decentraland / places / 31196817971

90%

push

github

fix: bump decentraland-gatsby to 8.4.8 for canonical signer validation (#858)

decentraland-gatsby 8.4.8 upgrades @dcl/crypto-middleware from ^4.0.0 to
^5.1.0, which requires the top-level `signer` and `intent` metadata
fields to arrive already trimmed and lowercased.

The signed-fetch payload is lowercased before signing, so the signature
does not bind the casing a consumer reads back:
{"signer":"Decentraland-Kernel-Scene"} and
{"signer":"decentraland-kernel-scene"} produce a byte-identical signing
payload and share one valid signature. gatsby's `verifySigner` asserts a
negative — it throws only on an exact match of 'decentraland-kernel-scene'
— so it failed open: a mixed-case spelling escaped the check and
`withAuth` resolved with the real account address, handing this service a
scene-originated request as a directly user-signed one.

Whitespace is signature-bound rather than a third-party bypass, since the
payload is never trimmed, but a padded value slipped past the same
comparison and is now rejected too.

No source changes. This service performs no signer comparison of its own
and declares no direct @dcl/crypto-middleware dependency, so the gatsby
bump is sufficient: the tree resolves exactly one copy of the middleware,
at 5.1.0.

The declared range moves ^8.4.7 -> ^8.4.8 rather than relying on the
previous floor, which would still permit resolving back to a gatsby
carrying the vulnerable middleware on a fresh install.

Claude-Session: https://claude.ai/code/session_01XTskziwD4er8Fq5qN6ZtDp

1132 of 1617 branches covered (70.01%)

Branch coverage included in aggregate %.

16512 of 18067 relevant lines covered (91.39%)

5.97 hits per line