decentraland / events / 32893334650

67%

push

github

fix(deps): upgrade decentraland-gatsby to 9.0.1 (#1012)

gatsby 9.0.1 pins @dcl/crypto-middleware 6.3.0, which closes a bypass in
the scene-signer gate this service relies on through gatsby's `withAuth`.

Until 6.3.0 the metadata predicates read the exact key, so metadata
delivering `{"Signer":"decentraland-kernel-scene"}` presented no `signer`
field and the gate treated it as absent -- answering "allowed" for
metadata that visibly names the signer it exists to refuse. Re-spelling
the key changes the signed bytes, so a request must be signed that way,
which a scene-driven client can simply do. It was reachable on the
current-format path, not only under a legacy fallback.

The caret range already admitted 9.0.1; the lockfile pinned 9.0.0, which
carries crypto-middleware 6.2.0. So the lockfile refresh is what actually
delivers the fix rather than the manifest edit.

Patched surgically rather than regenerated: `npm install` rewrote 556
lines of `peer` and `license` metadata that no dependency change
requires. The three entries that do change are the root range, the
decentraland-gatsby entry and the transitive @dcl/crypto-middleware
entry. `npm ci` accepts the result and installs gatsby 9.0.1 with
crypto-middleware 6.3.0.

No source change: the gate lives in gatsby, whose own suite covers it.
Verified against the installed tree that `verifySigner` now refuses
`{"Signer":"decentraland-kernel-scene"}` while still admitting
`{"signer":"dcl:explorer"}` and `{}`.

749 of 1023 branches covered (73.22%)

Branch coverage included in aggregate %.

4060 of 6123 relevant lines covered (66.31%)

7.51 hits per line