@atproto/xrpc-server 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @atproto/xrpc-server
 
+## 0.4.2
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @atproto/lexicon@0.3.1
+
+## 0.4.1
+
+### Patch Changes
+
+- [#1839](https://github.com/bluesky-social/atproto/pull/1839) [`e1b5f253`](https://github.com/bluesky-social/atproto/commit/e1b5f2537a5ba4d8b951a741269b604856028ae5) Thanks [@dholms](https://github.com/dholms)! - Prevent signature malleability through DER-encoded signatures
+
+- Updated dependencies [[`e1b5f253`](https://github.com/bluesky-social/atproto/commit/e1b5f2537a5ba4d8b951a741269b604856028ae5)]:
+  - @atproto/crypto@0.3.0
+
 ## 0.4.0
 
 ### Minor Changes

package/dist/index.js

@@ -43596,13 +43596,13 @@ var ensureValidAtUri = (uri2) => {
     throw new Error("ATURI requires at least method and authority sections");
   }
   try {
-    ensureValidHandle(parts[2]);
-  } catch {
-    try {
+    if (parts[2].startsWith("did:")) {
       ensureValidDid(parts[2]);
-    } catch {
-      throw new Error("ATURI authority must be a valid handle or DID");
+    } else {
+      ensureValidHandle(parts[2]);
     }
+  } catch {
+    throw new Error("ATURI authority must be a valid handle or DID");
   }
   if (parts.length >= 4) {
     if (parts[3].length == 0) {
@@ -44938,7 +44938,7 @@ function datetime(path, value) {
   } catch {
     return {
       success: false,
-      error: new ValidationError(`${path} must be an iso8601 formatted datetime`)
+      error: new ValidationError(`${path} must be an valid atproto datetime (both RFC-3339 and ISO-8601)`)
     };
   }
   return { success: true, value };
@@ -51925,11 +51925,23 @@ var verifyDidSig = async (did2, data, sig, opts) => {
   return verifySig(keyBytes, data, sig, opts);
 };
 var verifySig = async (publicKey, data, sig, opts) => {
+  const allowMalleable = opts?.allowMalleableSig ?? false;
   const msgHash = await sha2562(data);
+  if (!allowMalleable && !isCompactFormat(sig)) {
+    return false;
+  }
   return p256.verify(sig, msgHash, publicKey, {
-    lowS: opts?.lowS ?? true
+    lowS: !allowMalleable
   });
 };
+var isCompactFormat = (sig) => {
+  try {
+    const parsed = p256.Signature.fromCompact(sig);
+    return equals3(parsed.toCompactRawBytes(), sig);
+  } catch {
+    return false;
+  }
+};
 
 // ../crypto/src/p256/plugin.ts
 var p256Plugin = {
@@ -51948,11 +51960,23 @@ var verifyDidSig2 = async (did2, data, sig, opts) => {
   return verifySig2(keyBytes, data, sig, opts);
 };
 var verifySig2 = async (publicKey, data, sig, opts) => {
+  const allowMalleable = opts?.allowMalleableSig ?? false;
   const msgHash = await sha2562(data);
+  if (!allowMalleable && !isCompactFormat2(sig)) {
+    return false;
+  }
   return secp256k1.verify(sig, msgHash, publicKey, {
-    lowS: opts?.lowS ?? true
+    lowS: !allowMalleable
   });
 };
+var isCompactFormat2 = (sig) => {
+  try {
+    const parsed = secp256k1.Signature.fromCompact(sig);
+    return equals3(parsed.toCompactRawBytes(), sig);
+  } catch {
+    return false;
+  }
+};
 
 // ../crypto/src/secp256k1/plugin.ts
 var secp256k1Plugin = {
@@ -52051,7 +52075,7 @@ var verifyJwt = async (jwtStr, ownDid, getSigningKey) => {
   const sigBytes = fromString2(sig, "base64url");
   const verifySignatureWithKey = (key) => {
     return verifySignature(key, msgBytes, sigBytes, {
-      lowS: false
+      allowMalleableSig: true
     });
   };
   const signingKey = await getSigningKey(payload.iss, false);
@@ -52500,7 +52524,7 @@ function decodeQueryParam(type, value) {
   if (type === "float") {
     return Number(String(value));
   } else if (type === "integer") {
-    return Number(String(value)) | 0;
+    return parseInt(String(value), 10) || 0;
   } else if (type === "boolean") {
     return value === "true";
   }
@@ -52899,11 +52923,9 @@ var Server = class {
           req,
           res
         };
-        if (consumeRateLimit) {
-          const result = await consumeRateLimit(reqCtx);
-          if (result instanceof RateLimitExceededError) {
-            return next(result);
-          }
+        const result = await consumeRateLimit(reqCtx);
+        if (result instanceof RateLimitExceededError) {
+          return next(result);
         }
         const outputUnvalidated = await handler(reqCtx);
         if (isHandlerError(outputUnvalidated)) {