Merge pull request #291 from fans3210/master

fix: possible panic case if ios payment callback comes from unauthorised party
awa · Jul 10, 2024 · 63ac21b · 63ac21b
2 parents 1e659e4 + c6ac249
commit 63ac21b
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/appstore/cert.go b/appstore/cert.go
@@ -52,7 +52,9 @@ func (c *Cert) extractCertByIndex(tokenStr string, index int) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-
+	if len(header.X5c) <= 0 || index >= len(header.X5c) {
+		return nil, errors.New("failed to extract cert from x5c header, possible unauthorised request detected")
+	}
 	certByte, err := base64.StdEncoding.DecodeString(header.X5c[index])
 	if err != nil {
 		return nil, err