fix(core): validate protobuf SHA-256 hash lengths

Author: sameerank

packages/core/src/configuration/ufc-protobuf.test.ts

@@ -366,6 +366,17 @@ describe('UFC protobuf decoder', () => {
     ).toMatchObject({ value: false, reason: 'ERROR', errorCode: 'PARSE_ERROR' })
   })
 
+  it.each([11, 12] as const)('reports an invalid SHA-256 hash length for condition kind %s', (conditionKind) => {
+    expect(
+      evaluateBoolean({ conditionKind, shaHashes: ['00'] }, { targetingKey: 'user', country: 'US' })
+    ).toMatchObject({
+      value: false,
+      reason: 'ERROR',
+      errorCode: 'PARSE_ERROR',
+      errorMessage: 'SHA-256 hashes must contain 32 bytes',
+    })
+  })
+
   it('lazily compiles each regex once per configuration', () => {
     const configuration = decodeRules({ conditionKind: 7 })
     const regexes = configuration.regexes

packages/core/src/evaluation/evaluateProtobufConfiguration.ts

@@ -31,6 +31,7 @@ import { UFC_REASON, UFC_VARIATION_TYPE } from './ufc-enums'
 const SUPPORTED_FEATURE_LEVEL = 0
 const compiledRegexCache = new WeakMap<FlagsConfiguration, Map<number, RegExp | null>>()
 const validatedSortedArrays = new WeakSet<object>()
+const validatedSha256Arrays = new WeakSet<object>()
 
 export function evaluateProtobufConfiguration<T extends FlagValueType>(
   configuration: FlagsConfiguration,
@@ -443,10 +444,19 @@ function isJsonValue(value: unknown): value is FlagValue {
 }
 
 function containsBytes(values: Uint8Array[], value: Uint8Array): boolean {
+  validateSha256Hashes(values)
   ensureSorted(values, compareBytes, 'SHA-256 hashes')
   return containsSorted(values, (candidate) => compareBytes(candidate, value))
 }
 
+function validateSha256Hashes(values: Uint8Array[]): void {
+  if (validatedSha256Arrays.has(values)) return
+  if (values.some((hash) => hash.length !== 32)) {
+    throw new FlagConfigurationError('SHA-256 hashes must contain 32 bytes')
+  }
+  validatedSha256Arrays.add(values)
+}
+
 function compareStrings(left: string, right: string): number {
   return left === right ? 0 : left < right ? -1 : 1
 }