fix(cookie-signature): compare full signature in unsign (GHSA-63x4-8g8c-vhww) - #520

Fixes the outstanding advisory GHSA-63x4-8g8c-vhww — the last one still lacking a code fix.

The bug

unsign copied the untrusted value into a buffer allocated to the length of the expected MAC, so Buffer.write silently discarded everything past that length. Only a prefix of the value ever reached timingSafeEqual:

const macBuffer = Buffer.from(mac)
const valBuffer = Buffer.alloc(macBuffer.length)  // sized to the expected mac
valBuffer.write(val)                              // anything longer is truncated

A valid cookie with arbitrary data appended therefore verified successfully:

const cookie = sign('mysessionid', 'secret')
unsign(`${cookie}tampered`, 'secret')  // 'mysessionid' — expected false

Reproduced against master before the fix. A wrong secret was still correctly rejected; it is specifically trailing-garbage tampering that passed.

The fix

unsign now compares only the signature, rather than recomputing the whole signed string and comparing that against the whole cookie.

The payload is sliced out of the value being verified, so the recomputed `${str}.${sig}` shares its prefix with val by construction — the old comparison spent most of its work checking str against itself. Only the signature is untrusted, and an unpadded base64 SHA-256 digest is always exactly 43 bytes, so the expected side is fixed-width. A signature of any other length is rejected outright instead of being truncated to fit.

A value containing no . is now handled explicitly rather than relying on slice(0, -1) happening to produce a mismatching length.

Equivalence and performance

Signature-only comparison was differentially tested against whole-string comparison over 432 probes (payloads including empty/multibyte/2 KB/dot-laden, four secrets, and six tampering shapes): zero disagreements.

It is also faster, since the redundant prefix encode scaled with payload size:

For the record, a Buffer-free variant using TextEncoder/Uint8Array was measured and rejected: TextEncoder.encode carries a ~1.15µs fixed cost, ~18× slower than Buffer.from at cookie-sized strings, for no security gain (Buffer is a Uint8Array subclass; the bug was alloc+write truncation, which Buffer.from cannot express).

Compatibility

Values produced by sign verify exactly as before — the round trip is unchanged. Only values that were never validly signed change from accepted to rejected. No other package needed a source change; changesets will bump @tinyhttp/res/@tinyhttp/app as dependents.

Tests

Added a regression test for the reporter's PoC, plus coverage for truncated signatures, values with no . separator, and values containing dots.

Verified the regression test actually guards the vuln — against the unfixed source it fails:

× should reject a valid cookie with appended data
  AssertionError: expected 'mysessionid' to be false

Full suite: 841 passed | 3 skipped.

🤖 Generated with Claude Code