fix(tlock): harden hex helpers and add seal/open input validation - #200
Open
fadesany wants to merge 1 commit into
Open
fix(tlock): harden hex helpers and add seal/open input validation#200fadesany wants to merge 1 commit into
fadesany wants to merge 1 commit into
Conversation
- Export isValidHex from commitment.ts, a boolean predicate matching fromHex's own accept/reject decisions (even length, optional 0x prefix, hex-only characters), and re-export it from index.ts. - sealBid now rejects a non-positive/non-integer Drand round with a clear error instead of letting it fail deep inside tlock-js. - openBid now rejects an empty ciphertext with a clear error instead of an obscure downstream decode failure. - Add unit tests for isValidHex and the new sealBid/openBid guard clauses. Fixes Sub-Rosa-Issue#191
fadesany
force-pushed
the
harden-hex-helpers-seal-open-validation
branch
from
August 25, 2026 22:21
93e8f25 to
64e3458
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #191.
fromHexinpackages/tlock/src/commitment.tsalready validated hex strictly (even length, hex-only characters), but there was no exported predicate a caller could use to check a string before callingfromHex. This PR adds that helper and adds the guard clauses called for in the issue forsealBid/openBid.isValidHex(hex: string): boolean— exported fromcommitment.tsand re-exported from the package root (index.ts). Returnstrue/falseusing the exact same rulefromHexenforces (optional0x/0Xprefix stripped, even length, hex-digits only), soisValidHex(s)and "fromHex(s)does not throw" always agree.sealBidnow throwsround must be a positive integer, got <round>for a non-positive or non-integer Drand round, instead of letting an invalid round fail deep insidetlock-js'stimelockEncrypt.openBidnow throwsciphertext must not be emptyfor an empty ciphertext, instead of an obscure downstream decode/decrypt failure.Testing
packages/tlock/src/commitment.test.ts— new test assertingisValidHexagrees withfromHex's accept/reject behavior across the existing valid/invalid hex fixtures.packages/tlock/src/seal.test.ts— new tests:sealBidrejects0,-1,-100rounds;openBidrejects an empty ciphertext.packages/tlockunit suite plus the live-quicknetseal.test.tssuite (node --import tsx --test ...) — all passing.tsc --noEmit -p packages/tlock/tsconfig.json— clean.🤖 Generated with Claude Code