fix(builder): Add packageref validation for name and variant size

examples/sample-foundry-project/cannonfile.consumer.toml

@@ -41,11 +41,9 @@ args = ["<%= contracts.cloned.address %>", "<%= formatBytes32String(settings.cha
 
 var.NewCloneGreeting.event = "NewGreetingAdded"
 var.NewCloneGreeting.arg = 0
-var.NewCloneGreeting.artifact = "Greeter"
 
 var.OldCloneGreeting.event = "OldGreetingRemoved"
 var.OldCloneGreeting.arg = 0
-var.OldCloneGreeting.artifact = "Greeter"
 
 # test to parse through previous emitted event values
 [invoke.set_new_greeting_for_next_clones]

packages/builder/src/definition.test.ts

@@ -28,6 +28,24 @@ describe('ChainDefinition', () => {
 
       expect(() => new ChainDefinition(rawDef)).toThrow('Unrecognized action type invalid at [invalid.saturday]');
     });
+
+    it('throws an error when trying to use a definition with name over 32 bytes', () => {
+      const rawDef = {
+        name: 'package-name-longer-than-32bytes1337',
+        version: '1.0.0',
+      };
+
+      expect(() => new ChainDefinition(rawDef)).toThrow('Package name exceeds 32 bytes');
+    });
+
+    it('throws an error when trying to use a definition with version over 32 bytes', () => {
+      const rawDef = {
+        name: 'package',
+        version: 'package-version-longer-than-32bytes1337',
+      };
+
+      expect(() => new ChainDefinition(rawDef)).toThrow('Package version exceeds 32 bytes');
+    });
   });
 
   describe('validatePackageName()', () => {

packages/builder/src/error/zod.ts

@@ -42,11 +42,11 @@ export const customErrorMap: z.ZodErrorMap = (error, ctx) => {
       }
     case z.ZodIssueCode.too_big:
       return {
-        message: `Expected ${error.path[0]} to equal less than ${error.maximum} but got ${ctx.data}`,
+        message: `Expected ${error.path[0]} to equal less than ${error.maximum} but got ${ctx.data.length}`,
       };
     case z.ZodIssueCode.too_small:
       return {
-        message: `Expected ${error.path[0]} to equal more than ${error.minimum} but got ${ctx.data}`,
+        message: `Expected ${error.path[0]} to equal more than ${error.minimum} but got ${ctx.data.length}`,
       };
     case z.ZodIssueCode.invalid_enum_value:
       return {

packages/builder/src/package.ts

@@ -37,7 +37,7 @@ export interface PackagePublishCall {
 export class PackageReference {
   static DEFAULT_TAG = 'latest';
   static DEFAULT_PRESET = 'main';
-  static PACKAGE_REGEX = /^(?<name>@?[a-z0-9][A-Za-z0-9-]{1,30}[a-z0-9])(?::(?<version>[^@]+))?(@(?<preset>[^\s]+))?$/;
+  static PACKAGE_REGEX = /^(?<name>@?[a-z0-9][A-Za-z0-9-]{1,}[a-z0-9])(?::(?<version>[^@]+))?(@(?<preset>[^\s]+))?$/;
 
   /**
    * Anything before the colon or an @ (if no version is present) is the package name.
@@ -76,19 +76,35 @@ export class PackageReference {
 
     if (!match || !match.groups?.name) {
       throw new Error(
-        `Invalid package name "${ref}". Should be of the format <package-name>:<version> or <package-name>:<version>@<preset>`
+        `Invalid package reference "${ref}". Should be of the format <package-name>:<version> or <package-name>:<version>@<preset>`
       );
     }
 
     const res: PartialRefValues = { name: match.groups.name };
 
+    const nameSize = res.name.length;
+    if (!(nameSize <= 32)) {
+      throw new Error(`Package reference "${ref}" is too long. Package name exceeds 32 bytes`);
+    }
+
     if (match.groups.version) res.version = match.groups.version;
+
+    const versionSize = res.name.length;
+    if (!(versionSize <= 32)) {
+      throw new Error(`Package reference "${ref}" is too long. Package version exceeds 32 bytes`);
+    }
+
     if (match.groups.preset) res.preset = match.groups.preset;
 
     return res;
   }
 
   static isValid(ref: string) {
+    try {
+      PackageReference.parse(ref);
+    } catch (err) {
+      return false;
+    }
     return !!PackageReference.PACKAGE_REGEX.test(ref);
   }
 

packages/builder/src/schemas.ts

@@ -12,7 +12,7 @@ const argtype: z.ZodLazy<any> = z.lazy(() =>
 // <%=  string interpolation %>, step.names or property.names, packages:versions
 const interpolatedRegex = RegExp(/^<%=\s\w+.+[\w()[\]-]+\s%>$/, 'i');
 const stepRegex = RegExp(/^[\w-]+\.[.\w-]+$/, 'i');
-const packageRegex = RegExp(/^(?<name>@?[a-z0-9][a-z0-9-]{1,29}[a-z0-9])(?::(?<version>[^@]+))?(@(?<preset>[^\s]+))?$/, 'i');
+const packageRegex = RegExp(/^(?<name>@?[a-z0-9][a-z0-9-]{1,}[a-z0-9])(?::(?<version>[^@]+))?(@(?<preset>[^\s]+))?$/, 'i');
 const jsonAbiPathRegex = RegExp(/^(?!.*\.d?$).*\.json?$/, 'i');
 
 // This regex matches artifact names which are just capitalized words like solidity contract names
@@ -209,6 +209,34 @@ export const pullSchema = z
           message: `Source value: ${val} must match package formats: "package:version" or "package:version@preset" or operation name "import.Contract" or be an interpolated value`,
         })
       )
+      .refine(
+        (val) => {
+          const match = val.match(packageRegex);
+
+          if (match) {
+            const nameSize = match!.groups!.name.length;
+
+            return nameSize <= 32;
+          } else {
+            return true;
+          }
+        },
+        (val) => ({ message: `Package reference "${val}" is too long. Package name exceeds 32 bytes` })
+      )
+      .refine(
+        (val) => {
+          const match = val.match(packageRegex);
+
+          if (match && match!.groups!.version) {
+            const versionSize = match!.groups!.version.length;
+
+            return versionSize <= 32;
+          } else {
+            return true;
+          }
+        },
+        (val) => ({ message: `Package reference "${val}" is too long. Package version exceeds 32 bytes` })
+      )
       .describe('Source of the cannonfile package to import from. Can be a cannonfile operation name or package name'),
   })
   .merge(
@@ -502,6 +530,33 @@ export const cloneSchema = z
           message: `Source value: ${val} must match package formats: "package:version" or "package:version@preset" or be an interpolated value`,
         })
       )
+      .refine(
+        (val) => {
+          const match = val.match(packageRegex);
+          if (match) {
+            const nameSize = match!.groups!.name.length;
+
+            return nameSize <= 32;
+          } else {
+            return true;
+          }
+        },
+        (val) => ({ message: `Package reference "${val}" is too long. Package name exceeds 32 bytes` })
+      )
+      .refine(
+        (val) => {
+          const match = val.match(packageRegex);
+
+          if (match && match!.groups!.version) {
+            const versionSize = match!.groups!.version.length;
+
+            return versionSize <= 32;
+          } else {
+            return true;
+          }
+        },
+        (val) => ({ message: `Package reference "${val}" is too long. Package version exceeds 32 bytes` })
+      )
       .describe('Name of the package to provision'),
   })
   .merge(
@@ -536,7 +591,34 @@ export const cloneSchema = z
               message: `Target value: ${val} must match package formats: "package:version" or "package:version@preset" or be an interpolated value`,
             })
           )
-          .describe('Name of the package to provision'),
+          .refine(
+            (val) => {
+              const match = val.match(packageRegex);
+              if (match) {
+                const nameSize = match!.groups!.name.length;
+
+                return nameSize <= 32;
+              } else {
+                return true;
+              }
+            },
+            (val) => ({ message: `Package reference "${val}" is too long. Package name exceeds 32 bytes` })
+          )
+          .refine(
+            (val) => {
+              const match = val.match(packageRegex);
+
+              if (match && match!.groups!.version) {
+                const versionSize = match!.groups!.version.length;
+
+                return versionSize <= 32;
+              } else {
+                return true;
+              }
+            },
+            (val) => ({ message: `Package reference "${val}" is too long. Package version exceeds 32 bytes` })
+          )
+          .describe('Name of the package to clone'),
         /**
          *  (DEPRECATED) use `target` instead. Set the new preset to use for this package.
          * Default - "main"
@@ -654,7 +736,12 @@ export const chainDefinitionSchema = z
     name: z
       .string()
       .min(3)
-      .max(31)
+      .refine(
+        (val) => {
+          return new Blob([val]).size <= 32;
+        },
+        (val) => ({ message: `Package name "${val}" is too long. Package name exceeds 32 bytes` })
+      )
       .refine((val) => !!val.match(RegExp(/[a-zA-Z0-9-]+/, 'gm')), {
         message: 'Name cannot contain any special characters',
       })
@@ -664,7 +751,12 @@ export const chainDefinitionSchema = z
      */
     version: z
       .string()
-      .max(31)
+      .refine(
+        (val) => {
+          return new Blob([val]).size <= 32;
+        },
+        (val) => ({ message: `Package version "${val}" is too long. Package version exceeds 32 bytes` })
+      )
       .refine((val) => !!val.match(RegExp(/[\w.]+/, 'gm')), {
         message: 'Version cannot contain any special characters',
       })

packages/builder/src/steps/clone.test.ts

@@ -92,6 +92,132 @@ describe('steps/clone.ts', () => {
       ).rejects.toThrowError('deployment not found');
     });
 
+    it('throws if source name is longer than 32 bytes', async () => {
+      await expect(() =>
+        action.exec(
+          fakeRuntime,
+          fakeCtx,
+          { source: 'package-name-longer-than-32bytes1337:1.0.0' },
+          { name: 'package', version: '1.0.0', currentLabel: 'clone.whatever' }
+        )
+      ).rejects.toThrowError('Package name exceeds 32 bytes');
+    });
+
+    it('throws if source version is longer than 32 bytes', async () => {
+      jest.mocked(fakeRuntime.readDeploy).mockResolvedValue({
+        generator: 'cannon test',
+        timestamp: 1234,
+        state: {
+          'deploy.Woot': {
+            version: BUILD_VERSION,
+            hash: 'arst',
+            artifacts: {
+              contracts: {
+                Woot: {
+                  address: '0xfoobar',
+                  abi: [],
+                  deployTxnHash: '0x',
+                  contractName: 'Woot',
+                  sourceName: 'Woot.sol',
+                  deployedOn: 'deploy.Woot',
+                  gasCost: '0',
+                  gasUsed: 0,
+                },
+              },
+            },
+          },
+        },
+        options: {},
+        def: {
+          name: 'package',
+          version: '1.0.0',
+          var: {
+            main: {
+              sophisticated: 'fast',
+            },
+          },
+          clone: {
+            source: { source: 'package:package-version-longer-than-32bytes1337' },
+            target: { target: 'package:1.0.0' },
+          },
+        } as any,
+        meta: {},
+        miscUrl: 'https://something.com',
+      });
+
+      await expect(() =>
+        action.exec(
+          fakeRuntime,
+          fakeCtx,
+          { source: 'package:package-version-longer-than-32bytes1337' },
+          { name: 'package', version: '1.0.0', currentLabel: 'clone.whatever' }
+        )
+      ).rejects.toThrowError('Package version exceeds 32 bytes');
+    });
+
+    it('throws if target name is longer than 32 bytes', async () => {
+      await expect(() =>
+        action.exec(
+          fakeRuntime,
+          fakeCtx,
+          { source: 'package:1.0.0', target: 'package-name-longer-than-32bytes1337:1.0.0' },
+          { name: 'package', version: '1.0.0', currentLabel: 'clone.whatever' }
+        )
+      ).rejects.toThrowError('Package name exceeds 32 bytes');
+    });
+
+    it('throws if target version is longer than 32 bytes', async () => {
+      jest.mocked(fakeRuntime.readDeploy).mockResolvedValue({
+        generator: 'cannon test',
+        timestamp: 1234,
+        state: {
+          'deploy.Woot': {
+            version: BUILD_VERSION,
+            hash: 'arst',
+            artifacts: {
+              contracts: {
+                Woot: {
+                  address: '0xfoobar',
+                  abi: [],
+                  deployTxnHash: '0x',
+                  contractName: 'Woot',
+                  sourceName: 'Woot.sol',
+                  deployedOn: 'deploy.Woot',
+                  gasCost: '0',
+                  gasUsed: 0,
+                },
+              },
+            },
+          },
+        },
+        options: {},
+        def: {
+          name: 'package',
+          version: '1.0.0',
+          var: {
+            main: {
+              sophisticated: 'fast',
+            },
+          },
+          clone: {
+            source: { source: 'package:package-version-longer-than-32bytes1337' },
+            target: { target: 'package:package-version-longer-than-32bytes1337' },
+          },
+        } as any,
+        meta: {},
+        miscUrl: 'https://something.com',
+      });
+
+      await expect(() =>
+        action.exec(
+          fakeRuntime,
+          fakeCtx,
+          { source: 'package:1.0.0', target: 'package:package-version-longer-than-32bytes1337' },
+          { name: 'package', version: '1.0.0', currentLabel: 'clone.whatever' }
+        )
+      ).rejects.toThrowError('Package version exceeds 32 bytes');
+    });
+
     it('returns partial deployment if runtime becomes cancelled', async () => {
       await registry.publish(['hello:1.0.0@main'], 1234, 'https://something.com', '');