fix: validate challenge to sign (#456)

* fix: validate challenge to sign * bump android version --------- Co-authored-by: Mateo "Kuruk" Miccino <[email protected]>
decentraland · Oct 4, 2024 · 677cbb9 · 677cbb9
1 parent ec56b11
commit 677cbb9
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 1 deletion.
diff --git a/godot/export_presets.cfg b/godot/export_presets.cfg
@@ -234,7 +234,7 @@ architectures/armeabi-v7a=false
 architectures/arm64-v8a=true
 architectures/x86=false
 architectures/x86_64=true
-version/code=12
+version/code=13
 version/name="1.0"
 package/unique_name="org.decentraland.godotexplorer"
 package/name="Decentraland"

diff --git a/lib/src/comms/adapter/archipelago.rs b/lib/src/comms/adapter/archipelago.rs
@@ -168,6 +168,11 @@ impl ArchipelagoManager {
 
                                 let challenge_to_sign = challenge_msg.challenge_to_sign.clone();
 
+                                if !challenge_to_sign.starts_with("dcl-") {
+                                    tracing::error!("invalid challenge to sign");
+                                    return;
+                                }
+
                                 // TODO: should this block_on be async? the ephemeral wallet is sync
                                 let signature = futures_lite::future::block_on(
                                     self.ephemeral_auth_chain

diff --git a/lib/src/comms/adapter/ws_room.rs b/lib/src/comms/adapter/ws_room.rs
@@ -214,6 +214,11 @@ impl WebSocketRoom {
 
                                 let challenge_to_sign = challenge_msg.challenge_to_sign.clone();
 
+                                if !challenge_to_sign.starts_with("dcl-") {
+                                    tracing::error!("invalid challenge to sign");
+                                    return;
+                                }
+
                                 // TODO: should this block_on be async? the ephemeral wallet is sync
                                 let signature = futures_lite::future::block_on(
                                     self.ephemeral_auth_chain