fix: comms handshake (#6252)

decentraland · Oct 4, 2024 · ced5032 · ced5032
1 parent 43725c8
commit ced5032
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/browser-interface/packages/shared/comms/adapters/WebSocketAdapter.ts b/browser-interface/packages/shared/comms/adapters/WebSocketAdapter.ts
@@ -87,6 +87,10 @@ export class WebSocketAdapter implements MinimumCommunicationsAdapter {
             return this.handleWelcomeMessage(message.welcomeMessage, ws)
           }
           case 'challengeMessage': {
+            if (!message.challengeMessage.challengeToSign.match(/^dcl-[^:]*$/)) {
+              throw new Error('Protocol error: invalid challenge')
+            }
+
             const authChainJson = JSON.stringify(
               Authenticator.signPayload(this.identity, message.challengeMessage.challengeToSign)
             )

diff --git a/browser-interface/packages/shared/realm/connections/ArchipelagoConnection.ts b/browser-interface/packages/shared/realm/connections/ArchipelagoConnection.ts
@@ -74,6 +74,10 @@ export async function createArchipelagoConnection(
 
       switch (message.$case) {
         case 'challengeResponse': {
+          if (!message.challengeResponse.challengeToSign.match(/^dcl-[^:]*$/)) {
+            throw new Error('Protocol error: invalid challenge')
+          }
+
           const authChainJson = JSON.stringify(
             Authenticator.signPayload(identity, message.challengeResponse.challengeToSign)
           )