tlock: harden hex helpers and add seal/open input validation - #196
Closed
karagozemin wants to merge 1 commit into
Closed
tlock: harden hex helpers and add seal/open input validation#196karagozemin wants to merge 1 commit into
karagozemin wants to merge 1 commit into
Conversation
- fromHex now rejects non-hex characters instead of producing NaN bytes - add isValidHex helper and re-export it - sealBid guards against a non-positive round and wrong-length nonce - openBid guards against an empty ciphertext - add unit tests for all of the above
There was a problem hiding this comment.
Pull request overview
This PR hardens tlock input handling by adding strict hex validation helpers and by introducing early guard clauses in bid sealing/opening paths, aligning behavior with Issue #191’s goal of failing loudly on malformed inputs.
Changes:
- Added
isValidHexand tightenedfromHexvalidation to reject non-hex characters. - Added input guard clauses to
sealBid(round/nonce) andopenBid(empty ciphertext). - Added unit tests covering the new validation behavior.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/tlock/src/seal.ts | Adds guard clauses for round, nonce length, and empty ciphertext before crypto operations. |
| packages/tlock/src/seal.test.ts | Adds tests ensuring new sealBid/openBid validation rejects invalid inputs. |
| packages/tlock/src/index.ts | Re-exports isValidHex from the package entry point. |
| packages/tlock/src/commitment.ts | Introduces isValidHex and adds strict character validation to fromHex. |
| packages/tlock/src/commitment.test.ts | Adds tests for isValidHex and fromHex validation behavior. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+45
to
+47
| if (round < 1) { | ||
| throw new RangeError(`round must be a positive integer, got ${round}`); | ||
| } |
Comment on lines
88
to
+93
| export function fromHex(hex: string): Uint8Array { | ||
| const clean = hex.startsWith("0x") ? hex.slice(2) : hex; | ||
| if (clean.length % 2 !== 0) throw new Error("odd hex length"); | ||
| if (!HEX_CHARS_RE.test(clean)) { | ||
| throw new Error("invalid hex string: expected only [0-9a-fA-F] characters"); | ||
| } |
Comment on lines
+60
to
+63
| await assert.rejects( | ||
| () => sealBid({ value: 1n, nonce: new Uint8Array(16), round: 5, client }), | ||
| /nonce must be 32 bytes/, | ||
| ); |
Comment on lines
+71
to
+75
| test("fromHex rejects non-hex characters and odd length", () => { | ||
| assert.throws(() => fromHex("zz"), /invalid hex/); | ||
| assert.throws(() => fromHex("12g4"), /invalid hex/); | ||
| assert.throws(() => fromHex("abc"), /odd hex length/); | ||
| }); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #191