Validate records from dataplane (#2217)

* appview: validate records from dataplane * tidy
bluesky-social · Feb 22, 2024 · faf92be · faf92be
1 parent 84cfbd8
commit faf92be
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 7 deletions.
diff --git a/packages/bsky/src/hydration/util.ts b/packages/bsky/src/hydration/util.ts
@@ -1,6 +1,8 @@
 import { AtUri } from '@atproto/syntax'
+import { jsonToLex } from '@atproto/lexicon'
 import { CID } from 'multiformats/cid'
 import * as ui8 from 'uint8arrays'
+import { lexicons } from '../lexicon/lexicons'
 import { Record } from '../proto/bsky_pb'
 
 export class HydrationMap<T> extends Map<string, T | null> {
@@ -30,6 +32,9 @@ export const parseRecord = <T>(
   const cid = entry.cid
   const sortedAt = entry.sortedAt?.toDate() ?? new Date(0)
   if (!record || !cid) return
+  if (!isValidRecord(record)) {
+    return
+  }
   return {
     record,
     cid,
@@ -38,6 +43,19 @@ export const parseRecord = <T>(
   }
 }
 
+const isValidRecord = (json: unknown) => {
+  const lexRecord = jsonToLex(json)
+  if (typeof lexRecord?.['$type'] !== 'string') {
+    return false
+  }
+  try {
+    lexicons.assertValidRecord(lexRecord['$type'], lexRecord)
+    return true
+  } catch {
+    return false
+  }
+}
+
 // @NOTE not parsed into lex format, so will not match lexicon record types on CID and blob values.
 export const parseRecordBytes = <T>(
   bytes: Uint8Array | undefined,

diff --git a/packages/bsky/tests/image/uri.test.ts b/packages/bsky/tests/image/uri.test.ts
@@ -14,16 +14,20 @@ describe('image uri builder', () => {
   })
 
   it('generates paths.', () => {
-    expect(ImageUriBuilder.getPath({ preset: 'banner', did, cid })).toEqual(
-      `/banner/plain/${did}/${cid.toString()}@jpeg`,
-    )
     expect(
-      ImageUriBuilder.getPath({ preset: 'feed_thumbnail', did, cid }),
+      ImageUriBuilder.getPath({ preset: 'banner', did, cid: cid.toString() }),
+    ).toEqual(`/banner/plain/${did}/${cid.toString()}@jpeg`)
+    expect(
+      ImageUriBuilder.getPath({
+        preset: 'feed_thumbnail',
+        did,
+        cid: cid.toString(),
+      }),
     ).toEqual(`/feed_thumbnail/plain/${did}/${cid.toString()}@jpeg`)
   })
 
   it('generates uris.', () => {
-    expect(uriBuilder.getPresetUri('banner', did, cid)).toEqual(
+    expect(uriBuilder.getPresetUri('banner', did, cid.toString())).toEqual(
       `https://example.com/img/banner/plain/${did}/${cid.toString()}@jpeg`,
     )
     expect(
@@ -38,7 +42,7 @@ describe('image uri builder', () => {
       ImageUriBuilder.getOptions(`/banner/plain/${did}/${cid.toString()}@png`),
     ).toEqual({
       did: 'did:plc:xyz',
-      cid,
+      cid: cid.toString(),
       fit: 'cover',
       format: 'png',
       height: 1000,
@@ -52,7 +56,7 @@ describe('image uri builder', () => {
       ),
     ).toEqual({
       did: 'did:plc:xyz',
-      cid,
+      cid: cid.toString(),
       fit: 'inside',
       format: 'jpeg',
       height: 2000,