nbd-wtf / go-nostr

Nostr library for Golang
MIT License
364 stars 102 forks source link

security(event, checksig): validate correction of id. #146

Closed kehiy closed 1 month ago

kehiy commented 1 month ago

with removing new conditions on checksig, you can see new invalid test case will pass the test!

fiatjaf commented 1 month ago

My answers to this on DM:

fiatjaf, [9/11/24 7:12 PM] the signature is being checked against the correct id already

fiatjaf, [9/11/24 7:12 PM] what isn't being checked is if the id in the event is the correct id

fiatjaf, [9/11/24 7:12 PM] but that is checked in other parts of the code

fiatjaf, [9/11/24 7:12 PM] I didn't want to duplicate the checks

kehiy commented 1 month ago

Thanks.