From: Chris Duncan <chris@codecow.com>
Date: Sat, 8 Aug 2026 18:54:36 +0000 (-0700)
Subject: Narrow account_info response validation.
X-Git-Url: https://git.codecow.com/?a=commitdiff_plain;h=528a64f13fb8995e894b91385dac1b30aee1e604;p=libnemo.git

Narrow account_info response validation.
---

diff --git a/src/lib/rpc/account_info.ts b/src/lib/rpc/account_info.ts
index 8631100..29875de 100644
--- a/src/lib/rpc/account_info.ts
+++ b/src/lib/rpc/account_info.ts
@@ -13,7 +13,7 @@ export type AccountInfoRequest = {
 }
 
 export type AccountInfoResponse = {
-	account_version: string
+	account_version: '1' | '2'
 	balance: string
 	block_count: string
 	confirmation_height?: string
@@ -26,7 +26,7 @@ export type AccountInfoResponse = {
 	confirmed_representative: string
 	frontier: Hex
 	modified_timestamp: string
-	open_block: string
+	open_block: Hex
 	pending?: string
 	receivable: string
 	representative: string
@@ -36,17 +36,17 @@ export type AccountInfoResponse = {
 
 export function account_info (body: unknown): AccountInfoResponse {
 	if (body != null && typeof body === 'object') {
-		if ('account_version' in body && typeof body.account_version === 'string'
+		if ('account_version' in body && (body.account_version === '1' || body.account_version === '2')
 			&& 'balance' in body && typeof body.balance === 'string'
 			&& 'block_count' in body && typeof body.block_count === 'string'
 			&& 'confirmed_balance' in body && typeof body.confirmed_balance === 'string'
-			&& 'confirmed_frontier' in body && hex.is(body.confirmed_frontier)
+			&& 'confirmed_frontier' in body && hex.is(body.confirmed_frontier, 64)
 			&& 'confirmed_height' in body && typeof body.confirmed_height === 'string'
 			&& 'confirmed_receivable' in body && typeof body.confirmed_receivable === 'string'
 			&& 'confirmed_representative' in body && typeof body.confirmed_representative === 'string'
-			&& 'frontier' in body && hex.is(body.frontier)
+			&& 'frontier' in body && hex.is(body.frontier, 64)
 			&& 'modified_timestamp' in body && typeof body.modified_timestamp === 'string'
-			&& 'open_block' in body && typeof body.open_block === 'string'
+			&& 'open_block' in body && hex.is(body.open_block, 64)
 			&& 'receivable' in body && typeof body.receivable === 'string'
 			&& 'representative' in body && typeof body.representative === 'string'
 			&& 'representative_block' in body && typeof body.representative_block === 'string'
diff --git a/src/lib/rpc/accounts_frontiers.ts b/src/lib/rpc/accounts_frontiers.ts
index 538b15f..35fdb83 100644
--- a/src/lib/rpc/accounts_frontiers.ts
+++ b/src/lib/rpc/accounts_frontiers.ts
@@ -26,7 +26,7 @@ export function accounts_frontiers (body: unknown): AccountsFrontiers {
 			for (const [address, frontier] of Object.entries(frontiers) as [string, unknown][]) {
 				try {
 					Account.validate(address)
-					if (hex.is(frontier)) {
+					if (hex.is(frontier, 64)) {
 						response.frontiers ??= {}
 						response.frontiers[address] = frontier
 					}
diff --git a/src/lib/rpc/block_info.ts b/src/lib/rpc/block_info.ts
index 5344c7f..eaa2e3c 100644
--- a/src/lib/rpc/block_info.ts
+++ b/src/lib/rpc/block_info.ts
@@ -1,6 +1,8 @@
 //! SPDX-FileCopyrightText: 2026 Chris Duncan <chris@codecow.com>
 //! SPDX-License-Identifier: GPL-3.0-or-later
 
+import { Account } from '../account'
+import { hex } from '../convert'
 import { RpcError } from '../errors'
 
 export type BlockInfoRequest = {
@@ -48,11 +50,11 @@ export function block_info (body: unknown): BlockInfoResponse {
 			&& 'contents' in body && body.contents != null && typeof body.contents === 'object'
 			&& 'account' in body.contents && typeof body.contents.account === 'string'
 			&& 'balance' in body.contents && typeof body.contents.balance === 'string'
-			&& 'link' in body.contents && typeof body.contents.link === 'string' && /^[0-9A-F]{64}$/i.test(body.contents.link)
-			&& 'link_as_account' in body.contents && typeof body.contents.link_as_account === 'string'
-			&& 'previous' in body.contents && typeof body.contents.previous === 'string' && /^[0-9A-F]{64}$/i.test(body.contents.previous)
+			&& 'link' in body.contents && hex.is(body.contents.link, 64)
+			&& 'link_as_account' in body.contents && Account.validate(body.contents.link_as_account)
+			&& 'previous' in body.contents && hex.is(body.contents.previous, 64)
 			&& 'representative' in body.contents && typeof body.contents.representative === 'string'
-			&& 'signature' in body.contents && typeof body.contents.signature === 'string' && /^[0-9A-F]{128}$/i.test(body.contents.signature)
+			&& 'signature' in body.contents && hex.is(body.contents.signature, 128)
 			&& 'type' in body.contents && body.contents.type === 'state'
 			&& 'work' in body.contents && typeof body.contents.work === 'string'
 		) {