fix: stricter validation for CID v1 to v0 conversion

License: MIT
Signed-off-by: Alan Shaw <alan.shaw@protocol.ai>

.gitignore

@@ -9,6 +9,7 @@ logs
 *.log
 
 coverage
+.nyc_output
 
 # Runtime data
 pids

.npmignore

@@ -7,6 +7,7 @@ logs
 *.log
 
 coverage
+.nyc_output
 
 # Runtime data
 pids
@@ -31,4 +32,4 @@ build
 # https://www.npmjs.org/doc/misc/npm-faq.html#should-i-check-my-node_modules-folder-into-git
 node_modules
 
-test
+test

src/index.js

@@ -4,7 +4,6 @@ const mh = require('multihashes')
 const multibase = require('multibase')
 const multicodec = require('multicodec')
 const codecs = require('multicodec/src/base-table')
-const multihash = require('multihashes')
 const CIDUtil = require('./cid-util')
 const withIs = require('class-is')
 
@@ -147,7 +146,7 @@ class CID {
     return Buffer.concat([
       Buffer.from(`0${this.version}`, 'hex'),
       multicodec.getCodeVarint(this.codec),
-      multihash.prefix(this.multihash)
+      mh.prefix(this.multihash)
     ])
   }
 
@@ -161,6 +160,16 @@ class CID {
       throw new Error('Cannot convert a non dag-pb CID to CIDv0')
     }
 
+    const { name, length } = mh.decode(this.multihash)
+
+    if (name !== 'sha2-256') {
+      throw new Error('Cannot convert non sha2-256 multihash CID to CIDv0')
+    }
+
+    if (length !== 32) {
+      throw new Error('Cannot convert non 32 byte multihash CID to CIDv0')
+    }
+
     return new _CID(0, this.codec, this.multihash)
   }
 

test/index.spec.js

@@ -253,4 +253,51 @@ describe('CID', () => {
       expect(cid1 === cid2).to.equal(false)
     })
   })
+
+  describe('conversion v0 <-> v1', () => {
+    it('should convert v0 to v1', done => {
+      multihashing(Buffer.from(`TEST${Date.now()}`), 'sha2-256', (err, hash) => {
+        if (err) return done(err)
+        const cid = new CID(0, 'dag-pb', hash).toV1()
+        expect(cid.version).to.equal(1)
+        done()
+      })
+    })
+
+    it('should convert v1 to v0', done => {
+      multihashing(Buffer.from(`TEST${Date.now()}`), 'sha2-256', (err, hash) => {
+        if (err) return done(err)
+        const cid = new CID(1, 'dag-pb', hash).toV0()
+        expect(cid.version).to.equal(0)
+        done()
+      })
+    })
+
+    it('should not convert v1 to v0 if not dag-pb codec', done => {
+      multihashing(Buffer.from(`TEST${Date.now()}`), 'sha2-256', (err, hash) => {
+        if (err) return done(err)
+        const cid = new CID(1, 'dag-cbor', hash)
+        expect(() => cid.toV0()).to.throw('Cannot convert a non dag-pb CID to CIDv0')
+        done()
+      })
+    })
+
+    it('should not convert v1 to v0 if not sha2-256 multihash', done => {
+      multihashing(Buffer.from(`TEST${Date.now()}`), 'sha2-512', (err, hash) => {
+        if (err) return done(err)
+        const cid = new CID(1, 'dag-pb', hash)
+        expect(() => cid.toV0()).to.throw('Cannot convert non sha2-256 multihash CID to CIDv0')
+        done()
+      })
+    })
+
+    it('should not convert v1 to v0 if not 32 byte multihash', done => {
+      multihashing(Buffer.from(`TEST${Date.now()}`), 'sha2-256', 31, (err, hash) => {
+        if (err) return done(err)
+        const cid = new CID(1, 'dag-pb', hash)
+        expect(() => cid.toV0()).to.throw('Cannot convert non 32 byte multihash CID to CIDv0')
+        done()
+      })
+    })
+  })
 })