Language: TypeScript
Label: safe
CWE: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.

Code:
function inbox(ctx: Router.RouterContext) {
	// 署名の検証
	// referenced: https://github.com/mei23/misskey/pull/4749
	let signature: httpSignature.IParsedSignature;

	try {
		// ヘッダーの検証はライブラリに投げる
		signature = httpSignature.parseRequest(ctx.req, { "headers": ["(request-target)", "digest", "host", "date"] });
	} catch (e) {
		logger.warn("inbox: signature parse error");
		ctx.status = 401;
		return;
	}

	// Digestヘッダーの検証
	const digest = ctx.req.headers.digest;
	if (typeof digest !== "string") {
		//logger.warn("Invalid digest (not string)")
		ctx.status = 401;
		return;
	}

	const match = digest.match(/^([0-9A-Za-z-]+)=(.+)$/);

	if (match == null) {
		logger.warn("Invalid digest (match == null)")
		ctx.status = 401;
		return;
	}

	const digestAlgo = match[1];
	const digestExpected = match[2];

	if (digestAlgo.toUpperCase() !== "SHA-256") {
		// アルゴリズムをサポートしていない
		logger.warn("digestAlgo is not supported")
		ctx.status = 401;
		return;
	}

	const digestActual = crypto.createHash("sha256").update(ctx.request.rawBody).digest("base64")

	if (digestExpected !== digestActual) {
		// 不正なダイジェスト
		logger.warn("Invalid digest (digestExpected !== digestActual)")
		ctx.status = 401;
		return;
	}


	if (!signature.params.headers.includes("host") || ctx.headers.host !== config.host) {
		// Host not specified or not match.
		logger.warn("Invalid host header")
		ctx.status = 400;
		return;
	}

	const activity = ctx.request.body as IActivity;
	processInbox(activity, signature);

	ctx.status = 202;
}