···286286 };
287287288288 return {
289289- // TODO: Do we need this? Too big of a perf penalty?
290289 cid: await CID.create(0x71, encode(newInventory)),
291290 data: collection,
292291 inventory: newInventory,
+18-3
src/facets/l/index.js
···11import foundation from "~/common/facets/foundation.js";
22-import { createLoader } from "~/common/loader.js";
22+import * as CID from "~/common/cid.js";
33+import { createLoader, renderError } from "~/common/loader.js";
3445createLoader({
56 $type: "sh.diffuse.output.facet",
···89 const output = foundation.orchestrator.output();
910 return output.facets;
1011 },
1111- render(facet) {
1212- // TODO: Validate if CID matches HTML
1212+ async render(facet) {
1313 const container = /** @type {HTMLDivElement} */ (
1414 document.querySelector("#container")
1515 );
1616+1717+ if (facet.cid) {
1818+ const valid = await CID.verify(
1919+ new TextEncoder().encode(facet.html ?? ""),
2020+ facet.cid,
2121+ );
2222+2323+ if (!valid) {
2424+ renderError(
2525+ container,
2626+ "CID mismatch: HTML content does not match the CID",
2727+ );
2828+ return;
2929+ }
3030+ }
16311732 const range = document.createRange();
1833 range.selectNode(container);
+18-3
src/themes/l/index.js
···11import foundation from "~/common/facets/foundation.js";
22-import { createLoader } from "~/common/loader.js";
22+import * as CID from "~/common/cid.js";
33+import { createLoader, renderError } from "~/common/loader.js";
3445createLoader({
56 $type: "sh.diffuse.output.theme",
···89 const output = foundation.orchestrator.output();
910 return output.themes;
1011 },
1111- render(theme) {
1212- // TODO: Validate if CID matches HTML
1212+ async render(theme) {
1313+ if (theme.cid) {
1414+ const valid = await CID.verify(
1515+ new TextEncoder().encode(theme.html ?? ""),
1616+ theme.cid,
1717+ );
1818+1919+ if (!valid) {
2020+ renderError(
2121+ document.body,
2222+ "CID mismatch: HTML content does not match the CID",
2323+ );
2424+ return;
2525+ }
2626+ }
2727+1328 const iframe = document.createElement("iframe");
1429 iframe.srcdoc = theme.html ?? "";
1530