From 89abc8187593b295098604bc5f677c40d92fa009 Mon Sep 17 00:00:00 2001 From: Honey Date: Sat, 2 May 2026 20:55:26 +0200 Subject: [PATCH] fix: unwrap ALTCHA challenge .parameters wrapper before solving PoW The /api/altcha/challenge response is { parameters: { nonce, salt, ... } }. Destructuring the top level left nonce/salt/keyPrefix as undefined, causing Buffer.from(undefined) crash on every squid.wtf download attempt. Co-Authored-By: Claude Sonnet 4.6 --- backend/lib/squid.js | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/backend/lib/squid.js b/backend/lib/squid.js index e55c927..7c39231 100644 --- a/backend/lib/squid.js +++ b/backend/lib/squid.js @@ -97,15 +97,16 @@ function httpsPost(url, body, extraHeaders) { async function getAltchaCookie() { if (_captchaCookie && Date.now() - _captchaAt < CAPTCHA_TTL) return _captchaCookie; - // 1. Fetch challenge + // 1. Fetch challenge — response may wrap params in a "parameters" key const chRes = await httpsGet(`${SQUID_BASE}/api/altcha/challenge`); if (chRes.status !== 200) throw new Error(`ALTCHA challenge HTTP ${chRes.status}`); - const challenge = JSON.parse(chRes.body); + const chBody = JSON.parse(chRes.body); + const challenge = chBody.parameters ?? chBody; // unwrap { parameters: {...} } if present // 2. Solve PoW const solution = await solveAltcha(challenge); - // 3. Verify — server sets captcha_verified_at cookie + // 3. Verify — payload contains the unwrapped challenge params + our solution const payload = Buffer.from(JSON.stringify({ challenge, solution })).toString('base64'); const vRes = await httpsPost(`${SQUID_BASE}/api/altcha/verify`, { payload }); if (vRes.status !== 200) throw new Error(`ALTCHA verify HTTP ${vRes.status}`);