@kya-brasil/core 0.7.0 → 0.7.1

package/dist/icp-brasil.js

@@ -87,6 +87,15 @@ export async function verifyIcpSignature(p) {
         throw new KyaError("CERTIFICATE_INVALID", "CMS carries no signer certificate");
     const trusted = p.anchors.map((a) => pkijs.Certificate.fromBER(unb64(a.replace(/-----[^-]+-----/g, ""))));
     const data = new TextEncoder().encode(p.challenge);
+    // An attached CMS (the .p7s carries the signed text) is verified over its own content by pkijs, whatever
+    // `data` says: it MUST carry exactly the challenge, or any document the company ever signed would pass.
+    const embedded = signed.encapContentInfo.eContent;
+    if (embedded) {
+        const content = new Uint8Array(embedded.getValue());
+        if (content.length !== data.length || !content.every((b, i) => b === data[i])) {
+            throw new KyaError("CHALLENGE_FAILED", "the signed content is not the challenge text (sign exactly the challenge, without extra line breaks)");
+        }
+    }
     let ok = false;
     try {
         ok = await signed.verify({ signer: 0, data: data.buffer, trustedCerts: trusted, checkChain: false, checkDate: now });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-brasil/core",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "KYA Brasil as a library: verify and issue know-your-agent credentials for Brazilian companies without any hosted service. e-CNPJ (ICP-Brasil) CMS signature and chain validation, CRL revocation, CNPJ, agent key challenges (EVM, Ed25519 / Web Bot Auth, ERC-8004), mandate schema and evaluation (including payment instruments for card networks and acquirers), credential build, Ed25519 signing and verification. Pure functions: storage and network are yours.",
   "license": "MIT",
   "type": "module",