harden Stripe checkout webhook fields

2026-09-06 17:55:24 +03:00
parent c34b0edf15
commit 182f6dc05c
1 changed files with 4 additions and 2 deletions
@@ -1318,8 +1318,10 @@ const server = http.createServer(async (req, res) => {
        const o = olay.data?.object || {};
        switch (olay.type) {
          case 'checkout.session.completed': {
-            const email = (o.client_reference_id || o.customer_email || o.metadata?.email || '').toLowerCase();
-            const planId = o.metadata?.planId || 'pro';
+            const rawEmail = o.client_reference_id || o.customer_email || o.metadata?.email || '';
+            const email = typeof rawEmail === 'string' ? rawEmail.trim().toLowerCase() : '';
+            const rawPlanId = o.metadata?.planId;
+            const planId = typeof rawPlanId === 'string' && rawPlanId.trim() ? rawPlanId.trim() : 'pro';
            if (email) {
              store.setPlan(email, {
                plan: planId, kaynak: 'stripe',