paivana

commit a5ab1015c3aea428cfffa34a144afedfd5e8afa4
parent 270f57b100bb28ff2d995658d9cae425b84efb28
Author: Christian Grothoff <christian@grothoff.org>
Date:   Thu,  6 Aug 2026 16:17:14 +0200

insist our contracts are well-formed

Diffstat:
M
src/backend/paivana-httpd_pay.c
 | 
14
+++++++++++---

1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/src/backend/paivana-httpd_pay.c b/src/backend/paivana-httpd_pay.c
@@ -249,9 +249,17 @@ check_contract (struct PayRequest *ph,
                 "Encountered contract with unexpected fields: %s@%u\n",
                 ename,
                 eline);
-    /* For now, we tolerate this and just continue.
-       This is a design decision that could be revised. */
-    return true;
+    /* Fail closed: returning true here would skip every check below --
+       the fulfillment_url binding, the base-URL containment test and
+       the max_pickup_time deadline -- and mint an access cookie for
+       whatever website the client named.  Tolerating unknown *extra*
+       fields is already what GNUNET_JSON_parse() does; a failure here
+       means a field we do look at was malformed. */
+    GNUNET_break_op (0);
+    ph->response = TALER_MHD_make_error (TALER_EC_PAIVANA_WRONG_ORDER,
+                                         ph->order_id);
+    ph->response_status = MHD_HTTP_CONFLICT;
+    return false;
   }
   if ( (NULL != target) &&
        (0 != strcmp (target,