decentraland / decentraland-gatsby / 32408978708

58%

Build Type

push

github

Committed by web-flow

Commit Message

fix(auth)!: bind metadata casing in both the signer and the verifier (#1329)

* fix(auth)!: bind metadata casing in both the signer and the verifier

The pre-6.0.0 signed payload folded the whole joined string before
signing, so metadata casing fell outside the signature: two requests
differing only in case shared one valid signature, while consumers read
the metadata exactly as delivered.

verifySigner compared with an exact match, which left it sensitive to that
gap two ways. A delivered `{"Signer": ...}` made `'signer' in authMetadata`
false, and a re-cased value made the `===` false. In both cases the guard
fell through to `return true`, so a scene-originated request was classified
as a directly user-signed one.

This library is the only auth layer some consumers have: places and events
carry no auth code of their own and inherit this guard, so anything not
handled here is not handled for them.

Three changes:

- @dcl/crypto-middleware 5.1.0 -> 6.2.0, whose payload joins the metadata
  bytes verbatim. Casing is covered by the signature, which removes the
  ambiguity rather than trying to detect it.
- verifySigner delegates to rejectIfSigner, which refuses a signer that is
  not already canonical rather than comparing it. That covers what the
  signature cannot: a client signing a non-canonical value produces a
  valid signature, so only a gate can refuse it. Nothing is folded — the
  value reaching handlers is what was signed.
- Both signing sites (utils/api/API.ts, entities/Development/identity.ts)
  build the new payload. This library signs as well as verifies, so fixing
  one half alone would leave consumers signing a format its own verifier
  rejects.

Reconciles with #1328, which took the interim step of 5.1.0 to use the
library's canonical-value guard. 6.0.0 removed that guard because the
signature now covers the same ground, so those tests move to the checks
that apply: the in-flight case is refused by the gate before signature
verification... (continued)

Coverage Stats

531 of 1116 branches covered (47.58%)

Branch coverage included in aggregate %.

13 of 13 new or added lines in 4 files covered. (100.0%)

1 existing line in 1 file now uncovered.

1317 of 2057 relevant lines covered (64.03%)

12.58 hits per line