Harden uint8arrayFromHexString

tkhq · Mar 27, 2024 · 1fa5d30 · 1fa5d30
1 parent 330b3e8
commit 1fa5d30
Show file tree

Hide file tree

Showing 4 changed files with 43 additions and 2 deletions.
diff --git a/auth/index.html b/auth/index.html
@@ -213,6 +213,9 @@ <h2>Message log</h2>
        * @returns {Uint8Array}
        */
       var uint8arrayFromHexString = function(hexString) {
+        if (!hexString || hexString.length % 2 != 0 || !/^[0-9A-Fa-f]+$/.test(hexString)) {
+          throw new Error('cannot create uint8array from invalid hex string: "' + hexString + '"');
+        }
         return new Uint8Array(hexString.match(/../g).map(h=>parseInt(h,16)));
       }
 

diff --git a/auth/index.test.js b/auth/index.test.js
@@ -161,6 +161,23 @@ describe("TKHQ", () => {
 
   it("contains uint8arrayFromHexString", () => {
     expect(TKHQ.uint8arrayFromHexString("627566666572").toString()).toEqual("98,117,102,102,101,114");
+
+    // Error case: bad value
+    expect(() => {
+      TKHQ.uint8arrayFromHexString({});
+    }).toThrow('cannot create uint8array from invalid hex string: "[object Object]"');
+    // Error case: empty string
+    expect(() => {
+      TKHQ.uint8arrayFromHexString("");
+    }).toThrow('cannot create uint8array from invalid hex string: ""');
+    // Error case: odd number of characters
+    expect(() => {
+      TKHQ.uint8arrayFromHexString("123");
+    }).toThrow('cannot create uint8array from invalid hex string: "123"');
+    // Error case: bad characters outside of hex range
+    expect(() => {
+      TKHQ.uint8arrayFromHexString("oops");
+    }).toThrow('cannot create uint8array from invalid hex string: "oops"');
   })
 
   it("contains bigIntToHex", () => {

diff --git a/export/index.html b/export/index.html
@@ -201,8 +201,12 @@ <h2>Message log</h2>
        * @param {string} hexString
        * @returns {Uint8Array}
        */
-       const uint8arrayFromHexString = hexString => 
-        new Uint8Array(hexString.match(/../g).map(h=>parseInt(h,16)));
+       const uint8arrayFromHexString = function(hexString) {
+        if (!hexString || hexString.length % 2 != 0 || !/^[0-9A-Fa-f]+$/.test(hexString)) {
+          throw new Error('cannot create uint8array from invalid hex string: "' + hexString + '"');
+        }
+        return new Uint8Array(hexString.match(/../g).map(h=>parseInt(h,16)));
+      }
 
       /**
         * Takes a Uint8Array and returns a hex string

diff --git a/export/index.test.js b/export/index.test.js
@@ -125,6 +125,23 @@ describe("TKHQ", () => {
 
   it("contains uint8arrayFromHexString", () => {
     expect(TKHQ.uint8arrayFromHexString("627566666572").toString()).toEqual("98,117,102,102,101,114");
+
+    // Error case: bad value
+    expect(() => {
+      TKHQ.uint8arrayFromHexString({});
+    }).toThrow('cannot create uint8array from invalid hex string: "[object Object]"');
+    // Error case: empty string
+    expect(() => {
+      TKHQ.uint8arrayFromHexString("");
+    }).toThrow('cannot create uint8array from invalid hex string: ""');
+    // Error case: odd number of characters
+    expect(() => {
+      TKHQ.uint8arrayFromHexString("123");
+    }).toThrow('cannot create uint8array from invalid hex string: "123"');
+    // Error case: bad characters outside of hex range
+    expect(() => {
+      TKHQ.uint8arrayFromHexString("oops");
+    }).toThrow('cannot create uint8array from invalid hex string: "oops"');
   })
 
   it("logs messages and sends messages up", async () => {