESTORE_DONE ||
        state  == OAuth2LoginManager::SESSION_RESTORE_FAILED ||
        state  == OAuth2LoginManager::SESSION_RESTORE_CONNECTION_FAILED)) {
     LOG(WARNING) << "Restarting Chrome after session restore finishes, "
                  << "most likely due to custom flags.";
 
     // We need to restart cleanly in this case to make sure OAuth2 RT is
     // actually saved.
     chrome::AttemptRestart();
@@ skipping 1064 matching lines @@
           ->browser_policy_connector_chromeos()
           ->IsEnterpriseManaged()) {
     return false;
   }
 
   // Do not show end of life notification if this is a guest session
   return !profile->IsGuestSession();
 }
 
 }  // namespace chromeos