paivana

commit fdd2b9dd38a08d1b51977be63bf884b8becdc71a
parent b3e65b66e2267b27eee9fc41e9bf7f10f362985e
Author: Christian Grothoff <christian@grothoff.org>
Date:   Tue,  4 Aug 2026 15:11:36 +0200

check target website is reasonable

Diffstat:
M
src/backend/paivana-httpd_pay.c
 | 
17
++++++++++++++++-

1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/src/backend/paivana-httpd_pay.c b/src/backend/paivana-httpd_pay.c
@@ -183,7 +183,7 @@ check_contract (struct PayRequest *ph,
   const char *target = NULL;
   struct GNUNET_JSON_Specification spec[] = {
     GNUNET_JSON_spec_mark_optional (
-      GNUNET_JSON_spec_string ("fulfillment_url",
+      TALER_JSON_spec_web_url ("fulfillment_url",
                                &target),
       NULL),
     GNUNET_JSON_spec_mark_optional (
@@ -220,6 +220,21 @@ check_contract (struct PayRequest *ph,
     ph->response_status = MHD_HTTP_CONFLICT;
     return false;
   }
+  if ( ( (NULL == target) &&
+         (0 != strncmp (ph->website,
+                        PH_base_url,
+                        strlen (PH_base_url))) ) ||
+       (! TALER_is_web_url (ph->website)) )
+  {
+    /* Bad: the order has no fulfillment URL, and on top of that
+       the target given is not from our domain or not a well-formed
+       URL. Reject hard. */
+    GNUNET_break_op (0);
+    ph->response = TALER_MHD_make_error (TALER_EC_PAIVANA_INVALID_TARGET,
+                                         ph->website);
+    ph->response_status = MHD_HTTP_CONFLICT;
+    return false;
+  }
   if (GNUNET_TIME_timestamp_cmp (ph->cur_time,
                                  >,
                                  max_time))