fix: possible panic case if ios payment callback comes from unauthori…

…sed party
awa · Jul 10, 2024 · c6ac249 · c6ac249
1 parent 1e659e4
commit c6ac249
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/appstore/cert.go b/appstore/cert.go
@@ -52,7 +52,9 @@ func (c *Cert) extractCertByIndex(tokenStr string, index int) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-
+	if len(header.X5c) <= 0 || index >= len(header.X5c) {
+		return nil, errors.New("failed to extract cert from x5c header, possible unauthorised request detected")
+	}
 	certByte, err := base64.StdEncoding.DecodeString(header.X5c[index])
 	if err != nil {
 		return nil, err