decentraland / signatures-server / 31485350008

92%

push

github

fix: Normalize the scene signer and bump @dcl/crypto-middleware to 5.1.0 (#488)

* tests: Add tests to validate auth-chain

* chore: Bump @dcl/crypto-middleware lib

* fix: normalize the scene signer before comparing it

the signed payload is lowercased before signing, so casing is not covered by the signature. the
exact comparison against 'decentraland-kernel-scene' therefore missed any other spelling, and a
scene could deliver Decentraland-Kernel-Scene with a still valid signature and pass as a directly
user signed request. @dcl/crypto-middleware v5 rejects that metadata upstream, but the restriction
should not depend on the library's guard staying in place.

the signer is now trimmed and lowercased before the comparison, matching the canonical form the
library enforces. it is also type checked first: metadata is attacker supplied and only validated
to be an object, so a non string signer would have thrown on toLowerCase and answered a public
endpoint with a 500. pulling the value out with optional chaining makes the previous object check
redundant, since indexing a non object yields undefined and fails the string test anyway.

348 of 375 branches covered (92.8%)

Branch coverage included in aggregate %.

2 of 2 new or added lines in 1 file covered. (100.0%)

686 of 752 relevant lines covered (91.22%)

48.32 hits per line