From 84ce2b8155c6867b7f8ecae5a2b1bd89153d7464 Mon Sep 17 00:00:00 2001
From: ht <hikmet@texmart.com>
Date: Sun, 6 Sep 2026 17:44:43 +0300
Subject: [PATCH] validate Stripe webhook event shape

---
 server/billing.mjs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/server/billing.mjs b/server/billing.mjs
index 49ea83a..89e729a 100644
--- a/server/billing.mjs
+++ b/server/billing.mjs
@@ -114,7 +114,10 @@ export function verifyWebhook(hamGovde, imzaBasligi, { tolerans = 300 } = {}) {
   const b = Buffer.from(v1, 'utf8');
   if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) throw new Error('İmza doğrulanamadı');
 
-  return JSON.parse(hamGovde);
+  const olay = JSON.parse(hamGovde);
+  if (!olay || typeof olay !== 'object' || Array.isArray(olay) || typeof olay.type !== 'string' || !olay.type.trim())
+    throw new Error('Stripe webhook olay biçimi geçersiz');
+  return olay;
 }
 
 /** Stripe Price ID → plan kimliği */