decentraland / builder-server / 32374721526

72%

master: 72%

Build Type

Pull #809

github

Committed by LautaroPetaccio

Commit Message

fix(auth): upgrade to crypto-middleware 6 and refuse non-canonical signers

Builds on #808, which migrated off @dcl/platform-crypto-middleware and
added declaresSceneSigner to guard the legacy signature fallback. Two
things remained.

The dependency moves from ^5.1.0 to ^6.2.0. Up to 5.x the signed payload
folded the whole joined string, so metadata casing fell outside the
signature and two requests differing only in case shared one valid
signature. 6.0.0 joins the metadata bytes verbatim, so the parsed metadata
verify() returns is pinned to what was signed.

The post-verify check moves from an exact comparison to rejectIfSigner.
That covers what byte binding cannot: a client signing
`Decentraland-Kernel-Scene` itself produces a genuinely valid signature,
so no signature check can refuse it and only a gate can. The exact
comparison returned false and the request was accepted as directly
user-signed. Nothing is folded here — the value reaching handlers is what
was signed.

declaresSceneSigner is left as it is. It reads the raw header and
normalizes before comparing, which is right for its position: it runs
before verify() specifically to cover the fallback path, where a
`method:path` signature binds no metadata at all, so nothing pins that
value and the check has to be maximally suspicious.

The spec previously auto-mocked the whole module, which would leave
rejectIfSigner returning undefined and the predicate built at import time
undefined with it. It now mocks only verify, so the tests exercise the real
comparison, and covers the spellings the exact match let through.

BREAKING CHANGE: callers still signing the pre-6.0.0 payload are rejected
whenever their metadata contains an uppercase character. The builder dapp,
sites and landing send empty or all-lowercase metadata, byte-identical
under both formats, so they are unaffected.

Pull Request Pull Request #809: fix(auth): upgrade to crypto-middleware 6 and refuse non-canonical signers

Coverage Stats

1446 of 2220 branches covered (65.14%)

Branch coverage included in aggregate %.

1 of 3 new or added lines in 1 file covered. (33.33%)

3 existing lines in 1 file now uncovered.

3328 of 4393 relevant lines covered (75.76%)

48.6 hits per line