Merge upstream develop

Author: github-actions[bot]

.gitlab/images/rust-dind/Dockerfile

@@ -2,7 +2,7 @@ ARG RUST_IMAGE
 
 # Debian bookworm (the rust base) has no Compose v2 plugin in its repos, so
 # we copy the binaries from the official docker image, pinned by tag.
-FROM docker:28-cli AS docker
+FROM docker:29-cli AS docker
 FROM ${RUST_IMAGE}
 
 COPY --from=docker /usr/local/bin/docker /usr/local/bin/docker

Cargo.lock

@@ -8,6 +8,8 @@
   "react-native": "./src/index.tsx",
   "exports": {
     ".": {
+      "react-server": "./src/index.web.ts",
+      "node": "./src/index.web.ts",
       "browser": "./src/index.web.ts",
       "react-native": "./src/index.tsx",
       "source": "./src/index.tsx",

packages/react-native/package.json

@@ -176,7 +176,10 @@ impl PolycentricCore {
         for entry in contents {
             let digest = ContentDigest::decode(entry.digest_bytes.as_slice())
                 .map_err(|e| CoreError::Decode(format!("Failed to decode ContentDigest: {e}")))?;
-            client.copy_content(&digest, entry.content_bytes);
+            if let Err(e) = client.copy_content(&digest, entry.content_bytes) {
+                // Skip content that doesn't match its digest; keep the rest.
+                crate::logging::log_warn(|| format!("dropping content: {e}"));
+            }
         }
         Ok(())
     }

packages/rs-core/src/api.rs

@@ -3,8 +3,8 @@ use polycentric_common::{
     models::{
         Serializable, collections,
         protos_v2::{
-            self, Content, ContentDigest, Event, EventBundle, EventProof, Identity, PublicKey,
-            SerializedContent, SignedEvent, VectorClock, content::ContentBody,
+            self, Content, ContentDigest, ContentDigestType, Event, EventBundle, EventProof,
+            Identity, PublicKey, SerializedContent, SignedEvent, VectorClock, content::ContentBody,
         },
     },
 };
@@ -22,6 +22,17 @@ fn hex_short(bytes: &[u8]) -> String {
     bytes.iter().take(4).map(|b| format!("{:02x}", b)).collect()
 }
 
+/// True when `content_bytes` actually hash to `digest`. Only SHA-256 digests
+/// are supported; any other type fails verification (can't verify ⇒ reject).
+fn content_matches_digest(digest: &ContentDigest, content_bytes: &[u8]) -> bool {
+    use sha2::{Digest, Sha256};
+
+    if digest.r#type != ContentDigestType::Sha256 as i32 {
+        return false;
+    }
+    Sha256::digest(content_bytes).as_slice() == digest.value.as_slice()
+}
+
 #[derive(Default)]
 pub struct PolycentricClient {
     servers: Mutex<Vec<String>>,
@@ -50,9 +61,22 @@ impl PolycentricClient {
         self.event_store.insert(signed_event)
     }
 
-    /// Copy content bytes into the content store, keyed by digest.
-    pub fn copy_content(&mut self, digest: &ContentDigest, content_bytes: Vec<u8>) {
+    /// Copy content bytes into the content store, keyed by digest, after
+    /// verifying the bytes hash to that digest. Mismatched (or
+    /// unsupported-digest) content is rejected and not stored.
+    pub fn copy_content(
+        &mut self,
+        digest: &ContentDigest,
+        content_bytes: Vec<u8>,
+    ) -> Result<(), CoreError> {
+        if !content_matches_digest(digest, &content_bytes) {
+            let digest_hex: String = digest.value.iter().map(|b| format!("{b:02x}")).collect();
+            return Err(CoreError::InvalidEvent(format!(
+                "content does not match digest {digest_hex}"
+            )));
+        }
         self.content_store.insert(digest, content_bytes);
+        Ok(())
     }
 
     /// First locally-valid bundle at `(identity, collection, sequence)`.
@@ -130,8 +154,11 @@ impl PolycentricClient {
         });
 
         for (signed_event, event, serialized, proofs) in prepared {
-            if let (Some(digest), Some(content)) = (event.content_digest.as_ref(), serialized) {
-                self.copy_content(digest, content.content_bytes);
+            if let (Some(digest), Some(content)) = (event.content_digest.as_ref(), serialized)
+                && let Err(e) = self.copy_content(digest, content.content_bytes)
+            {
+                // Keep the validly-signed event; just drop the bad content.
+                crate::logging::log_warn(|| format!("dropping content: {e}"));
             }
             if !proofs.is_empty()
                 && let Ok(key) = EventKey::from_event(event)
@@ -754,7 +781,9 @@ mod tests {
             }
         }
 
-        client.copy_content(&digest, content_bytes);
+        client
+            .copy_content(&digest, content_bytes)
+            .expect("content matches its computed digest");
         let signed = sign_event(
             signer,
             &id_string,
@@ -1197,4 +1226,48 @@ mod tests {
             vc.err()
         );
     }
+
+    #[test]
+    fn copy_content_stores_matching_content() {
+        let mut client = PolycentricClient::default();
+        let bytes = b"hello content".to_vec();
+        let digest = sha256_digest(&bytes);
+
+        client
+            .copy_content(&digest, bytes.clone())
+            .expect("content matching its digest is accepted");
+
+        let stored = client.find_content_from_digest(&digest);
+        assert_eq!(stored.map(|c| c.content_bytes), Some(bytes));
+    }
+
+    #[test]
+    fn copy_content_rejects_mismatched_content() {
+        let mut client = PolycentricClient::default();
+        // Digest is computed over different bytes than we try to insert.
+        let digest = sha256_digest(b"the real content");
+        let tampered = b"tampered content".to_vec();
+
+        assert!(
+            client.copy_content(&digest, tampered).is_err(),
+            "content that does not hash to its digest must be rejected"
+        );
+        // Rejected content is never stored.
+        assert!(client.find_content_from_digest(&digest).is_none());
+    }
+
+    #[test]
+    fn copy_content_rejects_unsupported_digest_type() {
+        let mut client = PolycentricClient::default();
+        let bytes = b"hello content".to_vec();
+        // Correct hash value, but a digest type we can't verify.
+        let mut digest = sha256_digest(&bytes);
+        digest.r#type = ContentDigestType::Sha256 as i32 + 1;
+
+        assert!(
+            client.copy_content(&digest, bytes).is_err(),
+            "unsupported digest types must be rejected"
+        );
+        assert!(client.find_content_from_digest(&digest).is_none());
+    }
 }

packages/rs-core/src/client.rs

@@ -28,10 +28,11 @@ tonic = { workspace = true, features = ["router", "transport"] }
 tonic-prost.workspace = true
 tonic-reflection = "0.14"
 tonic-web = "0.14"
-tower-http = { version = "0.6", features = ["cors"] }
+tower-http = { version = "0.7", features = ["cors"] }
 tower-layer = "0.3"
 http = "1"
 
 [dev-dependencies]
 mockito = "1"
+tonic-prost-build = "*"