aiolabs/lightning-pub
2
0
Fork 0
Code Issues 9 Pull requests 4 Projects Releases Packages Wiki Activity Actions

comments/messages

Browse source
This commit is contained in:
Daniel Lugo 2020-07-25 10:16:18 -04:00
parent d12656d154
commit 7ca39103b2
1 changed files with 10 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

14
services/gunDB/contact-api/jobs/onAcceptedRequests.js
View file

@ -51,14 +51,20 @@ const onAcceptedRequests = (user, SEA) => {
' this can be due to nulling out an old request (if null) or something else happened (please look at the output)' ' this can be due to nulling out an old request (if null) or something else happened (please look at the output)'
) )
} }
// get the recipient pub from the stored request to avoid an attacker
// overwriting the handshake request in the root graph
const recipientPub = await SEA.decrypt(storedReq.recipientPub, mySecret) const recipientPub = await SEA.decrypt(storedReq.recipientPub, mySecret)
if (typeof recipientPub !== 'string') { if (typeof recipientPub !== 'string') {
throw new TypeError() throw new TypeError(
`Expected storedReq.recipientPub to be an string, instead got: ${recipientPub}`
)
} }
if (await Utils.successfulHandshakeAlreadyExists(recipientPub)) { if (await Utils.successfulHandshakeAlreadyExists(recipientPub)) {
return return
} }
const requestAddress = await SEA.decrypt( const requestAddress = await SEA.decrypt(
storedReq.handshakeAddress, storedReq.handshakeAddress,
mySecret mySecret
@ -101,9 +107,9 @@ const onAcceptedRequests = (user, SEA) => {
return return
} }
// The response can be decrypted with the same secret regardless of who // The response can be decrypted with the same secret regardless
// wrote to it last (see HandshakeRequest definition). // of who wrote to it last (see HandshakeRequest definition). This
// This could be our feed ID for the recipient, or the recipient's feed // could be our feed ID for the recipient, or the recipient's feed
// id if he accepted the request. // id if he accepted the request.
const feedID = await SEA.decrypt(sentReq.response, ourSecret) const feedID = await SEA.decrypt(sentReq.response, ourSecret)