bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-15 07:17:30 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Reject malformed CoinPay webhook signatures

Browse source
This commit is contained in:
Codex Microtask Operator 2026-06-13 01:38:25 +02:00
parent 8f4691584c
commit d60ceab6c2
2 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apps/logicsrc-web/src/lib/coinpay.ts
View file

@ -117,7 +117,7 @@ export function verifyCoinPayWebhook(
const parts = signatureHeader.split(",").map((part) => part.trim());
const timestamp = parts.find((part) => part.startsWith("t="))?.slice(2);
const signature = parts.find((part) => part.startsWith("v1="))?.slice(3);
if (!timestamp || !signature) {
if (!timestamp || !/^[0-9a-fA-F]{64}$/.test(signature)) {
return false;
}