decentraland / decentraland-gatsby / 31192002944

58%

push

github

fix: reject non-canonical metadata signer and intent (#1328)

Bump @dcl/crypto-middleware from ^4.0.0 to ^5.1.0, which requires the
top-level `signer` and `intent` metadata fields to arrive already
trimmed and lowercased.

The signed-fetch payload is lowercased before signing, so the signature
does not bind the casing a consumer reads back:
{"signer":"Decentraland-Kernel-Scene"} and
{"signer":"decentraland-kernel-scene"} produce a byte-identical signing
payload and share one valid signature. `verifySigner` in
entities/Auth/utils.ts asserts a negative — it throws only on an exact
match of 'decentraland-kernel-scene' — so it fails open: a mixed-case
spelling escaped the check and `withAuth` resolved with the real account
address, handing every consuming dapp a scene request as a directly
user-signed one.

Whitespace is signature-bound rather than a third-party bypass, since
the payload is never trimmed, but a padded value still slipped past that
same comparison. It is now rejected to prevent the misclassification.

No source changes. Every export this package uses from the middleware —
`verify`, `DecentralandSignatureData`, `VerifyAuthChainHeadersOptions`,
`AUTH_CHAIN_HEADER_PREFIX`, `AUTH_METADATA_HEADER`,
`AUTH_TIMESTAMP_HEADER` — is unchanged in v5. The only v5 removals are
the Express, Koa and Passport adapters, none of which this package uses;
it calls `verify()` directly. The deprecated `verifyMetadataContent`
compatibility shim in entities/Auth/utils.ts is untouched.

Extend withDecentralandAuth.test.ts to cover both halves of the rule
across `withAuth` (rejects) and `withAuthOptional` (falls through to
null). The mixed-case case signs the canonical form and rewrites the
delivered header afterwards, which keeps the signature genuinely valid;
the padded cases are signed as delivered, because whitespace changes the
signed bytes.

Note the 468/260 package-lock churn is almost entirely unrelated: a plain
`npm install` on unmodified master produces 46... (continued)

508 of 1115 branches covered (45.56%)

Branch coverage included in aggregate %.

1266 of 2049 relevant lines covered (61.79%)

12.09 hits per line