@@ -317,7 +317,7 @@ serve = \req -> case req of
317317 t <- now
318318 msgId <- genToken
319319 let clampedTs = if timestamp > t then t else if timestamp < t - messageMaxAge then t else timestamp
320− let validInput = not (to == "") && not (encryptedBlob == "") && isValidHex to && not (tooLong to maxPubkeyLen) && not (tooLong encryptedBlob maxBlobLen)
320+ let validInput = not (to == "") && not (encryptedBlob == "") && isValidHex to && isValidHex encryptedBlob && not (tooLong to maxPubkeyLen) && not (tooLong encryptedBlob maxBlobLen)
321321 result <- atomic do
322322 pr <- pruneExpired t
323323 sessions <- *sessions
@@ -621,7 +621,7 @@ serve = \req -> case req of
621621 t <- now
622622 let authorized = verifyFederationAuth authorization
623623 let validOrigin = not (originServer == "") && not (originServer == serverHost) && not (tooLong originServer maxPubkeyLen)
624− let validFields = not (toKey == "") && not (fromKey == "") && not (encryptedBlob == "") && not (messageId == "") && isValidHex toKey && isValidHex fromKey && isValidHex messageId && not (tooLong toKey maxPubkeyLen) && not (tooLong fromKey maxPubkeyLen) && not (tooLong encryptedBlob maxBlobLen) && not (tooLong messageId maxPubkeyLen)
624+ let validFields = not (toKey == "") && not (fromKey == "") && not (encryptedBlob == "") && not (messageId == "") && isValidHex toKey && isValidHex fromKey && isValidHex encryptedBlob && isValidHex messageId && not (tooLong toKey maxPubkeyLen) && not (tooLong fromKey maxPubkeyLen) && not (tooLong encryptedBlob maxBlobLen) && not (tooLong messageId maxPubkeyLen)
625625 let clampedTs = if timestamp > t then t else if timestamp < t - messageMaxAge then t else timestamp
626626 pruneResult <- atomic do
627627 pr <- pruneExpired t
@@ -631,6 +631,7 @@ serve = \req -> case req of
631631 let exists = count (do
632632 m <- messages
633633 where m.messageId == messageId
634+ where m.toKey == toKey
634635 where m.receivedAt >= t - messageMaxAge
635636 yield m) > 0
636637 let shouldInsert = authorized && validOrigin && validFields && not exists