@scryme/sdk 9.68.0 → 9.69.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +12 -5
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -179,11 +179,18 @@ function verifySignature(
|
|
|
179
179
|
const hmac = crypto.createHmac("sha256", webhookSecret);
|
|
180
180
|
const expectedSignature = hmac.update(payload).digest("hex");
|
|
181
181
|
|
|
182
|
-
//
|
|
183
|
-
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
182
|
+
// Pre-hash both signatures using SHA-256 to ensure identical 32-byte buffer length.
|
|
183
|
+
// This prevents timing side-channels, signature length leakage, and RangeError exceptions on unequal buffer lengths.
|
|
184
|
+
const expectedHash = crypto
|
|
185
|
+
.createHash("sha256")
|
|
186
|
+
.update(expectedSignature)
|
|
187
|
+
.digest();
|
|
188
|
+
const actualHash = crypto
|
|
189
|
+
.createHash("sha256")
|
|
190
|
+
.update(signature || "")
|
|
191
|
+
.digest();
|
|
192
|
+
|
|
193
|
+
return crypto.timingSafeEqual(expectedHash, actualHash);
|
|
187
194
|
}
|
|
188
195
|
```
|
|
189
196
|
|