diff --git a/golpe b/golpe index a655f8f..f84f71a 160000 --- a/golpe +++ b/golpe @@ -1 +1 @@ -Subproject commit a655f8f5b2dc90034ad62095f111ec2635a4f000 +Subproject commit f84f71a2f0758a7dd0df19e6091656737b9f9797 diff --git a/src/constants.h b/src/constants.h index fb10191..89ea623 100644 --- a/src/constants.h +++ b/src/constants.h @@ -1,3 +1,4 @@ #pragma once -const size_t MAX_SUBID_SIZE = 63; +const size_t MAX_SUBID_SIZE = 63; // Statically allocated size in SubId +const uint64_t MAX_TIMESTAMP = 17179869184; // Safety limit to ensure it can fit in quadrable key. Good until year 2514. diff --git a/src/events.cpp b/src/events.cpp index a7403fc..e66d9b1 100644 --- a/src/events.cpp +++ b/src/events.cpp @@ -119,7 +119,7 @@ void verifyEventTimestamp(const NostrIndex::Event *flat) { uint64_t latest = now + cfg().events__rejectEventsNewerThanSeconds; if (ts < earliest) throw herr("created_at too early"); - if (ts > latest) throw herr("created_at too late"); + if (ts > latest || ts > MAX_TIMESTAMP) throw herr("created_at too late"); } void parseAndVerifyEvent(const tao::json::value &origJson, secp256k1_context *secpCtx, bool verifyMsg, bool verifyTime, std::string &flatStr, std::string &jsonStr) { diff --git a/src/events.h b/src/events.h index a8f5eab..ff46c28 100644 --- a/src/events.h +++ b/src/events.h @@ -51,7 +51,9 @@ std::string_view decodeEventPayload(lmdb::txn &txn, Decompressor &decomp, std::s std::string_view getEventJson(lmdb::txn &txn, Decompressor &decomp, uint64_t levId); inline quadrable::Key flatEventToQuadrableKey(const NostrIndex::Event *flat) { - return quadrable::Key::fromIntegerAndHash(flat->created_at(), sv(flat->id()).substr(0, 23)); + uint64_t timestamp = flat->created_at(); + if (timestamp > MAX_TIMESTAMP) throw herr("timestamp is too large to encode in quadrable key"); + return quadrable::Key::fromIntegerAndHash(timestamp, sv(flat->id()).substr(0, 27)); }