decentraland / world-storage-service / 28895412237

99%

main: 99%

Pull #112

github

feat: enforce scene scope on storage delegations; guard header size

Security review F2/F5: verifyStorageDelegation now takes a target { signer, world, sceneId, parcel, trustedSigners } and requires the claim's sceneId == the request's scene and parcel == the request's parcel (which pins the placeId) — confining a compromised worker to its own scene's storage, not the whole world. F6: reject an oversized x-authoritative-scope header before base64/JSON decode. Docs: authoritative signer must be an EOA.

405 of 421 branches covered (96.2%)

Branch coverage included in aggregate %.

58 of 59 new or added lines in 2 files covered. (98.31%)

1136 of 1143 relevant lines covered (99.39%)

69.62 hits per line