Documentation
¶
Overview ¶
Package verifcid validates CIDs against configurable hash function allowlists.
ValidateCid checks that a CID's multihash uses an allowed hash function and that the digest size falls within the permitted range. The DefaultAllowlist permits common secure hash functions (SHA2, SHA3, BLAKE2, BLAKE3) and identity CIDs with constrained digest sizes.
Custom Allowlists ¶
Use NewAllowlist to build a custom set of allowed hash functions, or NewOverridingAllowlist to extend an existing allowlist with overrides.
Index ¶
Constants ¶
const ( // DefaultMinDigestSize is the default minimum size for hash digests (except for identity hashes) DefaultMinDigestSize = 20 // DefaultMaxDigestSize is the default maximum size for cryptographic hash digests. // This does not apply to identity hashes which are not cryptographic and use DefaultMaxIdentityDigestSize instead. DefaultMaxDigestSize = 128 // DefaultMaxIdentityDigestSize is the default maximum size for identity CID digests. // Identity CIDs (with multihash code 0x00) are not cryptographic hashes - they embed // data directly in the CID. This separate limit prevents abuse while allowing // different size constraints than cryptographic digests. DefaultMaxIdentityDigestSize = 128 )
Variables ¶
var ( ErrPossiblyInsecureHashFunction = errors.New("potentially insecure hash functions not allowed") ErrDigestTooSmall = errors.New("digest too small") ErrDigestTooLarge = errors.New("digest too large") // Deprecated: Use ErrDigestTooSmall instead ErrBelowMinimumHashLength = ErrDigestTooSmall // Deprecated: Use ErrDigestTooLarge instead ErrAboveMaximumHashLength = ErrDigestTooLarge )
var DefaultAllowlist defaultAllowlist
DefaultAllowlist is the default list of hashes allowed in IPFS.
Functions ¶
Types ¶
type Allowlist ¶ added in v0.12.0
type Allowlist interface {
// IsAllowed checks for multihash allowance by the code.
IsAllowed(code uint64) bool
// MinDigestSize returns the minimum digest size for a given multihash code.
MinDigestSize(code uint64) int
// MaxDigestSize returns the maximum digest size for a given multihash code.
MaxDigestSize(code uint64) int
}
Allowlist defines an interface containing list of allowed multihashes.
func NewAllowlist ¶ added in v0.12.0
NewAllowlist constructs new Allowlist from the given map set.
func NewOverridingAllowlist ¶ added in v0.12.0
NewOverridingAllowlist is like NewAllowlist but it will fallback to an other [AllowList] if keys are missing. If override is nil it will return unsecure for unknown things.
Source Files