just-execute: verify the validity of all the hashes received over the wire

1 files changed, 10 insertions, 0 deletions

diff --git a/src/buildtool/execution_api/execution_service/bytestream_server.cpp b/src/buildtool/execution_api/execution_service/bytestream_server.cpp
index 476b8502..69bac9a0 100644
--- a/src/buildtool/execution_api/execution_service/bytestream_server.cpp
+++ b/src/buildtool/execution_api/execution_service/bytestream_server.cpp
@@ -23,6 +23,7 @@
 #include "src/buildtool/execution_api/common/bytestream_common.hpp"
 #include "src/buildtool/storage/garbage_collector.hpp"
 #include "src/utils/cpp/tmp_dir.hpp"
+#include "src/utils/cpp/verify_hash.hpp"
 
 namespace {
 auto ParseResourceName(std::string const& x) -> std::optional<std::string> {
@@ -53,6 +54,11 @@ auto BytestreamServiceImpl::Read(
         return ::grpc::Status{::grpc::StatusCode::INVALID_ARGUMENT, str};
     }
 
+    if (auto error_msg = IsAHash(*hash); error_msg) {
+        logger_.Emit(LogLevel::Debug, *error_msg);
+        return ::grpc::Status{::grpc::StatusCode::INVALID_ARGUMENT, *error_msg};
+    }
+
     auto lock = GarbageCollector::SharedLock();
     if (!lock) {
         auto str = fmt::format("Could not acquire SharedLock");
@@ -108,6 +114,10 @@ auto BytestreamServiceImpl::Write(
         logger_.Emit(LogLevel::Error, str);
         return ::grpc::Status{::grpc::StatusCode::INVALID_ARGUMENT, str};
     }
+    if (auto error_msg = IsAHash(*hash); error_msg) {
+        logger_.Emit(LogLevel::Debug, *error_msg);
+        return ::grpc::Status{::grpc::StatusCode::INVALID_ARGUMENT, *error_msg};
+    }
     logger_.Emit(LogLevel::Trace,
                  "Write: {}, offset {}, finish write {}",
                  *hash,