decentraland / world-storage-service / 31187258617

99%

main: 99%

Pull #114

github

fix: reject non-canonical metadata signer and intent

Bump @dcl/crypto-middleware from ^4.1.1 to ^5.1.0, which requires the
top-level `signer` and `intent` metadata fields to arrive already
trimmed and lowercased.

The signed-fetch payload is lowercased before signing, so the signature
does not bind the casing a consumer reads back:
{"signer":"Decentraland-Kernel-Scene"} and
{"signer":"decentraland-kernel-scene"} produce a byte-identical signing
payload and share one valid signature. The scene gate in
controllers/routes.ts asserts a negative
(`signer !== 'decentraland-kernel-scene'`), so it fails open: a
mixed-case spelling escaped the check and a scene-originated request was
read as a directly user-signed one, reaching sceneContextMiddleware and
the world/player/env storage handlers as the user.

Whitespace is signature-bound rather than a third-party bypass — the
payload is never trimmed — but a padded value still slipped past the
same strict equality, so it is now rejected to prevent that silent
misclassification.

Add test/integration/auth/canonical-signer.spec.ts covering both halves
of the rule. The casing case signs the canonical form and rewrites the
delivered `x-identity-metadata` header afterwards, which is the attack
itself: the signature stays genuinely valid. The padding cases are signed
as delivered, because whitespace changes the signed bytes. Ordinary user
traffic is asserted to still reach the handler.

Claude-Session: https://claude.ai/code/session_01XTskziwD4er8Fq5qN6ZtDp

424 of 438 branches covered (96.8%)

Branch coverage included in aggregate %.

1146 of 1153 relevant lines covered (99.39%)

71.29 hits per line