Closed emanuelb closed 4 years ago
The call to const json = JSON.parse(jsonB64); in line 19 is done before the verification of the data in if (result) in line 30 https://github.com/MohGovIL/hamagen-react-native/blob/14dd43b9e0c502497969c836ba591d51989eb446/src/services/SigningService.ts#L19-L34 thus even not verified data will be passed to JSON.parse (which can be invalid or try to trigger DOS/other attacks)
const json = JSON.parse(jsonB64);
if (result)
fix: call to JSON.parse only if verification successful (line 31 inside the if (result) block)
Fixed at c2cfc6f2818a44f34f92b59cf276e53b7ed60ce6
The call to
const json = JSON.parse(jsonB64);
in line 19 is done before the verification of the data inif (result)
in line 30 https://github.com/MohGovIL/hamagen-react-native/blob/14dd43b9e0c502497969c836ba591d51989eb446/src/services/SigningService.ts#L19-L34 thus even not verified data will be passed to JSON.parse (which can be invalid or try to trigger DOS/other attacks)fix: call to JSON.parse only if verification successful (line 31 inside the
if (result)
block)