bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-13 14:37:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Reject malformed CoinPay webhook signatures (#41)

Browse source 
* Reject malformed CoinPay webhook signatures

* Fix webhook signature type guard

---------

Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
This commit is contained in:
Autowebassat-blip 2026-06-14 07:56:12 +02:00 • committed by GitHub
parent 055cc09d14
commit e89c10cc80
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
apps/logicsrc-web/contract/logicsrc-web.contract.test.ts
View file

@ -433,6 +433,7 @@ describe("POST /api/webhooks/coinpay", () => {
expect(verifyCoinPayWebhook(payload, `t=${timestamp},v1=${signature}`, secret)).toBe(true); expect(verifyCoinPayWebhook(payload, `t=${timestamp},v1=${signature}`, secret)).toBe(true);
expect(verifyCoinPayWebhook(payload, `t=${timestamp}, v1=${signature}`, secret)).toBe(true); expect(verifyCoinPayWebhook(payload, `t=${timestamp}, v1=${signature}`, secret)).toBe(true);
expect(verifyCoinPayWebhook(payload, `t=${timestamp},v1=${signature}0`, secret)).toBe(false);
const response = await coinpayWebhook( const response = await coinpayWebhook(
new NextRequest("http://localhost/api/webhooks/coinpay", { new NextRequest("http://localhost/api/webhooks/coinpay", {

2
apps/logicsrc-web/src/lib/coinpay.ts
View file

@ -117,7 +117,7 @@ export function verifyCoinPayWebhook(
const parts = signatureHeader.split(",").map((part) => part.trim()); const parts = signatureHeader.split(",").map((part) => part.trim());
const timestamp = parts.find((part) => part.startsWith("t="))?.slice(2); const timestamp = parts.find((part) => part.startsWith("t="))?.slice(2);
const signature = parts.find((part) => part.startsWith("v1="))?.slice(3); const signature = parts.find((part) => part.startsWith("v1="))?.slice(3);
if (!timestamp || !signature) { if (!timestamp || !signature || !/^[0-9a-fA-F]{64}$/.test(signature)) {
return false; return false;
} }