@atproto/xrpc-server 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @atproto/xrpc-server
 
+## 0.4.1
+
+### Patch Changes
+
+- [#1839](https://github.com/bluesky-social/atproto/pull/1839) [`e1b5f253`](https://github.com/bluesky-social/atproto/commit/e1b5f2537a5ba4d8b951a741269b604856028ae5) Thanks [@dholms](https://github.com/dholms)! - Prevent signature malleability through DER-encoded signatures
+
+- Updated dependencies [[`e1b5f253`](https://github.com/bluesky-social/atproto/commit/e1b5f2537a5ba4d8b951a741269b604856028ae5)]:
+  - @atproto/crypto@0.3.0
+
 ## 0.4.0
 
 ### Minor Changes

package/dist/index.js

@@ -51925,11 +51925,23 @@ var verifyDidSig = async (did2, data, sig, opts) => {
   return verifySig(keyBytes, data, sig, opts);
 };
 var verifySig = async (publicKey, data, sig, opts) => {
+  const allowMalleable = opts?.allowMalleableSig ?? false;
   const msgHash = await sha2562(data);
+  if (!allowMalleable && !isCompactFormat(sig)) {
+    return false;
+  }
   return p256.verify(sig, msgHash, publicKey, {
-    lowS: opts?.lowS ?? true
+    lowS: !allowMalleable
   });
 };
+var isCompactFormat = (sig) => {
+  try {
+    const parsed = p256.Signature.fromCompact(sig);
+    return equals3(parsed.toCompactRawBytes(), sig);
+  } catch {
+    return false;
+  }
+};
 
 // ../crypto/src/p256/plugin.ts
 var p256Plugin = {
@@ -51948,11 +51960,23 @@ var verifyDidSig2 = async (did2, data, sig, opts) => {
   return verifySig2(keyBytes, data, sig, opts);
 };
 var verifySig2 = async (publicKey, data, sig, opts) => {
+  const allowMalleable = opts?.allowMalleableSig ?? false;
   const msgHash = await sha2562(data);
+  if (!allowMalleable && !isCompactFormat2(sig)) {
+    return false;
+  }
   return secp256k1.verify(sig, msgHash, publicKey, {
-    lowS: opts?.lowS ?? true
+    lowS: !allowMalleable
   });
 };
+var isCompactFormat2 = (sig) => {
+  try {
+    const parsed = secp256k1.Signature.fromCompact(sig);
+    return equals3(parsed.toCompactRawBytes(), sig);
+  } catch {
+    return false;
+  }
+};
 
 // ../crypto/src/secp256k1/plugin.ts
 var secp256k1Plugin = {
@@ -52051,7 +52075,7 @@ var verifyJwt = async (jwtStr, ownDid, getSigningKey) => {
   const sigBytes = fromString2(sig, "base64url");
   const verifySignatureWithKey = (key) => {
     return verifySignature(key, msgBytes, sigBytes, {
-      lowS: false
+      allowMalleableSig: true
     });
   };
   const signingKey = await getSigningKey(payload.iss, false);
@@ -52500,7 +52524,7 @@ function decodeQueryParam(type, value) {
   if (type === "float") {
     return Number(String(value));
   } else if (type === "integer") {
-    return Number(String(value)) | 0;
+    return parseInt(String(value), 10) || 0;
   } else if (type === "boolean") {
     return value === "true";
   }