feat(utxo-lib): improve validation for path chain and index

Require chain to be a valid ChainCode and ensure index is a non-negative
integer. Improve error messages and test cases.

TICKET: BTC-1966

Co-authored-by: llm-git <[email protected]>

Author: OttoAllmendinger

modules/utxo-lib/src/bitgo/parseInput.ts

@@ -4,6 +4,7 @@ import { TxInput, script as bscript } from 'bitcoinjs-lib';
 
 import { isTriple } from './types';
 import { isScriptType2Of3 } from './outputScripts';
+import { ChainCode, isChainCode } from './wallet/chains';
 
 export function isPlaceholderSignature(v: number | Buffer): boolean {
   if (Buffer.isBuffer(v)) {
@@ -699,18 +700,18 @@ export function parsePubScript(
   return result;
 }
 
-export function getChainAndIndexFromPath(path: string): { chain: number; index: number } {
+export function getChainAndIndexFromPath(path: string): { chain: ChainCode; index: number } {
   const parts = path.split('/');
   if (parts.length <= 2) {
     throw new Error(`invalid path "${path}"`);
   }
   const chain = Number(parts[parts.length - 2]);
   const index = Number(parts[parts.length - 1]);
-  if (isNaN(chain) || isNaN(index)) {
-    throw new Error(`Could not parse chain and index into numbers from path ${path}`);
+  if (!isChainCode(chain)) {
+    throw new Error(`invalid chain "${chain}"`);
   }
-  if (chain < 0 || index < 0) {
-    throw new Error(`chain and index must be non-negative`);
+  if (!Number.isInteger(index) || index < 0) {
+    throw new Error(`invalid index "${index}"`);
   }
 
   return { chain, index };

modules/utxo-lib/test/bitgo/wallet/chains.ts

@@ -67,20 +67,18 @@ describe('getChainAndIndexFromPath', function () {
   });
 
   it('should throw if the path is not a number', function () {
-    assert.throws(() => getChainAndIndexFromPath('m/0/ssss'), /Could not parse chain and index into numbers from path/);
-    assert.throws(
-      () => getChainAndIndexFromPath('//d/dd/d/d/dd/dd'),
-      /Could not parse chain and index into numbers from path/
-    );
-  });
-
-  it('should throw if chain or index is negative', function () {
-    assert.throws(() => getChainAndIndexFromPath('m/-1/0'), /chain and index must be non-negative/);
-    assert.throws(() => getChainAndIndexFromPath('m/0/-1'), /chain and index must be non-negative/);
+    const invalidChain = [-1, 2, 'lol'];
+    const invalidIndex = [-1, 'lol'];
+    for (const chain of invalidChain) {
+      assert.throws(() => getChainAndIndexFromPath(`m/${chain}/0`), /invalid chain/);
+    }
+    for (const index of invalidIndex) {
+      assert.throws(() => getChainAndIndexFromPath(`m/0/${index}`), /invalid index/);
+    }
   });
 
   it('should set the chain and index correctly', function () {
     assert.deepStrictEqual(getChainAndIndexFromPath('m/1/2'), { chain: 1, index: 2 });
-    assert.deepStrictEqual(getChainAndIndexFromPath('m/4/3/2'), { chain: 3, index: 2 });
+    assert.deepStrictEqual(getChainAndIndexFromPath('m/1/2/3/4/5/10/20'), { chain: 10, index: 20 });
   });
 });