@stasho/vf-records 0.2.0 → 0.2.2

package/README.md

@@ -9,5 +9,13 @@ what a prepared publish or transfer message should say and compares it
 against what the signer actually asked for, before that signer's key ever
 touches the message.
 
+The format it checks is public: the Verified Frontends signing format page
+(https://docs.stasho.xyz/reference/vf-signing-format.html) specifies the
+request envelope, the prepare/submit endpoints, the transaction and every
+check, for clients that do not want to run this package.
+`examples/reference-client.ts` (in the repository) is a complete publish client that imports no
+`@stasho/*` code; `tests/reference-client.test.ts` holds its check to the
+same verdicts as `checkPreparedMessage`.
+
 Zero runtime dependencies, no Node-only imports — safe to import from a
 browser or from `@stasho/vf`.

package/dist/client-check.js

@@ -34,7 +34,15 @@ export function checkPreparedMessage(args) {
         return refuse("instruction program is not the memo program");
     if (ix.accounts.length !== 1 || ix.accounts[0] !== 1)
         return refuse("your key must be the instruction's only account");
-    const payload = new TextDecoder().decode(ix.data);
+    // Fatal + ignoreBOM: a leading BOM or an invalid byte is refused, never repaired
+    // into a string that compares equal while the on-chain bytes do not parse.
+    let payload;
+    try {
+        payload = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(ix.data);
+    }
+    catch {
+        return refuse("instruction data is not valid UTF-8");
+    }
     const record = parsePayload(payload);
     if (record === null)
         return refuse("instruction data is not a stasho-vf record");
@@ -56,8 +64,13 @@ export function checkPreparedMessage(args) {
     if (record.kind === "accept" && args.expected.kind === "accept" && record.transfer !== args.expected.transfer) {
         return refuse(`accept names transfer ${record.transfer}, you asked for ${args.expected.transfer}`);
     }
+    // `Date.parse` also accepts legacy formats and ignores parenthesised text, so
+    // only the exact `toISOString()` form the server emits is admitted: `t` must
+    // not carry anything but a time onto the customer's signed record.
     const t = Date.parse(record.ts);
-    if (!Number.isFinite(t) || Math.abs(t - args.now) > CLIENT_CHECK_SKEW_MS)
+    if (!Number.isFinite(t) || new Date(t).toISOString() !== record.ts)
+        return refuse("record timestamp is not an ISO 8601 UTC time");
+    if (Math.abs(t - args.now) > CLIENT_CHECK_SKEW_MS)
         return refuse("record timestamp is more than 10 minutes from this clock");
     return { ok: true, payload, record };
 }

package/dist/legacy-message.js

@@ -16,6 +16,10 @@ class Reader {
         let value = 0;
         for (let shift = 0; shift <= 14; shift += 7) {
             const b = this.u8();
+            // A trailing zero group re-encodes the same length (an "alias"), which
+            // Solana's own short_vec decoder refuses too.
+            if (b === 0 && shift > 0)
+                throw new RangeError("compact-u16 is not minimally encoded");
             value |= (b & 0x7f) << shift;
             if ((b & 0x80) === 0)
                 return value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stasho/vf-records",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Stasho Verified Frontends record codec + the client-side check of a prepared publish message. Zero dependencies, browser-safe.",
   "license": "MIT",
   "type": "module",
@@ -19,7 +19,7 @@
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
-    "lint": "oxlint src tests",
+    "lint": "oxlint src tests examples",
     "prepublishOnly": "npm run build"
   },
   "devDependencies": {