diff --git a/src/cid.js b/src/cid.js index a13d4ec8..852b3d53 100644 --- a/src/cid.js +++ b/src/cid.js @@ -484,6 +484,10 @@ export class CID { const cid = CID.decode(bytes) + if (cid.version === 0 && source[0] !== 'Q') { + throw Error('Version 0 CID string must not include multibase prefix') + } + // Cache string representation to avoid computing it on `this.toString()` baseCache(cid).set(prefix, source) diff --git a/test/test-cid.spec.js b/test/test-cid.spec.js index cf59103a..e6a6b806 100644 --- a/test/test-cid.spec.js +++ b/test/test-cid.spec.js @@ -85,6 +85,12 @@ describe('CID', () => { assert.throws(() => cid.toString(base32), msg) }) + it('throws on CIDv0 string with explicit multibase prefix', async () => { + const str = 'zQmdfTbBqBPQ7VNxZEYEj14VmRuZBkqFbiwReogJgS1zR1n' + const msg = 'Version 0 CID string must not include multibase prefix' + assert.throws(() => CID.parse(str), msg) + }) + it('.bytes', async () => { const hash = await sha256.digest(textEncoder.encode('abc')) const codec = 112