hints: prevent malicious timestamp hints to bork calculations.

nbd-wtf · Nov 29, 2024 · 9df2fc8 · 9df2fc8
1 parent 2519cab
commit 9df2fc8
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/sdk/hints/memory/db.go b/sdk/hints/memory/db.go
@@ -27,6 +27,10 @@ func NewHintDB() *HintDB {
 }
 
 func (db *HintDB) Save(pubkey string, relay string, key hints.HintKey, ts nostr.Timestamp) {
+	if now := nostr.Now(); ts > now {
+		ts = now
+	}
+
 	relayIndex := slices.Index(db.RelayBySerial, relay)
 	if relayIndex == -1 {
 		relayIndex = len(db.RelayBySerial)

diff --git a/sdk/hints/sqlite/db.go b/sdk/hints/sqlite/db.go
@@ -87,11 +87,15 @@ func (sh SQLiteHints) TopN(pubkey string, n int) []string {
 	return res
 }
 
-func (sh SQLiteHints) Save(pubkey string, relay string, key hints.HintKey, score nostr.Timestamp) {
-	_, err := sh.saves[key].Exec(pubkey, relay, score, score)
+func (sh SQLiteHints) Save(pubkey string, relay string, key hints.HintKey, ts nostr.Timestamp) {
+	if now := nostr.Now(); ts > now {
+		ts = now
+	}
+
+	_, err := sh.saves[key].Exec(pubkey, relay, ts, ts)
 	if err != nil {
 		nostr.InfoLogger.Printf("[sdk/hints/sqlite] unexpected error on insert for %s, %s, %d: %s\n",
-			pubkey, relay, score, err)
+			pubkey, relay, ts, err)
 	}
 }