#399

frontend/src/lib/postNewQueryState.ts

@@ -84,13 +84,55 @@ const STATE_KEYS = [
     'created_post_id',
     'recoverable'] as const
 const SINGLE_ROW_KEYS = [...BASIC_KEYS, ...STATE_KEYS, 'session_id'] as const
+const ENCODED_ROW_KEYS = [
+    'n',
+    'u',
+    't',
+    'h',
+    'f',
+    'b',
+    'x',
+    'd',
+    'g',
+    'p',
+    'm',
+    's',
+    'e',
+    'i',
+    'c',
+    'r'] as const
+const ALLOWED_MANUAL_FIELDS = [
+    'title',
+    'thumbnailBase',
+    'originalCreatedFrom',
+    'originalCreatedBefore',
+    'duration',
+    'tags',
+    'parentPostIds'] as const
 const MAX_REGULAR_URL_LENGTH = 768
 const MAX_COMPRESSED_STATE_LENGTH = 767
 const COMPRESSED_STATE_PREFIX = 'z1.'
+const MAX_COMPRESSED_STATE_PARAM_LENGTH = 8_192
+const MAX_COMPRESSED_STATE_BYTES = 16_384
+const MAX_DECOMPRESSED_STATE_BYTES = 262_144
+const MAX_STATE_ROWS = 100
+const MAX_QUERY_STRING_BYTES = 20_480
 
 const textEncoder = new TextEncoder ()
 const textDecoder = new TextDecoder ()
 
+const isPlainObject = (value: unknown): value is Record<string, unknown> =>
+    typeof value === 'object' && value != null && !(Array.isArray (value))
+
+const hasOnlyKeys = (
+    value:        Record<string, unknown>,
+    allowedKeys:  readonly string[],
+): boolean =>
+    Object.keys (value).every (key => allowedKeys.includes (key))
+
+const byteLength = (value: string): number =>
+    textEncoder.encode (value).byteLength
+
 const isValidSkipReason = (value: unknown): value is PostImportSkipReason =>
     value === 'existing' || value === 'manual'
 
@@ -202,18 +244,25 @@ const compressBytes = async (value: Uint8Array): Promise<Uint8Array> => {
 const decompressBytes = async (value: Uint8Array): Promise<Uint8Array> => {
   const stream =
       new Blob ([value]).stream ().pipeThrough (new DecompressionStream ('gzip'))
-  return new Uint8Array (await new Response (stream).arrayBuffer ())
+  const bytes = new Uint8Array (await new Response (stream).arrayBuffer ())
+  if (bytes.byteLength > MAX_DECOMPRESSED_STATE_BYTES)
+    throw new Error ('decompressed state too large')
+  return bytes
 }
 
 
 const decodeCompressedState = async (value: string): Promise<string | null> => {
   if (!(value.startsWith (COMPRESSED_STATE_PREFIX)))
     return null
+  if (value.length > MAX_COMPRESSED_STATE_PARAM_LENGTH)
+    return null
 
   const encoded = value.slice (COMPRESSED_STATE_PREFIX.length)
   const compressed = decodeBase64UrlBytes (encoded)
   if (compressed == null)
     return null
+  if (compressed.byteLength > MAX_COMPRESSED_STATE_BYTES)
+    return null
 
   try
   {
@@ -318,6 +367,10 @@ const parseManual = (value: string | null): string[] =>
     .filter (entry => entry !== '')
 
 
+const hasOnlyAllowedManualFields = (value: string[]): boolean =>
+    value.every (field => ALLOWED_MANUAL_FIELDS.includes (field as never))
+
+
 const isStringArray = (value: unknown): value is string[] =>
     Array.isArray (value) && value.every (entry => typeof entry === 'string')
 
@@ -326,10 +379,12 @@ const parseEncodedRow = (
     value:      unknown,
     requireUrl: boolean,
 ): FullRowState | null => {
-  if (typeof value !== 'object' || value == null || Array.isArray (value))
+  if (!(isPlainObject (value)))
     return null
 
   const row = value as Record<string, unknown>
+  if (!(hasOnlyKeys (row, ENCODED_ROW_KEYS)))
+    return null
   const url = row['u']
   const manual = row['m']
   const skip = decodeSkip (row['s'])
@@ -341,8 +396,12 @@ const parseEncodedRow = (
 
   if (requireUrl && typeof url !== 'string')
     return null
+  if (typeof url === 'string' && byteLength (url) > MAX_QUERY_STRING_BYTES)
+    return null
   if (manual != null && !(isStringArray (manual)))
     return null
+  if ((manual ?? []).some (field => !(ALLOWED_MANUAL_FIELDS.includes (field as never))))
+    return null
   if (row['s'] != null && skip == null)
     return null
   if (row['i'] != null && importStatus == null)
@@ -382,6 +441,8 @@ const parseEncodedRow = (
 	  const fieldValue = row[key]
 	  if (fieldValue != null && typeof fieldValue !== 'string')
 	    throw new Error ('invalid row')
+	  if (typeof fieldValue === 'string' && byteLength (fieldValue) > MAX_QUERY_STRING_BYTES)
+	    throw new Error ('invalid row')
 	  return [target, fieldValue ?? '']
 	}),
     ) as Record<(typeof stringFields)[number][1], string>
@@ -418,6 +479,8 @@ const parseSingleRow = (params: URLSearchParams): ParsedPostNewState | null => {
   const url = params.get ('url')
   if (url == null || url === '')
     return null
+  if (byteLength (url) > MAX_QUERY_STRING_BYTES)
+    return null
 
   const hasOnlyUrl = Array.from (params.keys ()).every (
       key => key === 'url' || key === 'session_id')
@@ -460,6 +523,8 @@ const parseSingleRow = (params: URLSearchParams): ParsedPostNewState | null => {
     return null
   if (importStatus != null && !(isValidImportStatus (importStatus)))
     return null
+  if (!(hasOnlyAllowedManualFields (parseManual (params.get ('manual')))))
+    return null
 
   const row = buildRow ({
       source_row: 1,
@@ -509,7 +574,12 @@ const parseMetaRows = (
     return null
 
   const urls = urlsValue.split (' ').filter (url => url !== '')
-  if (urls.length < 2 || urls.length !== parsed.rows.length)
+  if (urls.length < 2
+      || urls.length > MAX_STATE_ROWS
+      || urls.length !== parsed.rows.length
+      || parsed.rows.length > MAX_STATE_ROWS)
+    return null
+  if (urls.some (url => byteLength (url) > MAX_QUERY_STRING_BYTES))
     return null
 
   const fullRows = parsed.rows.map ((row, index) => {
@@ -520,6 +590,8 @@ const parseMetaRows = (
   })
   if (fullRows.some (row => row == null))
     return null
+  if ((new Set (fullRows.map (row => (row as FullRowState).source_row))).size !== fullRows.length)
+    return null
 
   const rows = fullRows.map (row => buildRow (row as FullRowState))
   return {
@@ -545,12 +617,17 @@ const parseFullState = async (stateValue: string): Promise<ParsedPostNewState |
     return null
   }
 
-  if (parsed.v !== 1 || !(Array.isArray (parsed.rows)) || parsed.rows.length === 0)
+  if (parsed.v !== 1
+      || !(Array.isArray (parsed.rows))
+      || parsed.rows.length === 0
+      || parsed.rows.length > MAX_STATE_ROWS)
     return null
 
   const fullRows = parsed.rows.map (row => parseEncodedRow (row, true))
   if (fullRows.some (row => row == null))
     return null
+  if ((new Set (fullRows.map (row => (row as FullRowState).source_row))).size !== fullRows.length)
+    return null
 
   const rows = fullRows.map (row => buildRow (row as FullRowState))
   return {