bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-13 22:37:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Reject malformed CoinPay webhook signatures (#41)

Browse source 
* Reject malformed CoinPay webhook signatures

* Fix webhook signature type guard

---------

Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
This commit is contained in:
Autowebassat-blip 2026-06-14 07:56:12 +02:00 • committed by GitHub
parent 055cc09d14
commit e89c10cc80
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apps/logicsrc-web/src/lib/coinpay.ts
View file

@ -117,7 +117,7 @@ export function verifyCoinPayWebhook(
const parts = signatureHeader.split(",").map((part) => part.trim());
const timestamp = parts.find((part) => part.startsWith("t="))?.slice(2);
const signature = parts.find((part) => part.startsWith("v1="))?.slice(3);
if (!timestamp || !signature) {
if (!timestamp || !signature || !/^[0-9a-fA-F]{64}$/.test(signature)) {
return false;
}