fix: validate challenge to sign

decentraland · Oct 4, 2024 · 3da572b · 3da572b
1 parent ec56b11
commit 3da572b
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/lib/src/comms/adapter/archipelago.rs b/lib/src/comms/adapter/archipelago.rs
@@ -168,6 +168,11 @@ impl ArchipelagoManager {
 
                                 let challenge_to_sign = challenge_msg.challenge_to_sign.clone();
 
+                                if !challenge_to_sign.starts_with("dcl-") {
+                                    tracing::error!("invalid challenge to sign");
+                                    return;
+                                }
+
                                 // TODO: should this block_on be async? the ephemeral wallet is sync
                                 let signature = futures_lite::future::block_on(
                                     self.ephemeral_auth_chain

diff --git a/lib/src/comms/adapter/ws_room.rs b/lib/src/comms/adapter/ws_room.rs
@@ -214,6 +214,11 @@ impl WebSocketRoom {
 
                                 let challenge_to_sign = challenge_msg.challenge_to_sign.clone();
 
+                                if !challenge_to_sign.starts_with("dcl-") {
+                                    tracing::error!("invalid challenge to sign");
+                                    return;
+                                }
+
                                 // TODO: should this block_on be async? the ephemeral wallet is sync
                                 let signature = futures_lite::future::block_on(
                                     self.ephemeral_auth_chain