fix(gist-export): validate OAuth2 state and redirect URI

The state of the OAuth2 response was not verified.
In theory an attacker could use this to extract the contents of a note.

Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>

lib/web/note/actions.js

@@ -32,11 +32,15 @@ exports.getInfo = function getInfo (req, res, note) {
 }
 
 exports.createGist = function createGist (req, res, note) {
+  const state = nanoid.nanoid()
+  const redirectUri = config.serverURL + '/auth/github/callback/' + models.Note.encodeNoteId(note.id) + '/gist'
+  req.session.githubGistState = state
+  req.session.githubGistRedirectUri = redirectUri
   const data = {
     client_id: config.github.clientID,
-    redirect_uri: config.serverURL + '/auth/github/callback/' + models.Note.encodeNoteId(note.id) + '/gist',
+    redirect_uri: redirectUri,
     scope: 'gist',
-    state: nanoid.nanoid()
+    state
   }
   const query = querystring.stringify(data)
   res.redirect('https://github.com/login/oauth/authorize?' + query)