resolver.put allows you to create invalid blocks

[wanderer]

const node = {
  'test': 1
}
resolve.put(node, { format: 'dag-cbor', hashAlg: 'sha2-256'}, () => {
   console.log('done!')
})

node.test = 2

This will produce an invalid node, it will have the contents of {test: 2} with the cid of {test: 1}
Most of the time changing the node before resolve.put is done would be a mistake but it can easily prevented at the level of this module. The problem is that serialize the data twice (here and here). If it would only be serialized once then hashed this would be prevented. It would help to have this first though.

[daviddias]

Thanks for reporting this bug. It is a fun one indeed!

A simple (and I believe to be the wisest) solution would be to make a copy at the beginning of put, however, that would force us to add a copy function to the interface-ipld-format so that we know how to make a 1:1 copy of any format.

Mind submitting a PR with a test?

[kumavis]

Hmm do we need a ipldXResolver.clone method?

[daviddias]

@kumavis if we go with that solution, then yes

[wanderer]

Hmm do we need a ipldXResolver.clone method?

i think i would argue against it since we have serialize. Which is copying in a sense. If we serialized once then hashed the serialized data instead of serializing twice then invalid blocks coudn't be generated

[daviddias]

@wanderer it would work for this case, yes, but getting .copy would prevent other weird scenarios int he future. We can: a) solve this by taking in your proposal -- ipld/interface-ipld-format#7 -- and b) keep considering adding .copy to interface-ipld-format.

[wanderer]

@diasdavid in which case would this not work? I can't think of anything off the top of my head. But if there are things that mutate the serialized version somehow then i guess we could aslo specify that serialize does a copy

[daviddias]

It will work 👍

[wanderer]

@diasdavid okie! test added

[daviddias]

@vmx just getting this on your radar :)

[richardschneider]

ipld/interface-ipld-format#32 will resolve this. cid will take the serialised output not the dagNode.

[vmx]

As cid() is now taking the serialized version of a node, that's not an issue anymore.