Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
exports.isInvite = function (msg, caps) {
if(!isObject(caps)) throw new Error('caps must be provided')
//return true
return isObject(msg) && isObject(msg.content) && (
'user-invite' === msg.content.type &&
ref.isFeed(msg.content.host) &&
ref.isFeed(msg.content.invite) &&
isMaybeBase64(msg.content.reveal) &&
isMaybeBase64(msg.content.public) &&
// signature must be valid !!!
ssbKeys.verifyObj(msg.content.invite, caps.userInvite, msg.content)
)
}
write: function (rawChunk, enc, next) {
try {
var chunk = JSON.parse(rawChunk)
if (chunk.public === self.keys.public) {
debug('got one of my own messages; discarding')
} else if (ssbkeys.verifyObj(chunk, chunk.data)) {
if (self.seqs[chunk.public] === undefined || self.seqs[chunk.public] < chunk.seq) {
self.seqs[chunk.public] = chunk.seq
self.store.push(rawChunk + '\n')
debug('current seq for', chunk.public, 'is', self.seqs[chunk.public])
var copy = clone(chunk.data)
delete copy.signature
self.emit('message', copy, {public: chunk.public})
} else {
debug('old gossip; discarding')
}
} else {
debug('received message with bad signature! discarding')
}
} catch (e) {
debug('bad json (or end of stream)')
}
else {
if(!(msg.previous == null
&& msg.sequence === 1 && msg.timestamp > 0))
return new Error('expected initial message')
}
if(msg.author !== pub) {
return new Error(
'expected different author:'
+ hash(pub.public || pub).toString('base64')
+ 'but found:' + msg.author.toString('base64')
)
}
if(!ssbKeys.verifyObj(pub, sign_cap, msg))
return new Error('signature was invalid')
return false
}
exports.verifyAcceptOnly = function (accept, caps) {
if(!isObject(caps)) throw new Error('caps *must* be provided')
if(accept.content.type !== 'peer-invite/accept')
throw code(new Error('accept must be type: "peer-invite/accept", was:'+JSON.stringify(accept.content.type)), 'accept-message-type')
if(!isMsg(accept.content.receipt))
throw code(new Error('accept must reference invite message id'), 'accept-reference-invite')
//verify signed as ordinary message.
if(!ssbKeys.verifyObj(accept.content.id, caps.sign, accept))
throw code(new Error('acceptance must be signed by claimed key'), 'accept-signature-failed')
}
exports.verifyInvitePublic = function (msg, caps) {
if(!isObject(caps)) throw new Error('caps *must* be provided')
if(msg.content.host != msg.author)
throw code(new Error('host did not match author'), 'host-must-match-author')
if(!ssbKeys.verifyObj(msg.content.invite, caps.peerInvite, msg.content))
throw code(new Error('invalid invite signature'), 'invite-signature-failed')
//an ordinary message so doesn't use special hmac_key, unless configed to.
if(!ssbKeys.verifyObj(msg.author, caps.sign, msg))
throw code(new Error('invalid host signature'), 'host-signature-failed')
return true
}
var invite_id = toMsgId(invite_msg)
var reveal
if(invite_id !== accept.content.receipt)
throw code(new Error('acceptance not matched to given invite, got:'+invite_id+' expected:'+accept.content.receipt), 'accept-wrong-invite')
if(accept.author === invite_msg.content.id)
throw code(new Error('guest must use a new key, not the same seed'), 'guest-key-reuse')
if(invite_msg.content.reveal) {
if(!accept.content.key)
throw code(new Error('accept missing reveal key, when invite has it'), 'accept-must-reveal-key')
reveal = u.unbox(invite_msg.content.reveal, toBuffer(accept.content.key))
if(!reveal) throw code(new Error('accept did not correctly reveal invite'), 'decrypt-accept-reveal-failed')
}
if(!ssbKeys.verifyObj(invite_msg.content.invite, caps.peerInvite, accept.content))
throw code(new Error('did not verify invite-acceptance contents'), 'accept-invite-signature-failed')
//an ordinary message, so does not use hmac_key
return reveal || true
}
tape("verify", (t) => {
t.ok(testobj.signature, "has signature")
t.ok(ssbKeys.verifyObj({public:keys.public}, testobj), "verify")
t.end()
})
exports.checkInvalid = function (state, hmac_key, msg) {
var err = exports.checkInvalidCheap(state, msg)
if(err) return err
if(!ssbKeys.verifyObj({public: msg.author.substring(1)}, hmac_key, msg))
return fatal(new Error('invalid signature'))
return false //not invalid
}
tape("verify with HMAC", (t) => {
t.ok(testobj.signature, "has signature")
t.ok(ssbKeys.verifyObj({public:keys.public}, hmacKey, testobj), "verify")
t.end()
})