fix: validation for satoshi ordinal numbers (#223)

* fix: validation for satoshi ordinal numbers * fix: only catch correct err * fix: specify error
hirosystems · Sep 14, 2023 · c3cf8c0 · c3cf8c0
1 parent 0469aa3
commit c3cf8c0
Show file tree

Hide file tree

Showing 4 changed files with 32 additions and 4 deletions.
diff --git a/src/api/routes/sats.ts b/src/api/routes/sats.ts
@@ -4,8 +4,8 @@ import { FastifyPluginCallback } from 'fastify';
 import { Server } from 'http';
 import {
   InscriptionResponse,
+  InvalidSatoshiNumberResponse,
   LimitParam,
-  NotFoundResponse,
   OffsetParam,
   OrdinalParam,
   PaginatedResponse,
@@ -32,12 +32,18 @@ export const SatRoutes: FastifyPluginCallback<Record<never, never>, Server, Type
         }),
         response: {
           200: SatoshiResponse,
-          404: NotFoundResponse,
+          400: InvalidSatoshiNumberResponse,
         },
       },
     },
     async (request, reply) => {
-      const sat = new OrdinalSatoshi(request.params.ordinal);
+      let sat: OrdinalSatoshi;
+      try {
+        sat = new OrdinalSatoshi(request.params.ordinal);
+      } catch (error) {
+        await reply.code(400).send({ error: 'Invalid satoshi ordinal number' });
+        return;
+      }
       const inscriptions = await fastify.db.getInscriptions(
         { limit: 1, offset: 0 },
         { sat_ordinal: BigInt(request.params.ordinal) }
@@ -76,15 +82,23 @@ export const SatRoutes: FastifyPluginCallback<Record<never, never>, Server, Type
         }),
         response: {
           200: PaginatedResponse(InscriptionResponse, 'Paginated Satoshi Inscriptions Response'),
+          400: InvalidSatoshiNumberResponse,
         },
       },
     },
     async (request, reply) => {
+      let sat: OrdinalSatoshi;
+      try {
+        sat = new OrdinalSatoshi(request.params.ordinal);
+      } catch (error) {
+        await reply.code(400).send({ error: 'Invalid satoshi ordinal number' });
+        return;
+      }
       const limit = request.query.limit ?? DEFAULT_API_LIMIT;
       const offset = request.query.offset ?? 0;
       const inscriptions = await fastify.db.getInscriptions(
         { limit, offset },
-        { sat_ordinal: BigInt(request.params.ordinal) }
+        { sat_ordinal: BigInt(sat.ordinal) }
       );
       await reply.send({
         limit,

diff --git a/src/api/schemas.ts b/src/api/schemas.ts
@@ -512,6 +512,13 @@ export const NotFoundResponse = Type.Object(
   { title: 'Not Found Response' }
 );
 
+export const InvalidSatoshiNumberResponse = Type.Object(
+  {
+    error: Type.Literal('Invalid satoshi ordinal number'),
+  },
+  { title: 'Invalid Satoshi Number Response' }
+);
+
 export const InscriptionsPerBlock = Type.Object({
   block_height: Type.String({ examples: ['778921'] }),
   block_hash: Type.String({

diff --git a/src/api/util/ordinal-satoshi.ts b/src/api/util/ordinal-satoshi.ts
@@ -32,6 +32,7 @@ export class OrdinalSatoshi {
   private third: number;
 
   constructor(ordinal: number) {
+    if (ordinal > SAT_SUPPLY || ordinal < 0) throw Error('Invalid satoshi ordinal number');
     let satAccum = 0;
     let subsidy = INITIAL_SUBSIDY;
     let epoch = 0;

diff --git a/tests/sats.test.ts b/tests/sats.test.ts
@@ -208,5 +208,11 @@ describe('/sats', () => {
       url: '/ordinals/v1/sats/-1',
     });
     expect(response2.statusCode).toBe(400);
+
+    const response3 = await fastify.inject({
+      method: 'GET',
+      url: '/ordinals/v1/sats/Infinity',
+    });
+    expect(response3.statusCode).toBe(400);
   });
 });