nostr-tools 2.23.7 → 2.23.8

package/lib/nostr.bundle.js

@@ -4877,6 +4877,7 @@ var NostrTools = (() => {
   __export(nip10_exports, {
     parse: () => parse
   });
+  var HEX64 = /^[0-9a-fA-F]{64}$/;
   function parse(event) {
     const result = {
       reply: void 0,
@@ -4889,12 +4890,12 @@ var NostrTools = (() => {
     let maybeRoot;
     for (let i2 = event.tags.length - 1; i2 >= 0; i2--) {
       const tag = event.tags[i2];
-      if (tag[0] === "e" && tag[1]) {
+      if (tag[0] === "e" && tag[1] && HEX64.test(tag[1])) {
         const [_, eTagEventId, eTagRelayUrl, eTagMarker, eTagAuthor] = tag;
         const eventPointer = {
           id: eTagEventId,
           relays: eTagRelayUrl ? [eTagRelayUrl] : [],
-          author: eTagAuthor
+          author: eTagAuthor && HEX64.test(eTagAuthor) ? eTagAuthor : void 0
         };
         if (eTagMarker === "root") {
           result.root = eventPointer;
@@ -4916,14 +4917,14 @@ var NostrTools = (() => {
         result.mentions.push(eventPointer);
         continue;
       }
-      if (tag[0] === "q" && tag[1]) {
+      if (tag[0] === "q" && tag[1] && HEX64.test(tag[1])) {
         const [_, eTagEventId, eTagRelayUrl] = tag;
         result.quotes.push({
           id: eTagEventId,
           relays: eTagRelayUrl ? [eTagRelayUrl] : []
         });
       }
-      if (tag[0] === "p" && tag[1]) {
+      if (tag[0] === "p" && tag[1] && HEX64.test(tag[1])) {
         result.profiles.push({
           pubkey: tag[1],
           relays: tag[2] ? [tag[2]] : []
@@ -6043,6 +6044,7 @@ var NostrTools = (() => {
   __export(nip22_exports, {
     parse: () => parse3
   });
+  var HEX642 = /^[0-9a-fA-F]{64}$/;
   function parseKind(kind) {
     if (!kind)
       return void 0;
@@ -6056,9 +6058,12 @@ var NostrTools = (() => {
     const kind = parseInt(value.slice(0, idx), 10);
     if (Number.isNaN(kind))
       return void 0;
+    const pubkey = value.slice(idx + 1, idx2);
+    if (!HEX642.test(pubkey))
+      return void 0;
     return {
       kind,
-      pubkey: value.slice(idx + 1, idx2),
+      pubkey,
       identifier: value.slice(idx2 + 1),
       relays: relayUrl ? [relayUrl] : []
     };
@@ -6067,12 +6072,12 @@ var NostrTools = (() => {
     switch (tag[0]) {
       case "E":
       case "e":
-        if (!tag[1])
+        if (!tag[1] || !HEX642.test(tag[1]))
           return void 0;
         return {
           id: tag[1],
           relays: tag[2] ? [tag[2]] : [],
-          author: tag[3]
+          author: tag[3] && HEX642.test(tag[3]) ? tag[3] : void 0
         };
       case "A":
       case "a":
@@ -6095,10 +6100,12 @@ var NostrTools = (() => {
     if (tag[1].includes(":")) {
       return parseAddressPointer(tag[1], tag[2]);
     }
+    if (!HEX642.test(tag[1]))
+      return void 0;
     return {
       id: tag[1],
       relays: tag[2] ? [tag[2]] : [],
-      author: tag[3]
+      author: tag[3] && HEX642.test(tag[3]) ? tag[3] : void 0
     };
   }
   function choosePointer(candidates) {
@@ -6158,7 +6165,7 @@ var NostrTools = (() => {
           result.quotes.push(pointer);
         continue;
       }
-      if ((tag[0] === "P" || tag[0] === "p") && tag[1]) {
+      if ((tag[0] === "P" || tag[0] === "p") && tag[1] && HEX642.test(tag[1])) {
         result.profiles.push({
           pubkey: tag[1],
           relays: tag[2] ? [tag[2]] : []