From e64cf7003b8f1b648d610872e479480aecaf6c09 Mon Sep 17 00:00:00 2001 From: araharah-executor Date: Fri, 23 Oct 2026 01:34:53 +0800 Subject: [PATCH] =?UTF-8?q?docs(03-04):=20log=20debug=20round=206=20?= =?UTF-8?q?=E2=80=94=20signature-field=20HMAC=20erratum=20(the=20live=20bl?= =?UTF-8?q?ocker)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../03-DEVICE-MATRIX.md | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md b/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md index 3126e9a..c934b26 100644 --- a/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md +++ b/.planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md @@ -207,3 +207,28 @@ readings: - plain browser: `WA unknown/unknown · q 0ch · s malformed/tampered` **Re-test:** the probe line is what to report, verbatim, in the next message. + +## 2026-10-23 debug round 6 (DEFINITIVE — `s tampered` on a real webview) + +**Probe reading:** `WA ... · s tampered · loc denied` — the session gate was +rejecting the REAL initData (empty-initData theories were wrong; the webview +is live and Telegram-native). + +**Root cause:** `bot/src/security/initdata.ts` excluded the Ed25519 +`signature` field from the HMAC data-check-string. Per the official spec +(core.telegram.org/bots/webapps §Validating data received via the Mini App), +the bot's own HMAC check excludes **only** `hash`; the signature exclusion +belongs to THIRD-PARTY validation. Modern webviews append `signature`, so +every real client failed as "tampered" while all signature-less suite +vectors passed. + +**Fix (deploy `bedc8126`, 50 bot tests incl. new T2b signature-field +regression vectors):** HMAC dcs = fields minus `hash` only, in +initdata.ts + both test-side signing helpers. Erratum header updated. + +**Live post-fix proof:** a minted initData WITH a signature field → 200 at +the deployed origin (pre-fix equivalent → 401/tampered). + +**Re-test:** app should now validate → chain runs → permission ask / +LocationManager read → LIVE. Probe should read `s ok · loc live` on +success.