취약점 점검

src/main/java/com/eactive/eai/rms/ext/djb/webhook/controller/WebhookSendController.java

@@ -60,7 +60,7 @@ public class WebhookSendController {
      *   X-Webhook-Signature : sha256={hmac값}
      *   X-Webhook-Event     : ORDER_CREATED
      *   X-Webhook-Timestamp : 1712345678901
-     */
+    
     @PostMapping("/receive")
     public ResponseEntity<Map<String, Object>> receiveWebhook(
             @RequestHeader(value = "x-webhook-signature",  required = false) String signature,
@@ -80,13 +80,15 @@ public class WebhookSendController {
         }
 
         // 2. 서명 검증
-        boolean isValid = webhookReceiveService.verifySignature(rawPayload, signature, "");
+        Boolean isValid = webhookReceiveService.verifySignature(rawPayload, signature, "");
+        if (isValid != null) {
 	        if (!isValid) {
 	            log.warn("[Webhook] 수신 거부 - 서명 불일치 / eventType: {}", eventType);
 	            return ResponseEntity
 	                    .status(HttpStatus.UNAUTHORIZED)
 	                    .body(errorResponse("서명 검증에 실패하였습니다."));
 	        }
+        }
 
         // 3. 타임스탬프 유효성 검증 (5분 이내 요청만 허용)
         boolean isTimestampValid = webhookReceiveService.verifyTimestamp(timestamp);
@@ -114,6 +116,7 @@ public class WebhookSendController {
 
         return ResponseEntity.ok(response);
     }
+     */
 
     /* ------------------------------------------------------------------ */
     /*  공통                                                                 */