decentraland / world-storage-service / 33280924052

99%

main: 99%

push

github

fix(auth): upgrade @dcl/crypto-middleware to 6.3 to close the folded signer-key bypass (#119)

`rejectIfSigner('decentraland-kernel-scene')` is built on `canonicalField`, which
reads the own property `signer`. Metadata delivering `{"Signer":"decentraland-kernel-scene"}`
therefore presented no `signer` at all, and every predicate read the field as
absent -- so the gate answered "allowed" for a request that visibly names the
signer it exists to refuse.

It is reachable on the strict, current-format path. Re-spelling the key changes
the signed bytes, so the request has to be signed that way -- which a malicious
scene-driven client can simply do. The bytes it delivers are then the bytes it
signed, signature verification has no objection to make, and the request is
served.

`canonicalMetadataKeys` already refused a re-spelled key via
`assertLegacyMetadataKeys`, but only on the legacy path, which `verify()` reaches
only after the current-format check fails. Signed in the current format the
fallback is never consulted, so that guard never ran.

6.3.0 adds a `hasFoldedVariant` check to `canonicalField` and
`requireCanonicalField`: a key that case-folds to the declared field without
being spelled exactly that is a rejection rather than an absence. Nothing is
folded -- the request is refused, not rewritten.

The lockfile change is the load-bearing part. The `^6.2.0` range already admitted
6.3.0, but the lockfile pinned 6.2.0, so the fix did not arrive without a refresh.
The declared range is bumped alongside it so the intent is explicit.

`scene-signer-gate.spec.ts` drives `verify()` with the `signedFetchPolicy` that
`routes.ts` wires. Against 6.2.0 its re-spelled-key cases resolve with a valid
authentication and hand the service `{"Signer":"decentraland-kernel-scene"}`;
against 6.3.0 they are refused.

One row of the existing table in `legacy-signed-payload.spec.ts` moves from
`Invalid chain metadata` to `Invalid metadata content`: the same 400 for a
re-spelle... (continued)

424 of 438 branches covered (96.8%)

Branch coverage included in aggregate %.

1149 of 1156 relevant lines covered (99.39%)

71.24 hits per line