fix(payments): reject HTML-special chars in product titles (VK payment guard)

A product title containing & < > " ' silently breaks VK purchases: VK HTML-escapes the character in its order_status_change payment-callback echo (e.g. " -> ") but signs the notification over a different form, so the gateway's signature check no longer matches ("vk callback: bad signature") and the purchase never confirms — while get_item (whose request carries no title) still passes. validateProduct now rejects those characters at the admin catalog editor — the single write path for CreateProduct/UpdateProduct/SetProductActive — so a title can't reintroduce the break. Reject, not transform: the operator retypes a clean title (« » guillemets, not straight quotes), so the stored value stays identical everywhere (storefront, wallet, VK box). Docs: docs/PAYMENTS.md §7 + agent field notes; Go Doc on validateProduct. Test: validateProduct HTML-special-char cases. No wire/schema change.
2026-07-16 20:57:04 +02:00
parent 69246eb0c0
commit f60327c1ce
4 changed files with 34 additions and 6 deletions
@@ -56,16 +56,25 @@ func validCurrency(c Currency) bool {
 	return false
 }

-// validateProduct checks a product's composition and prices. When sellable is true (the product is
-// or is becoming active) it also enforces the storefront shape: a pack (the chips atom ⇒ a money
-// price per method and no CHIP price, chips-only) or a value (no chips ⇒ a single CHIP price and no
-// money price). The tournament atom is never sellable (its economy is the tournament stage), so an
-// active product may not carry it; an archived draft may (a template for later) and skips the shape
-// check.
+// validateProduct checks a product's composition and prices. The title must be non-empty and free of
+// the HTML-special characters & < > " ' (they break VK's payment callback — see the inline note).
+// When sellable is true (the product is or is becoming active) it also enforces the storefront shape:
+// a pack (the chips atom ⇒ a money price per method and no CHIP price, chips-only) or a value (no
+// chips ⇒ a single CHIP price and no money price). The tournament atom is never sellable (its economy
+// is the tournament stage), so an active product may not carry it; an archived draft may (a template
+// for later) and skips the shape check.
 func validateProduct(in ProductInput, sellable bool) error {
 	if strings.TrimSpace(in.Title) == "" {
 		return errors.New("product title is required")
 	}
+	// Reject the HTML-special characters in a title. VK HTML-escapes them in its order_status_change
+	// payment echo (e.g. `"` -> `&quot;`) but computes the notification signature over a different
+	// form, so our callback signature check no longer matches and the purchase cannot be confirmed.
+	// Titles never need them — use « » guillemets, not straight quotes. The rule holds for drafts too,
+	// since a draft is sold later.
+	if i := strings.IndexAny(in.Title, "&<>\"'"); i >= 0 {
+		return fmt.Errorf("product title must not contain %q — use « » guillemets, not straight quotes (VK payment callbacks break on it)", in.Title[i:i+1])
+	}
 	if len(in.Atoms) == 0 {
 		return errors.New("product needs at least one atom")
 	}