#399

frontend/src/lib/postNewQueryState.ts

@@ -101,6 +101,7 @@ const ENCODED_ROW_KEYS = [
     'i',
     'c',
     'r'] as const
+const ENCODED_STATE_KEYS = ['v', 'rows'] as const
 const ALLOWED_MANUAL_FIELDS = [
     'title',
     'thumbnailBase',
@@ -200,12 +201,19 @@ const decodeImportStatus = (
 }
 
 
+const isStrictPositiveIntegerString = (value: string): boolean =>
+    /^[1-9][0-9]*$/.test (value)
+    && Number.isSafeInteger (Number (value))
+
+
 const parsePositiveInt = (value: string | null): number | null => {
   if (value == null || value === '')
     return null
 
-  const parsed = Number.parseInt (value, 10)
-  return Number.isInteger (parsed) && parsed > 0 ? parsed : null
+  if (!(isStrictPositiveIntegerString (value)))
+    return null
+
+  return Number (value)
 }
 
 
@@ -244,9 +252,37 @@ const compressBytes = async (value: Uint8Array): Promise<Uint8Array> => {
 const decompressBytes = async (value: Uint8Array): Promise<Uint8Array> => {
   const stream =
       new Blob ([value]).stream ().pipeThrough (new DecompressionStream ('gzip'))
-  const bytes = new Uint8Array (await new Response (stream).arrayBuffer ())
-  if (bytes.byteLength > MAX_DECOMPRESSED_STATE_BYTES)
-    throw new Error ('decompressed state too large')
+  const reader = stream.getReader ()
+  const chunks: Uint8Array[] = []
+  let totalBytes = 0
+
+  try
+  {
+    while (true)
+      {
+        const result = await reader.read ()
+        if (result.done)
+          break
+        totalBytes += result.value.byteLength
+        if (totalBytes > MAX_DECOMPRESSED_STATE_BYTES)
+          {
+            await reader.cancel ()
+            throw new Error ('decompressed state too large')
+          }
+        chunks.push (result.value)
+      }
+  }
+  finally
+  {
+    reader.releaseLock ()
+  }
+
+  const bytes = new Uint8Array (totalBytes)
+  let offset = 0
+  chunks.forEach (chunk => {
+    bytes.set (chunk, offset)
+    offset += chunk.byteLength
+  })
   return bytes
 }
 
@@ -408,21 +444,31 @@ const parseEncodedRow = (
     return null
   if (existingPostId != null
       && !(typeof existingPostId === 'number'
-           && Number.isInteger (existingPostId)
+           && Number.isSafeInteger (existingPostId)
            && existingPostId > 0))
     return null
   if (createdPostId != null
       && !(typeof createdPostId === 'number'
-           && Number.isInteger (createdPostId)
+           && Number.isSafeInteger (createdPostId)
            && createdPostId > 0))
     return null
   if (recoverable != null && typeof recoverable !== 'boolean')
     return null
   if (sourceRow != null
       && !(typeof sourceRow === 'number'
-           && Number.isInteger (sourceRow)
+           && Number.isSafeInteger (sourceRow)
            && sourceRow > 0))
     return null
+  if (skip === 'existing' && existingPostId == null)
+    return null
+  if (importStatus === 'created' && createdPostId == null)
+    return null
+  if (importStatus !== 'created' && createdPostId != null)
+    return null
+  if (recoverable === true
+      && importStatus !== 'failed'
+      && importStatus !== 'pending')
+    return null
 
   const stringFields = [
       ['t', 'title'],
@@ -515,16 +561,41 @@ const parseSingleRow = (params: URLSearchParams): ParsedPostNewState | null => {
 
   const skipValue = params.get ('skip')
   const importStatus = params.get ('import_status')
+  const recoverableValue = params.get ('recoverable')
   const recoverable =
-      params.get ('recoverable') == null
+      recoverableValue == null
       ? null
-      : params.get ('recoverable') === 'true'
+      : recoverableValue === 'true'
+        ? true
+        : recoverableValue === 'false'
+          ? false
+          : null
   if (skipValue != null && !(isValidSkipReason (skipValue)))
     return null
   if (importStatus != null && !(isValidImportStatus (importStatus)))
     return null
+  if (recoverableValue != null && recoverable == null)
+    return null
   if (!(hasOnlyAllowedManualFields (parseManual (params.get ('manual')))))
     return null
+  const existingPostIdValue = params.get ('existing_post_id')
+  const createdPostIdValue = params.get ('created_post_id')
+  const existingPostId = parsePositiveInt (existingPostIdValue)
+  const createdPostId = parsePositiveInt (createdPostIdValue)
+  if (existingPostIdValue != null && existingPostId == null)
+    return null
+  if (createdPostIdValue != null && createdPostId == null)
+    return null
+  if (skipValue === 'existing' && existingPostId == null)
+    return null
+  if (importStatus === 'created' && createdPostId == null)
+    return null
+  if (importStatus !== 'created' && createdPostIdValue != null)
+    return null
+  if (recoverable === true
+      && importStatus !== 'failed'
+      && importStatus !== 'pending')
+    return null
 
   const row = buildRow ({
       source_row: 1,
@@ -539,9 +610,9 @@ const parseSingleRow = (params: URLSearchParams): ParsedPostNewState | null => {
       parent_post_ids: params.get ('parent_post_ids') ?? '',
       manual: parseManual (params.get ('manual')),
       skip: skipValue,
-      existing_post_id: parsePositiveInt (params.get ('existing_post_id')),
+      existing_post_id: existingPostId,
       import_status: importStatus,
-      created_post_id: parsePositiveInt (params.get ('created_post_id')),
+      created_post_id: createdPostId,
       recoverable })
 
   return {
@@ -559,6 +630,8 @@ const parseMetaRows = (
   const decodedBytes = decodeBase64UrlBytes (metaValue)
   if (decodedBytes == null)
     return null
+  if (decodedBytes.byteLength > MAX_DECOMPRESSED_STATE_BYTES)
+    return null
 
   let parsed: MultiRowMetaState
   try
@@ -618,6 +691,8 @@ const parseFullState = async (stateValue: string): Promise<ParsedPostNewState |
   }
 
   if (parsed.v !== 1
+      || !(isPlainObject (parsed))
+      || !(hasOnlyKeys (parsed as Record<string, unknown>, ENCODED_STATE_KEYS))
       || !(Array.isArray (parsed.rows))
       || parsed.rows.length === 0
       || parsed.rows.length > MAX_STATE_ROWS)
@@ -754,6 +829,9 @@ export const appendPostNewSessionId = (
 export const parsePostNewState = async (
     search: string,
 ): Promise<ParsedPostNewState | null> => {
+  if (byteLength (search) > MAX_QUERY_STRING_BYTES)
+    return null
+
   const params = new URLSearchParams (search)
   const stateValue = params.get ('state')
   if (stateValue != null)