Reject malformed CoinPay webhook timestamps

Author: Codex Microtask Operator

apps/logicsrc-web/contract/logicsrc-web.contract.test.ts

@@ -411,6 +411,10 @@ describe("POST /api/webhooks/coinpay", () => {
     expect(verifyCoinPayWebhook(payload, `t=${timestamp},v1=${signature}`, secret)).toBe(true);
     expect(verifyCoinPayWebhook(payload, `t=${timestamp}, v1=${signature}`, secret)).toBe(true);
 
+    const malformedTimestamp = `${timestamp}abc`;
+    const malformedSignature = createHmac("sha256", secret).update(`${malformedTimestamp}.${payload}`).digest("hex");
+    expect(verifyCoinPayWebhook(payload, `t=${malformedTimestamp},v1=${malformedSignature}`, secret)).toBe(false);
+
     const response = await coinpayWebhook(
       new NextRequest("http://localhost/api/webhooks/coinpay", {
         method: "POST",

apps/logicsrc-web/src/lib/coinpay.ts

@@ -117,7 +117,7 @@ export function verifyCoinPayWebhook(
     const parts = signatureHeader.split(",").map((part) => part.trim());
     const timestamp = parts.find((part) => part.startsWith("t="))?.slice(2);
     const signature = parts.find((part) => part.startsWith("v1="))?.slice(3);
-    if (!timestamp || !signature) {
+    if (!timestamp || !signature || !/^\d+$/.test(timestamp)) {
       return false;
     }