decentraland / worlds-content-server / 32195938902

92%

main: 92%

Pull #534

github

fix(auth): use rejectIfSigner instead of normalizing the signer

The previous commit folded the signer with trim().toLowerCase() before
comparing, so a re-spelled value could not walk past the gate. That works,
but it rewrites a value the signature binds, and it is the one place in
this migration where a service transformed metadata rather than refusing
it.

6.1.0 provides the predicate that gate wanted. rejectIfSigner refuses a
signer that is not already canonical instead of folding it, so the same
requests are refused and the value reaching handlers stays exactly what
the client signed.

Bumps the dependency to ^6.1.0 for it.

The four non-canonical cases split, because the predicate refuses a
non-canonical `signer` whether or not it matches the sentinel: the two
signer cases now expect 400, the two intent cases stay 200 since this
route does not gate intent. Noted there that the /comms adapter route does
compare intent, and should use requireCanonicalField if that check ever
moves.

1880 of 2169 branches covered (86.68%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

3869 of 4099 relevant lines covered (94.39%)

137.0 hits per line