Harden Nostr tag handling

bitchat/App/LocationPresenceStore.swift

@@ -7,19 +7,8 @@ final class LocationPresenceStore: ObservableObject {
     @Published private(set) var geoNicknames: [String: String] = [:]
     @Published private(set) var teleportedGeo: Set<String> = []
 
-    private let teleportedGeoCapacity: Int
-    private var teleportedGeoOrder: [String] = []
-
-    init(teleportedGeoCapacity: Int = TransportConfig.geoTeleportedParticipantsCap) {
-        self.teleportedGeoCapacity = max(0, teleportedGeoCapacity)
-    }
-
     func setCurrentGeohash(_ geohash: String?) {
-        let normalized = geohash?.lowercased()
-        if currentGeohash != normalized {
-            clearTeleportedGeo()
-        }
-        currentGeohash = normalized
+        currentGeohash = geohash?.lowercased()
     }
 
     func setNickname(_ nickname: String, for pubkeyHex: String) {
@@ -39,63 +28,24 @@ final class LocationPresenceStore: ObservableObject {
     }
 
     func markTeleported(_ pubkeyHex: String) {
-        guard teleportedGeoCapacity > 0 else {
-            clearTeleportedGeo()
-            return
-        }
-
-        let key = pubkeyHex.lowercased()
-        guard !teleportedGeo.contains(key) else { return }
-
-        while teleportedGeoOrder.count >= teleportedGeoCapacity, let oldest = teleportedGeoOrder.first {
-            teleportedGeoOrder.removeFirst()
-            teleportedGeo.remove(oldest)
-        }
-
-        teleportedGeo.insert(key)
-        teleportedGeoOrder.append(key)
+        teleportedGeo.insert(pubkeyHex.lowercased())
     }
 
     func clearTeleported(_ pubkeyHex: String) {
-        let key = pubkeyHex.lowercased()
-        teleportedGeo.remove(key)
-        teleportedGeoOrder.removeAll { $0 == key }
+        teleportedGeo.remove(pubkeyHex.lowercased())
     }
 
     func replaceTeleportedGeo(_ pubkeys: Set<String>) {
-        guard teleportedGeoCapacity > 0 else {
-            clearTeleportedGeo()
-            return
-        }
-
-        var seen: Set<String> = []
-        var ordered: [String] = []
-        for key in pubkeys.map({ $0.lowercased() }) where !seen.contains(key) {
-            seen.insert(key)
-            ordered.append(key)
-        }
-        if ordered.count > teleportedGeoCapacity {
-            ordered = Array(ordered.suffix(teleportedGeoCapacity))
-        }
-        teleportedGeoOrder = ordered
-        teleportedGeo = Set(ordered)
-    }
-
-    func retainTeleportedGeo(keeping pubkeys: Set<String>) {
-        let allowed = Set(pubkeys.map { $0.lowercased() })
-        teleportedGeoOrder = teleportedGeoOrder.filter { allowed.contains($0) }
-        teleportedGeo = teleportedGeo.intersection(allowed)
+        teleportedGeo = Set(pubkeys.map { $0.lowercased() })
     }
 
     func clearTeleportedGeo() {
         teleportedGeo.removeAll()
-        teleportedGeoOrder.removeAll()
     }
 
     func reset() {
         currentGeohash = nil
         geoNicknames.removeAll()
         teleportedGeo.removeAll()
-        teleportedGeoOrder.removeAll()
     }
 }

bitchat/Nostr/NostrProtocol.swift

@@ -501,6 +501,10 @@ struct NostrEvent: Codable {
             throw NostrError.invalidEvent
         }
         
+        guard Self.isWithinInboundTagLimits(tags) else {
+            throw NostrError.invalidEvent
+        }
+
         self.id = dict["id"] as? String ?? ""
         self.pubkey = pubkey
         self.created_at = createdAt
@@ -509,6 +513,17 @@ struct NostrEvent: Codable {
         self.content = content
         self.sig = dict["sig"] as? String
     }
+
+    private static func isWithinInboundTagLimits(_ tags: [[String]]) -> Bool {
+        guard tags.count <= TransportConfig.nostrMaxEventTags else { return false }
+
+        for tag in tags {
+            guard tag.count <= TransportConfig.nostrMaxEventTagValues else { return false }
+            guard tag.allSatisfy({ $0.utf8.count <= TransportConfig.nostrMaxEventTagValueBytes }) else { return false }
+        }
+
+        return true
+    }
     
     func sign(with key: P256K.Schnorr.PrivateKey) throws -> NostrEvent {
         let (eventId, eventIdHash) = try calculateEventId()

bitchat/Nostr/NostrRelayManager.swift

@@ -963,6 +963,7 @@ private enum ParsedInbound {
     
     init?(_ message: URLSessionWebSocketTask.Message) {
         guard let data = message.data,
+              data.count <= TransportConfig.nostrMaxInboundMessageBytes,
               let array = try? JSONSerialization.jsonObject(with: data) as? [Any],
               array.count >= 2,
               let type = array[0] as? String else {

bitchat/Services/TransportConfig.swift

@@ -17,7 +17,6 @@ enum TransportConfig {
     static let privateChatCap: Int = 1337
     static let meshTimelineCap: Int = 1337
     static let geoTimelineCap: Int = 1337
-    static let geoTeleportedParticipantsCap: Int = 1337
     static let contentLRUCap: Int = 2000
 
     // Timers
@@ -130,6 +129,12 @@ enum TransportConfig {
     static let nostrGeohashSampleLimit: Int = 100
     static let nostrDMSubscribeLookbackSeconds: TimeInterval = 86400
 
+    // Nostr inbound event safety limits
+    static let nostrMaxInboundMessageBytes: Int = 256 * 1024
+    static let nostrMaxEventTags: Int = 64
+    static let nostrMaxEventTagValues: Int = 16
+    static let nostrMaxEventTagValueBytes: Int = 1024
+
     // Nostr helpers
     static let nostrShortKeyDisplayLength: Int = 8
     static let nostrConvKeyPrefixLength: Int = 16

bitchat/ViewModels/ChatNostrCoordinator.swift

@@ -93,10 +93,6 @@ final class ChatNostrCoordinator {
         let hasTeleportTag = event.tags.contains { tag in
             tag.count >= 2 && tag[0].lowercased() == "t" && tag[1].lowercased() == "teleport"
         }
-        let content = event.content.trimmed
-        if hasTeleportTag && content.isEmpty {
-            return
-        }
 
         if hasTeleportTag {
             let key = event.pubkey.lowercased()
@@ -115,6 +111,7 @@ final class ChatNostrCoordinator {
         }
 
         let senderName = viewModel.displayNameForNostrPubkey(event.pubkey)
+        let content = event.content.trimmed
         let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
         let timestamp = min(rawTs, Date())
         let mentions = viewModel.parseMentions(from: content)
@@ -265,8 +262,10 @@ final class ChatNostrCoordinator {
         if viewModel.deduplicationService.hasProcessedNostrEvent(event.id) { return }
         viewModel.deduplicationService.recordNostrEvent(event.id)
 
-        let tagSummary = event.tags.map { "[" + $0.joined(separator: ",") + "]" }.joined(separator: ",")
-        SecureLogger.debug("GeoTeleport: recv pub=\(event.pubkey.prefix(8))… tags=\(tagSummary)", category: .session)
+        SecureLogger.debug(
+            "GeoTeleport: recv pub=\(event.pubkey.prefix(8))… tagCount=\(event.tags.count)",
+            category: .session
+        )
 
         if viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey) {
             return
@@ -275,10 +274,6 @@ final class ChatNostrCoordinator {
         let hasTeleportTag = event.tags.contains { tag in
             tag.count >= 2 && tag[0].lowercased() == "t" && tag[1].lowercased() == "teleport"
         }
-        let content = event.content
-        if hasTeleportTag && content.trimmed.isEmpty {
-            return
-        }
 
         let isSelf: Bool = {
             if let gh = viewModel.currentGeohash,
@@ -321,6 +316,14 @@ final class ChatNostrCoordinator {
         }
 
         let senderName = viewModel.displayNameForNostrPubkey(event.pubkey)
+        let content = event.content
+
+        if let teleTag = event.tags.first(where: { $0.first == "t" }),
+           teleTag.count >= 2,
+           teleTag[1] == "teleport",
+           content.trimmed.isEmpty {
+            return
+        }
 
         let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
         let mentions = viewModel.parseMentions(from: content)

bitchat/ViewModels/ChatViewModelBootstrapper.swift

@@ -121,17 +121,6 @@ private extension ChatViewModelBootstrapper {
                 viewModel?.objectWillChange.send()
             }
             .store(in: &viewModel.cancellables)
-
-        viewModel.participantTracker.$visiblePeople
-            .receive(on: DispatchQueue.main)
-            .sink { [weak viewModel] people in
-                Task { @MainActor [weak viewModel] in
-                    viewModel?.locationPresenceStore.retainTeleportedGeo(
-                        keeping: Set(people.map { $0.id })
-                    )
-                }
-            }
-            .store(in: &viewModel.cancellables)
     }
 
     func loadPersistedViewState() {

bitchatTests/AppArchitectureTests.swift

@@ -125,26 +125,6 @@ struct AppArchitectureTests {
         #expect(store.teleportedGeo.isEmpty)
     }
 
-
-    @Test("LocationPresenceStore bounds and prunes teleported geohash participants")
-    @MainActor
-    func locationPresenceStoreBoundsTeleportedParticipants() {
-        let store = LocationPresenceStore(teleportedGeoCapacity: 2)
-
-        store.setCurrentGeohash("u4pruy")
-        store.markTeleported("AAAAAA")
-        store.markTeleported("BBBBBB")
-        store.markTeleported("CCCCCC")
-
-        #expect(store.teleportedGeo == Set(["bbbbbb", "cccccc"]))
-
-        store.retainTeleportedGeo(keeping: Set(["CCCCCC"]))
-        #expect(store.teleportedGeo == Set(["cccccc"]))
-
-        store.setCurrentGeohash("u4pruz")
-        #expect(store.teleportedGeo.isEmpty)
-    }
-
     @Test("PeerHandle equality and hashing use the canonical identity only")
     func peerHandleEqualityUsesCanonicalIdentity() {
         let first = PeerHandle(

bitchatTests/NostrProtocolTests.swift

@@ -241,6 +241,51 @@ struct NostrProtocolTests {
         #expect(!signed.isValidSignature())
     }
 
+    @Test func inboundNostrEventRejectsTooManyTags() throws {
+        var eventDict = Self.validInboundEventDict()
+        eventDict["tags"] = Array(
+            repeating: ["g", "u4pruyd"],
+            count: TransportConfig.nostrMaxEventTags + 1
+        )
+
+        #expect(throws: NostrError.invalidEvent) {
+            _ = try NostrEvent(from: eventDict)
+        }
+    }
+
+    @Test func inboundNostrEventRejectsTooManyTagValues() throws {
+        var eventDict = Self.validInboundEventDict()
+        eventDict["tags"] = [Array(
+            repeating: "value",
+            count: TransportConfig.nostrMaxEventTagValues + 1
+        )]
+
+        #expect(throws: NostrError.invalidEvent) {
+            _ = try NostrEvent(from: eventDict)
+        }
+    }
+
+    @Test func inboundNostrEventRejectsOversizedTagValues() throws {
+        var eventDict = Self.validInboundEventDict()
+        eventDict["tags"] = [[
+            "g",
+            String(repeating: "a", count: TransportConfig.nostrMaxEventTagValueBytes + 1)
+        ]]
+
+        #expect(throws: NostrError.invalidEvent) {
+            _ = try NostrEvent(from: eventDict)
+        }
+    }
+
+    @Test func inboundNostrEventAcceptsTagsWithinLimits() throws {
+        var eventDict = Self.validInboundEventDict()
+        eventDict["tags"] = [["g", "u4pruyd"], ["t", "teleport"]]
+
+        let event = try NostrEvent(from: eventDict)
+
+        #expect(event.tags.count == 2)
+    }
+
     @Test func geohashNotesSingleFilter_encodesExpectedTagShape() throws {
         let since = Date(timeIntervalSince1970: 1_234_567)
         let filter = NostrFilter.geohashNotes("u4pruyd", since: since, limit: 42)
@@ -254,6 +299,18 @@ struct NostrProtocolTests {
     }
 
     // MARK: - Helpers
+    private static func validInboundEventDict() -> [String: Any] {
+        [
+            "id": String(repeating: "0", count: 64),
+            "pubkey": String(repeating: "1", count: 64),
+            "created_at": 1_234_567,
+            "kind": NostrProtocol.EventKind.ephemeralEvent.rawValue,
+            "tags": [["g", "u4pruyd"]],
+            "content": "hello",
+            "sig": String(repeating: "2", count: 128)
+        ]
+    }
+
     private static func base64URLDecode(_ s: String) -> Data? {
         var str = s.replacingOccurrences(of: "-", with: "+").replacingOccurrences(of: "_", with: "/")
         let rem = str.count % 4