fix: reject expiration timestamp 0 and accept far-future timestamps in getEventExpiration()

.changeset/fix-event-expiration-validation.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+fix: reject expiration timestamp 0 and millisecond-scale values, and accept safe-integer second-based timestamps up to year 9999 in getEventExpiration()

src/utils/event.ts

@@ -245,6 +245,11 @@ export const isExpiredEvent = (event: Event): boolean => {
   return expirationTime <= now
 }
 
+// 9999-12-31T23:59:59Z as Unix seconds. Millisecond-scale timestamps for any date
+// from 2001 onward are at least 13 digits, well past this ceiling, so this rejects
+// accidental millisecond values without capping legitimate far-future expirations.
+const MAX_EXPIRATION_TIME = 253402300799
+
 export const getEventExpiration = (event: Event): number | undefined => {
   const [, rawExpirationTime] = event.tags.find((tag) => tag.length >= 2 && tag[0] === EventTags.Expiration) ?? []
   if (!rawExpirationTime) {
@@ -253,7 +258,7 @@ export const getEventExpiration = (event: Event): number | undefined => {
 
   const expirationTime = Number(rawExpirationTime)
 
-  if (Number.isSafeInteger(expirationTime) && Math.log10(expirationTime) < 10) {
+  if (Number.isSafeInteger(expirationTime) && expirationTime > 0 && expirationTime <= MAX_EXPIRATION_TIME) {
     return expirationTime
   }
 }

test/unit/utils/event.spec.ts

@@ -691,6 +691,26 @@ describe('NIP-40', () => {
       event.tags = [['expiration', 'a']]
       expect(getEventExpiration(event)).to.be.undefined
     })
+
+    it('returns false if expiration is 0', () => {
+      event.tags = [['expiration', '0']]
+      expect(getEventExpiration(event)).to.be.undefined
+    })
+
+    it('returns true if expiration is a safe integer beyond year 2287', () => {
+      event.tags = [['expiration', '10000000000']]
+      expect(getEventExpiration(event)).to.equal(10000000000)
+    })
+
+    it('returns true if expiration is the maximum representable Unix seconds timestamp', () => {
+      event.tags = [['expiration', '253402300799']]
+      expect(getEventExpiration(event)).to.equal(253402300799)
+    })
+
+    it('returns false if expiration looks like a millisecond-scale timestamp', () => {
+      event.tags = [['expiration', '1700000000000']]
+      expect(getEventExpiration(event)).to.be.undefined
+    })
   })
 
   describe('isExpiredEvent', () => {