From 3e6e8a95c91a85ce413c64580c5bdcceca0e4fcd Mon Sep 17 00:00:00 2001
From: Jan Mazak <jan.mazak@gmail.com>
Date: Thu, 7 Sep 2023 12:35:15 +0200
Subject: [PATCH] check for unknown items in tx body

---
 src/errors/parseError.ts       |  1 +
 src/txParsers.ts               |  6 ++++++
 test/integration/parse.test.ts | 22 ++++++++++++++++++++++
 3 files changed, 29 insertions(+)

diff --git a/src/errors/parseError.ts b/src/errors/parseError.ts
index f35b9e3..8c605da 100644
--- a/src/errors/parseError.ts
+++ b/src/errors/parseError.ts
@@ -58,6 +58,7 @@ export enum ParseErrorReason {
   INVALID_REFERENCE_INPUT = 'Invalid transaction reference input',
 
   INVALID_TX_BODY_CBOR = 'Invalid transaction body CBOR',
+  INVALID_TX_BODY_UNKNOWN_ITEMS = 'Transaction body contains unknown items',
   INVALID_TX_INPUTS = 'Invalid transaction inputs',
   INVALID_TX_OUTPUTS = 'Invalid transaction outputs',
   INVALID_FEE = 'Invalid transaction fee',
diff --git a/src/txParsers.ts b/src/txParsers.ts
index f17fb94..5f5a9a1 100644
--- a/src/txParsers.ts
+++ b/src/txParsers.ts
@@ -656,6 +656,12 @@ export const parseTxBody = (unparsedTxBody: unknown): TransactionBody => {
     isMapWithKeysOfType(unparsedTxBody, isNumber),
     ParseErrorReason.INVALID_TX_BODY_CBOR,
   )
+  validate(
+    Array.from(unparsedTxBody.keys()).every((key) =>
+      Object.values(TransactionBodyKeys).includes(key),
+    ),
+    ParseErrorReason.INVALID_TX_BODY_UNKNOWN_ITEMS,
+  )
 
   return {
     inputs: parseInputs(unparsedTxBody.get(TransactionBodyKeys.INPUTS)),
diff --git a/test/integration/parse.test.ts b/test/integration/parse.test.ts
index 17d78b6..a7bb9e2 100644
--- a/test/integration/parse.test.ts
+++ b/test/integration/parse.test.ts
@@ -39,6 +39,28 @@ describe('Parse', () => {
         ParseErrorReason.INVALID_TX_BODY_CBOR,
       )
     })
+    it('Transaction body contains unknown items --- negative key', () => {
+      expect(() =>
+        decodeTxBody(
+          Buffer.from(
+            // tx body map key -17 not allowed
+            'a30081825820ba638246bd9be05aa46e865320c354efea75cf5796e88b763faaa30c9fbb78de003181825839000743d16cfe3c4fcc0c11c2403bbc10dbc7ecdd4477e053481a368e7a06e2ae44dff6770dc0f4ada3cf4cf2605008e27aecdb332ad349fda700021a0001e240',
+            'hex',
+          ),
+        ),
+      ).to.throw(ParseError, ParseErrorReason.INVALID_TX_BODY_UNKNOWN_ITEMS)
+    })
+    it('Transaction body contains unknown items --- unsupported key', () => {
+      expect(() =>
+        decodeTxBody(
+          Buffer.from(
+            // tx body map key 10 is not defined in the CDDL
+            'a30081825820ba638246bd9be05aa46e865320c354efea75cf5796e88b763faaa30c9fbb78de000a81825839000743d16cfe3c4fcc0c11c2403bbc10dbc7ecdd4477e053481a368e7a06e2ae44dff6770dc0f4ada3cf4cf2605008e27aecdb332ad349fda700021a0001e240',
+            'hex',
+          ),
+        ),
+      ).to.throw(ParseError, ParseErrorReason.INVALID_TX_BODY_UNKNOWN_ITEMS)
+    })
   })
 
   describe('Invalid transactions', () => {