nostr-tools 2.23.7 → 2.23.8

package/lib/cjs/index.js

@@ -1826,6 +1826,7 @@ var nip10_exports = {};
 __export(nip10_exports, {
   parse: () => parse
 });
+var HEX64 = /^[0-9a-fA-F]{64}$/;
 function parse(event) {
   const result = {
     reply: void 0,
@@ -1838,12 +1839,12 @@ function parse(event) {
   let maybeRoot;
   for (let i2 = event.tags.length - 1; i2 >= 0; i2--) {
     const tag = event.tags[i2];
-    if (tag[0] === "e" && tag[1]) {
+    if (tag[0] === "e" && tag[1] && HEX64.test(tag[1])) {
       const [_, eTagEventId, eTagRelayUrl, eTagMarker, eTagAuthor] = tag;
       const eventPointer = {
         id: eTagEventId,
         relays: eTagRelayUrl ? [eTagRelayUrl] : [],
-        author: eTagAuthor
+        author: eTagAuthor && HEX64.test(eTagAuthor) ? eTagAuthor : void 0
       };
       if (eTagMarker === "root") {
         result.root = eventPointer;
@@ -1865,14 +1866,14 @@ function parse(event) {
       result.mentions.push(eventPointer);
       continue;
     }
-    if (tag[0] === "q" && tag[1]) {
+    if (tag[0] === "q" && tag[1] && HEX64.test(tag[1])) {
       const [_, eTagEventId, eTagRelayUrl] = tag;
       result.quotes.push({
         id: eTagEventId,
         relays: eTagRelayUrl ? [eTagRelayUrl] : []
       });
     }
-    if (tag[0] === "p" && tag[1]) {
+    if (tag[0] === "p" && tag[1] && HEX64.test(tag[1])) {
       result.profiles.push({
         pubkey: tag[1],
         relays: tag[2] ? [tag[2]] : []
@@ -2369,6 +2370,7 @@ var nip22_exports = {};
 __export(nip22_exports, {
   parse: () => parse3
 });
+var HEX642 = /^[0-9a-fA-F]{64}$/;
 function parseKind(kind) {
   if (!kind)
     return void 0;
@@ -2382,9 +2384,12 @@ function parseAddressPointer(value, relayUrl) {
   const kind = parseInt(value.slice(0, idx), 10);
   if (Number.isNaN(kind))
     return void 0;
+  const pubkey = value.slice(idx + 1, idx2);
+  if (!HEX642.test(pubkey))
+    return void 0;
   return {
     kind,
-    pubkey: value.slice(idx + 1, idx2),
+    pubkey,
     identifier: value.slice(idx2 + 1),
     relays: relayUrl ? [relayUrl] : []
   };
@@ -2393,12 +2398,12 @@ function parsePointer(tag) {
   switch (tag[0]) {
     case "E":
     case "e":
-      if (!tag[1])
+      if (!tag[1] || !HEX642.test(tag[1]))
         return void 0;
       return {
         id: tag[1],
         relays: tag[2] ? [tag[2]] : [],
-        author: tag[3]
+        author: tag[3] && HEX642.test(tag[3]) ? tag[3] : void 0
       };
     case "A":
     case "a":
@@ -2421,10 +2426,12 @@ function parseQuote(tag) {
   if (tag[1].includes(":")) {
     return parseAddressPointer(tag[1], tag[2]);
   }
+  if (!HEX642.test(tag[1]))
+    return void 0;
   return {
     id: tag[1],
     relays: tag[2] ? [tag[2]] : [],
-    author: tag[3]
+    author: tag[3] && HEX642.test(tag[3]) ? tag[3] : void 0
   };
 }
 function choosePointer(candidates) {
@@ -2484,7 +2491,7 @@ function parse3(event) {
         result.quotes.push(pointer);
       continue;
     }
-    if ((tag[0] === "P" || tag[0] === "p") && tag[1]) {
+    if ((tag[0] === "P" || tag[0] === "p") && tag[1] && HEX642.test(tag[1])) {
       result.profiles.push({
         pubkey: tag[1],
         relays: tag[2] ? [tag[2]] : []