fix(tlock): reject malformed hex input (#179)

Co-authored-by: emrekayat <237104270+emrekayat@users.noreply.github.com>

Author: emrekayat

packages/tlock/src/commitment.test.ts

@@ -6,6 +6,7 @@ import {
   commitment,
   decodeBidPreimage,
   encodeBidPreimage,
+  fromHex,
   i128ToBeBytes,
   toHex,
 } from "./commitment.js";
@@ -51,3 +52,23 @@ test("rejects out-of-range and malformed inputs", () => {
   assert.throws(() => encodeBidPreimage(1n, new Uint8Array(31)));
   assert.throws(() => decodeBidPreimage(new Uint8Array(47)));
 });
+
+test("fromHex decodes lowercase, uppercase, and prefixed values", () => {
+  const expected = [0xab, 0xcd, 0xef];
+  assert.deepEqual([...fromHex("abcdef")], expected);
+  assert.deepEqual([...fromHex("ABCDEF")], expected);
+  assert.deepEqual([...fromHex("0xAbCdEf")], expected);
+  assert.deepEqual([...fromHex("0XABCDEF")], expected);
+});
+
+test("fromHex accepts empty input as an empty byte array", () => {
+  assert.deepEqual([...fromHex("")], []);
+  assert.deepEqual([...fromHex("0x")], []);
+});
+
+test("fromHex rejects odd-length and non-hex input", () => {
+  assert.throws(() => fromHex("abc"), /odd hex length/);
+  assert.throws(() => fromHex("zz"), /invalid hex characters/);
+  assert.throws(() => fromHex("12 3"), /invalid hex characters/);
+  assert.throws(() => fromHex("0x12gg"), /invalid hex characters/);
+});

packages/tlock/src/commitment.ts

@@ -78,8 +78,11 @@ export function toHex(bytes: Uint8Array): string {
 }
 
 export function fromHex(hex: string): Uint8Array {
-  const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+  const clean = /^0x/i.test(hex) ? hex.slice(2) : hex;
   if (clean.length % 2 !== 0) throw new Error("odd hex length");
+  if (!/^[0-9a-fA-F]*$/.test(clean)) {
+    throw new Error("invalid hex characters");
+  }
   const out = new Uint8Array(clean.length / 2);
   for (let i = 0; i < out.length; i++) {
     out[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);