From da14725a96619f1330e19478cc2393c2f690c2bf Mon Sep 17 00:00:00 2001 From: Claire Date: Fri, 26 Feb 2021 17:40:27 +0100 Subject: [PATCH] Fix crash on receiving requests with missing Digest header (#15782) * Fix crash on receiving requests with missing Digest header Return an error pointing out that Digest is missing, instead of crashing. Fixes #15743 * Fix from review feedback --- app/controllers/concerns/signature_verification.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/app/controllers/concerns/signature_verification.rb b/app/controllers/concerns/signature_verification.rb index fc3978fbbd..4dd0cac55d 100644 --- a/app/controllers/concerns/signature_verification.rb +++ b/app/controllers/concerns/signature_verification.rb @@ -133,6 +133,7 @@ module SignatureVerification def verify_body_digest! return unless signed_headers.include?('digest') + raise SignatureVerificationError, 'Digest header missing' unless request.headers.key?('Digest') digests = request.headers['Digest'].split(',').map { |digest| digest.split('=', 2) }.map { |key, value| [key.downcase, value] } sha256 = digests.assoc('sha-256')