kmc7468/arkvault
1
0
Fork 0
mirror of https://github.com/kmc7468/arkvault.git synced 2026-02-04 16:16:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

클라이언트가 Decryption Oracle로 사용될 수 있는 취약점 수정

Browse Source
This commit is contained in:
static
2025-07-04 23:26:58 +09:00
parent 13bac59824
commit c9331ae5b7
12 changed files with 58 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/lib/services/auth.ts
View File

@@ -18,12 +18,12 @@ export const requestSessionUpgrade = async (
});
if (!res.ok) return false;
const { challenge }: SessionUpgradeResponse = await res.json();
const { id, challenge }: SessionUpgradeResponse = await res.json();
const answer = await decryptChallenge(challenge, decryptKey);
const answerSig = await signMessageRSA(answer, signKey);
res = await callPostApi<SessionUpgradeVerifyRequest>("/api/auth/upgradeSession/verify", {
answer: encodeToBase64(answer),
id,
answerSig: encodeToBase64(answerSig),
});
return res.ok;

4
src/lib/services/key.ts
View File

@@ -27,12 +27,12 @@ export const requestClientRegistration = async (
});
if (!res.ok) return false;
const { challenge }: ClientRegisterResponse = await res.json();
const { id, challenge }: ClientRegisterResponse = await res.json();
const answer = await decryptChallenge(challenge, decryptKey);
const answerSig = await signMessageRSA(answer, signKey);
res = await callPostApi<ClientRegisterVerifyRequest>("/api/client/register/verify", {
answer: encodeToBase64(answer),
id,
answerSig: encodeToBase64(answerSig),
});
return res.ok;