fix: check hash and node ID sizes when writing masternode list diffs

lib/deterministicmnlist/SimplifiedMNListDiff.js

@@ -221,6 +221,13 @@ SimplifiedMNListDiff.fromHexString = function fromHexString(
  * @return {Buffer}
  */
 SimplifiedMNListDiff.prototype.toBuffer = function toBuffer() {
+  ['baseBlockHash', 'blockHash'].forEach((name) => {
+    $.checkArgument(
+      isHexStringOfSize(this[name], constants.SHA256_HASH_SIZE * 2),
+      `Expected ${name} to be a sha256 hex string`
+    );
+  });
+
   const bufferWriter = new BufferWriter();
 
   // Diffs from Core RPC that predate nVersion are version 1
@@ -241,6 +248,10 @@ SimplifiedMNListDiff.prototype.toBuffer = function toBuffer() {
 
   bufferWriter.writeVarintNum(this.deletedMNs.length);
   this.deletedMNs.forEach((deleteMNHash) => {
+    $.checkArgument(
+      isHexStringOfSize(deleteMNHash, constants.SHA256_HASH_SIZE * 2),
+      'Expected deletedMNs to hold sha256 hex strings'
+    );
     bufferWriter.write(Buffer.from(deleteMNHash, 'hex').reverse());
   });
 
@@ -251,6 +262,10 @@ SimplifiedMNListDiff.prototype.toBuffer = function toBuffer() {
 
   bufferWriter.writeVarintNum(this.deletedQuorums.length);
   this.deletedQuorums.forEach((deletedQuorum) => {
+    $.checkArgument(
+      isHexStringOfSize(deletedQuorum.quorumHash, constants.SHA256_HASH_SIZE * 2),
+      'Expected deletedQuorums quorumHash to be a sha256 hex string'
+    );
     bufferWriter.writeUInt8(deletedQuorum.llmqType);
     bufferWriter.write(Buffer.from(deletedQuorum.quorumHash, 'hex').reverse());
   });

lib/deterministicmnlist/SimplifiedMNListEntry.js

@@ -369,8 +369,8 @@ SimplifiedMNListEntry.prototype.validate = function validate() {
     }
 
     $.checkArgument(
-      typeof this.platformNodeID === 'string',
-      'Expected platformNodeID to be a string'
+      utils.isHexStringOfSize(this.platformNodeID, PLATFORM_NODE_ID_SIZE * 2),
+      'Expected platformNodeID to be a 20-byte hex string'
     );
   }
 };

test/deterministicmnlist/SimplifiedMNListDiff.js

@@ -253,6 +253,32 @@ describe('SimplifiedMNListDiff', function () {
         Object.assign({}, mnListDiffJSON, { quorumsCLSigs: [] })
       );
     });
+
+    var hash = mnListDiffJSON.blockHash;
+    [
+      ['a short baseBlockHash', function (diff) { diff.baseBlockHash = 'abcd'; },
+        'Expected baseBlockHash to be a sha256 hex string'],
+      ['a long blockHash', function (diff) { diff.blockHash = hash + '00'; },
+        'Expected blockHash to be a sha256 hex string'],
+      ['a non-hex blockHash', function (diff) { diff.blockHash = hash.slice(0, -2) + 'zz'; },
+        'Expected blockHash to be a sha256 hex string'],
+      ['a short deletedMNs hash', function (diff) { diff.deletedMNs = [hash.slice(2)]; },
+        'Expected deletedMNs to hold sha256 hex strings'],
+      ['a deletedMNs buffer', function (diff) { diff.deletedMNs = [Buffer.from(hash, 'hex')]; },
+        'Expected deletedMNs to hold sha256 hex strings'],
+      ['a short deleted quorum hash',
+        function (diff) { diff.deletedQuorums = [{ llmqType: 1, quorumHash: hash.slice(2) }]; },
+        'Expected deletedQuorums quorumHash to be a sha256 hex string'],
+    ].forEach(function (testCase) {
+      it('Should reject ' + testCase[0], function () {
+        var diff = new SimplifiedMNListDiff(mnListDiffJSON);
+        testCase[1](diff);
+
+        expect(function () {
+          diff.toBuffer();
+        }).to.throw(testCase[2]);
+      });
+    });
   });
   describe('toBuffer quorumsCLSigs', function () {
     var signature = coreDiffsJSON[0].quorumsCLSigs[0];

test/deterministicmnlist/SimplifiedMNListEntry.js

@@ -175,6 +175,17 @@ describe('SimplifiedMNListEntry', function () {
         entryWithDifferentKeys.length
       );
     });
+    ['', 'abcd', smlEntryJSON.platformNodeID + '00', smlEntryJSON.platformNodeID.slice(0, -2) + 'zz']
+      .forEach(function (platformNodeID) {
+        it('Should reject an evonode platformNodeID "' + platformNodeID + '" that is not 20 bytes of hex', function () {
+          var entry = new SimplifiedMNListEntry(smlEntryJSON);
+          entry.platformNodeID = platformNodeID;
+
+          expect(function () {
+            entry.toP2PBuffer();
+          }).to.throw('Expected platformNodeID to be a 20-byte hex string');
+        });
+      });
   });
   describe('P2P serialization', function () {
     // Core sends entries as nVersion followed by the hashed fields