db.put(): throw INVALID_REV for invalid revs (#8931)

Author: alxndrsn

packages/node_modules/pouchdb-core/src/adapter.js

@@ -190,6 +190,10 @@ function attachmentNameError(name) {
   return false;
 }
 
+function isValidRev(rev) {
+  return typeof rev === 'string' && /^\d+-/.test(rev);
+}
+
 class AbstractPouchDB extends EventEmitter {
   _setup() {
     this.post = adapterFun('post', function (doc, opts, callback) {
@@ -212,6 +216,9 @@ class AbstractPouchDB extends EventEmitter {
         return cb(createError(NOT_AN_OBJECT));
       }
       invalidIdError(doc._id);
+      if ('_rev' in doc && !isValidRev(doc._rev)) {
+        return cb(createError(INVALID_REV));
+      }
       if (isLocalId(doc._id) && typeof this._putLocal === 'function') {
         if (doc._deleted) {
           return this._removeLocal(doc, cb);
@@ -555,7 +562,7 @@ class AbstractPouchDB extends EventEmitter {
             for (var i = 0; i < leaves.length; i++) {
               var l = leaves[i];
               // looks like it's the only thing couchdb checks
-              if (!(typeof (l) === "string" && /^\d+-/.test(l))) {
+              if (!isValidRev(l)) {
                 return cb(createError(INVALID_REV));
               }
             }

tests/integration/test.basics.js

@@ -268,6 +268,54 @@ adapters.forEach(function (adapter) {
       });
     });
 
+    [
+      () => '-format',
+      () => 'bad-format',
+      () => ({}),
+      () => ({ toString:'2-abc' }),
+      () => ({ toString:'2-abc', indexOf:777 }),
+      () => ({ toString:'2-abc', indexOf:() => -1000 }),
+      () => ({ toString:'2-abc', indexOf:() => -1000, substring:'hi' }),
+      () => ({ toString:'2-abc', indexOf:() => -1000, substring:() => 'hi' }),
+      () => ({ toString:() => '2-abc' }),
+      () => ({ toString:() => '2-abc', indexOf:777 }),
+      () => ({ toString:() => '2-abc', indexOf:() => 12 }),
+      () => ({ toString:() => '2-abc', indexOf:() => 12, substring:'hi' }),
+      () => ({ toString:() => '2-abc', indexOf:() => 12, substring:() => 'hi' }),
+      ({ rev }) => ({ toString:rev }),
+      ({ rev }) => ({ toString:rev, indexOf:777 }),
+      ({ rev }) => ({ toString:rev, indexOf:() => -1000 }),
+      ({ rev }) => ({ toString:rev, indexOf:() => -1000, substring:'hi' }),
+      ({ rev }) => ({ toString:rev, indexOf:() => -1000, substring:() => 'hi' }),
+      ({ rev }) => ({ toString:() => rev }),
+      ({ rev }) => ({ toString:() => rev, indexOf:777 }),
+      ({ rev }) => ({ toString:() => rev, indexOf:() => 12 }),
+      ({ rev }) => ({ toString:() => rev, indexOf:() => 12, substring:'hi' }),
+      ({ rev }) => ({ toString:() => rev, indexOf:() => 12, substring:() => 'hi' }),
+    ].forEach((generateRev, idx) => {
+      it(`Modify a doc with illegal rev value #${idx}`, async () => {
+        const db = new PouchDB(dbs.name);
+
+        const info = await db.post({ test: 'somestuff' });
+
+        let threw;
+        try {
+          await db.put({
+            _id: info.id,
+            _rev: generateRev(info),
+            another: 'test'
+          });
+        } catch (err) {
+          threw = true;
+          err.message.should.equal('Invalid rev format'); // TODO should be err.reason?
+        }
+
+        if (!threw) {
+          throw new Error('db.put() should have thrown.');
+        }
+      });
+    });
+
     it('Remove doc', function (done) {
       var db = new PouchDB(dbs.name);
       db.post({ test: 'somestuff' }, function (err, info) {