@couch-kit/core 0.10.1 → 0.10.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @couch-kit/core
 
+## 0.10.2
+
+### Patch Changes
+
+- [#225](https://github.com/faluciano/react-native-couch-kit/pull/225) [`072bc40`](https://github.com/faluciano/react-native-couch-kit/commit/072bc40f923dd9169f2bcb344deb733223402323) Thanks [@faluciano](https://github.com/faluciano)! - **Security:** `actionValidator` drops an action whose validator throws. Before, the middleware error boundary passed it on to the reducer, so a malformed payload (exactly what makes a validator like `(a) => a.payload.points > 0` throw) skipped validation. `isValidSecret` now also rejects secrets longer than 128 hex characters (`MAX_SECRET_HEX_LENGTH`), so a client cannot make the host hash and store an arbitrarily long string.
+
 ## 0.10.1
 
 ### Patch Changes

package/README.md

@@ -84,7 +84,7 @@ actionLogger({ collapsed: false }); // expanded groups
 
 #### `actionValidator(schema)`
 
-Validates actions against a schema before they reach the reducer. If a validator returns `false`, the action is dropped and a warning is logged.
+Validates actions against a schema before they reach the reducer. If a validator returns `false` or throws, the action is dropped and a warning is logged.
 
 ```typescript
 import { actionValidator, type ActionSchema } from "@couch-kit/core";
@@ -188,7 +188,7 @@ try {
 
 #### `isValidSecret(secret: string): boolean`
 
-Validates that a string is a valid UUID format (32+ hex characters, with or without dashes).
+Validates that a string is a valid UUID format (32 to 128 hex characters, with or without dashes).
 
 #### `derivePlayerId(secret: string): Promise<string>`
 

package/dist/index.cjs

@@ -52,6 +52,7 @@ __export(exports_src, {
   KEEPALIVE_TIMEOUT: () => KEEPALIVE_TIMEOUT,
   MAX_FRAME_SIZE: () => MAX_FRAME_SIZE,
   MAX_PENDING_PINGS: () => MAX_PENDING_PINGS,
+  MAX_SECRET_HEX_LENGTH: () => MAX_SECRET_HEX_LENGTH,
   MAX_SYNC_INTERVAL: () => MAX_SYNC_INTERVAL,
   MessageTypes: () => MessageTypes,
   SYNC_BACKOFF_FACTOR: () => SYNC_BACKOFF_FACTOR,
@@ -142,7 +143,15 @@ function actionValidator(schema) {
     if (getInternalTypes().has(action.type))
       return next(action);
     const validate = schema[action.type];
-    if (validate && !validate(action)) {
+    if (!validate)
+      return next(action);
+    let valid;
+    try {
+      valid = validate(action);
+    } catch {
+      valid = false;
+    }
+    if (!valid) {
       console.warn(`[couch-kit] Action "${action.type}" failed validation, skipping`);
       return _api.getState();
     }
@@ -399,9 +408,12 @@ function generateId() {
   const b = Math.random().toString(36).substring(2, 10);
   return a + b;
 }
+var MAX_SECRET_HEX_LENGTH = 128;
 function isValidSecret(secret) {
+  if (secret.length > MAX_SECRET_HEX_LENGTH * 2)
+    return false;
   const hex = secret.replace(/-/g, "");
-  return hex.length >= 32 && /^[0-9a-f]+$/i.test(hex);
+  return hex.length >= 32 && hex.length <= MAX_SECRET_HEX_LENGTH && /^[0-9a-f]+$/i.test(hex);
 }
 async function derivePlayerId(secret) {
   if (typeof globalThis.crypto !== "undefined" && typeof globalThis.crypto.subtle?.digest === "function") {

package/dist/index.js

@@ -72,7 +72,15 @@ function actionValidator(schema) {
     if (getInternalTypes().has(action.type))
       return next(action);
     const validate = schema[action.type];
-    if (validate && !validate(action)) {
+    if (!validate)
+      return next(action);
+    let valid;
+    try {
+      valid = validate(action);
+    } catch {
+      valid = false;
+    }
+    if (!valid) {
       console.warn(`[couch-kit] Action "${action.type}" failed validation, skipping`);
       return _api.getState();
     }
@@ -329,9 +337,12 @@ function generateId() {
   const b = Math.random().toString(36).substring(2, 10);
   return a + b;
 }
+var MAX_SECRET_HEX_LENGTH = 128;
 function isValidSecret(secret) {
+  if (secret.length > MAX_SECRET_HEX_LENGTH * 2)
+    return false;
   const hex = secret.replace(/-/g, "");
-  return hex.length >= 32 && /^[0-9a-f]+$/i.test(hex);
+  return hex.length >= 32 && hex.length <= MAX_SECRET_HEX_LENGTH && /^[0-9a-f]+$/i.test(hex);
 }
 async function derivePlayerId(secret) {
   if (typeof globalThis.crypto !== "undefined" && typeof globalThis.crypto.subtle?.digest === "function") {
@@ -386,6 +397,7 @@ export {
   KEEPALIVE_TIMEOUT,
   MAX_FRAME_SIZE,
   MAX_PENDING_PINGS,
+  MAX_SECRET_HEX_LENGTH,
   MAX_SYNC_INTERVAL,
   MessageTypes,
   SYNC_BACKOFF_FACTOR,

package/lib/constants.d.ts

@@ -42,8 +42,12 @@ export declare const KEEPALIVE_TIMEOUT = 10000;
  * falling back to `crypto.getRandomValues()` for older environments.
  */
 export declare function generateId(): string;
+/** Longest secret, in hex characters, the host accepts. A UUID is 32. */
+export declare const MAX_SECRET_HEX_LENGTH = 128;
 /**
- * Validates that a string looks like a UUID (with or without dashes, 32+ hex chars).
+ * Validates that a string looks like a UUID (with or without dashes, 32 to
+ * {@link MAX_SECRET_HEX_LENGTH} hex chars). The upper bound keeps a client from
+ * making the host hash and store an arbitrarily long string.
  */
 export declare function isValidSecret(secret: string): boolean;
 /**

package/lib/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAIxD,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,0DAA0D;AAC1D,eAAO,MAAM,eAAe,QAAQ,CAAC;AAErC,8FAA8F;AAC9F,eAAO,MAAM,cAAc,QAAc,CAAC;AAE1C,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,oEAAoE;AACpE,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC,qGAAqG;AACrG,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,+EAA+E;AAC/E,eAAO,MAAM,0BAA0B,QAAgB,CAAC;AAExD,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAExC,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAwBnC;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGrD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBpE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGrD"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAIxD,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,0DAA0D;AAC1D,eAAO,MAAM,eAAe,QAAQ,CAAC;AAErC,8FAA8F;AAC9F,eAAO,MAAM,cAAc,QAAc,CAAC;AAE1C,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,oEAAoE;AACpE,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC,qGAAqG;AACrG,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,+EAA+E;AAC/E,eAAO,MAAM,0BAA0B,QAAgB,CAAC;AAExD,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAExC,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAwBnC;AAED,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAQrD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBpE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGrD"}

package/lib/middleware.d.ts

@@ -53,7 +53,8 @@ export type ActionSchema<A extends IAction> = {
 };
 /**
  * Middleware that validates actions against a schema before they reach the
- * reducer. Invalid actions are silently dropped (with a console warning).
+ * reducer. Invalid actions are dropped with a console warning. A validator
+ * that throws counts as a failed validation.
  *
  * Internal actions are never validated — they always pass through.
  *

package/lib/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,OAAO,EACP,cAAc,EACd,WAAW,EACZ,MAAM,YAAY,CAAC;AAOpB,oDAAoD;AACpD,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,UAAU;IACjD,QAAQ,EAAE,MAAM,CAAC,CAAC;CACnB;AAED,yEAAyE;AACzE,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,IAAI,CACxE,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,KAC1B,CAAC,CAAC;AAEP;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,CACpB,CAAC,SAAS,UAAU,GAAG,UAAU,EACjC,CAAC,SAAS,OAAO,GAAG,OAAO,IACzB,CACF,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,KAClB,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAM9E;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,EACrE,GAAG,WAAW,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GACjC,CACD,OAAO,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAC3C,WAAW,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,CAwDzC;AAMD,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,EAClE,OAAO,CAAC,EAAE,mBAAmB,GAC5B,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAmBlB;AAeD;;;GAGG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,OAAO,IAAI;KAC3C,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG;QAAE,IAAI,EAAE,CAAC,CAAA;KAAE,KAAK,OAAO;CACxD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,EACrE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,GACtB,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAgBlB"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,OAAO,EACP,cAAc,EACd,WAAW,EACZ,MAAM,YAAY,CAAC;AAOpB,oDAAoD;AACpD,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,UAAU;IACjD,QAAQ,EAAE,MAAM,CAAC,CAAC;CACnB;AAED,yEAAyE;AACzE,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,IAAI,CACxE,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,KAC1B,CAAC,CAAC;AAEP;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,CACpB,CAAC,SAAS,UAAU,GAAG,UAAU,EACjC,CAAC,SAAS,OAAO,GAAG,OAAO,IACzB,CACF,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,KAClB,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAM9E;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,EACrE,GAAG,WAAW,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GACjC,CACD,OAAO,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAC3C,WAAW,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,CAwDzC;AAMD,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,EAClE,OAAO,CAAC,EAAE,mBAAmB,GAC5B,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAmBlB;AAeD;;;GAGG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,OAAO,IAAI;KAC3C,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG;QAAE,IAAI,EAAE,CAAC,CAAA;KAAE,KAAK,OAAO;CACxD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,EACrE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,GACtB,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CA6BlB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@couch-kit/core",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "publishConfig": {
     "access": "public",
     "provenance": true

package/src/constants.ts

@@ -84,12 +84,22 @@ export function generateId(): string {
   return a + b;
 }
 
+/** Longest secret, in hex characters, the host accepts. A UUID is 32. */
+export const MAX_SECRET_HEX_LENGTH = 128;
+
 /**
- * Validates that a string looks like a UUID (with or without dashes, 32+ hex chars).
+ * Validates that a string looks like a UUID (with or without dashes, 32 to
+ * {@link MAX_SECRET_HEX_LENGTH} hex chars). The upper bound keeps a client from
+ * making the host hash and store an arbitrarily long string.
  */
 export function isValidSecret(secret: string): boolean {
+  if (secret.length > MAX_SECRET_HEX_LENGTH * 2) return false;
   const hex = secret.replace(/-/g, "");
-  return hex.length >= 32 && /^[0-9a-f]+$/i.test(hex);
+  return (
+    hex.length >= 32 &&
+    hex.length <= MAX_SECRET_HEX_LENGTH &&
+    /^[0-9a-f]+$/i.test(hex)
+  );
 }
 
 /**

package/src/middleware.ts

@@ -178,7 +178,8 @@ export type ActionSchema<A extends IAction> = {
 
 /**
  * Middleware that validates actions against a schema before they reach the
- * reducer. Invalid actions are silently dropped (with a console warning).
+ * reducer. Invalid actions are dropped with a console warning. A validator
+ * that throws counts as a failed validation.
  *
  * Internal actions are never validated — they always pass through.
  *
@@ -196,8 +197,21 @@ export function actionValidator<S extends IGameState, A extends IAction>(
     if (getInternalTypes().has(action.type)) return next(action);
 
     const validate = schema[action.type as A["type"]];
+    if (!validate) return next(action);
+
+    // A validator that throws has not said yes. Malformed client payloads are
+    // exactly what makes a validator like `(a) => a.payload.points > 0` throw,
+    // so a throw counts as a failed validation. Letting the middleware error
+    // boundary fall through to `next` would hand the reducer the very action
+    // the validator exists to stop.
+    let valid: boolean;
+    try {
+      valid = validate(action as A & { type: A["type"] });
+    } catch {
+      valid = false;
+    }
 
-    if (validate && !validate(action as A & { type: A["type"] })) {
+    if (!valid) {
       console.warn(
         `[couch-kit] Action "${action.type}" failed validation, skipping`,
       );