bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-14 23:07:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Reject malformed CoinPay webhook timestamps

Browse source
This commit is contained in:
Codex Microtask Operator 2026-06-13 01:36:03 +02:00
parent 8f4691584c
commit f2be6b850d
2 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apps/logicsrc-web/contract/logicsrc-web.contract.test.ts
View file

@ -411,6 +411,10 @@ describe("POST /api/webhooks/coinpay", () => {
expect(verifyCoinPayWebhook(payload, `t=${timestamp},v1=${signature}`, secret)).toBe(true); expect(verifyCoinPayWebhook(payload, `t=${timestamp},v1=${signature}`, secret)).toBe(true);
expect(verifyCoinPayWebhook(payload, `t=${timestamp}, v1=${signature}`, secret)).toBe(true); expect(verifyCoinPayWebhook(payload, `t=${timestamp}, v1=${signature}`, secret)).toBe(true);
const malformedTimestamp = `${timestamp}abc`;
const malformedSignature = createHmac("sha256", secret).update(`${malformedTimestamp}.${payload}`).digest("hex");
expect(verifyCoinPayWebhook(payload, `t=${malformedTimestamp},v1=${malformedSignature}`, secret)).toBe(false);
const response = await coinpayWebhook( const response = await coinpayWebhook(
new NextRequest("http://localhost/api/webhooks/coinpay", { new NextRequest("http://localhost/api/webhooks/coinpay", {
method: "POST", method: "POST",

2
apps/logicsrc-web/src/lib/coinpay.ts
View file

@ -117,7 +117,7 @@ export function verifyCoinPayWebhook(
const parts = signatureHeader.split(",").map((part) => part.trim()); const parts = signatureHeader.split(",").map((part) => part.trim());
const timestamp = parts.find((part) => part.startsWith("t="))?.slice(2); const timestamp = parts.find((part) => part.startsWith("t="))?.slice(2);
const signature = parts.find((part) => part.startsWith("v1="))?.slice(3); const signature = parts.find((part) => part.startsWith("v1="))?.slice(3);
if (!timestamp || !signature) { if (!timestamp || !signature || !/^\d+$/.test(timestamp)) {
return false; return false;
} }