Reject duplicate Web App data keys

[KnightNiwrem]

Summary

• reject duplicate URLSearchParams keys before token-based HMAC validation
• apply the same fail-fast check before third-party Ed25519 verification
• cover repeated signed fields, hash, and signature in regression tests

Testing

• formatting and lint checks pass
• source type-check passes
• 25 tests pass

---

Summary by cubic

Reject duplicate Web App data keys before HMAC or Ed25519 verification to prevent ambiguous parsing and signature bypass via repeated parameters. Previously duplicates were accepted with the last value used; now any duplicate key causes validation to return false.

• Applies to both validateWebAppData and validateWebAppDataThirdParty; covers duplicates in signed fields and meta fields (query_id, chat_type, hash, signature).
• Introduces a fail-fast hasDuplicateKeys helper for simpler, centralized detection; public API and return values are unchanged.
• Adds regression tests for both paths to assert rejection of duplicates.

Migration

• Ensure Web App init data has unique keys. Do not send repeated hash, signature, or any other duplicate parameters.

^{Written for commit daf0a42. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: da865d7c-0e6a-459f-81df-f1c59fd92c97

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}