fix: fix the data validation of StrKey class.

CHANGELOG.md

@@ -7,6 +7,7 @@
 - feat: add support for Soroban PRC's `getLedgers` API interface.
 - refactor!: if seed is not present, calling `Keypair.sign` throws IllegalStateException.
 - refactor!: `StrKeyException` has been removed, use `IllegalArgumentException` instead. When you call functions like `Keypair.fromAccountId`, this exception will also be thrown if invalid data is passed in.
+- fix: fix the data validation of `StrKey` class.
 
 ## 1.0.0-beta1
 

src/main/java/org/stellar/sdk/StrKey.java

@@ -387,12 +387,38 @@ static byte[] decodeCheck(VersionByte versionByte, char[] encoded) {
 
     byte[] decoded = base32decode(bytes);
     byte decodedVersionByte = decoded[0];
+    VersionByte decodedVersionByteEnum =
+        VersionByte.findByValue(decodedVersionByte)
+            .orElseThrow(() -> new IllegalArgumentException("Version byte is invalid"));
     byte[] payload = Arrays.copyOfRange(decoded, 0, decoded.length - 2);
     byte[] data = Arrays.copyOfRange(payload, 1, payload.length);
     byte[] checksum = Arrays.copyOfRange(decoded, decoded.length - 2, decoded.length);
 
-    if (decodedVersionByte != versionByte.getValue()) {
-      throw new IllegalArgumentException("Version byte is invalid");
+    // Check the data length
+    switch (decodedVersionByteEnum) {
+      case SIGNED_PAYLOAD:
+        if (data.length < 32 + 4 + 4 || data.length > 32 + 4 + 64) {
+          throw new IllegalArgumentException(
+              "Invalid data length, the length should be between 40 and 100 bytes, got "
+                  + data.length);
+        }
+        break;
+      case MUXED:
+        if (data.length != 32 + 8) {
+          throw new IllegalArgumentException(
+              "Invalid data length, expected 40 bytes, got " + data.length);
+        }
+        break;
+      default:
+        if (data.length != 32) {
+          throw new IllegalArgumentException(
+              "Invalid data length, expected 32 bytes, got " + data.length);
+        }
+        break;
+    }
+
+    if (decodedVersionByteEnum != versionByte) {
+      throw new IllegalArgumentException("Version byte mismatch");
     }
 
     byte[] expectedChecksum = StrKey.calculateChecksum(payload);

src/test/java/org/stellar/sdk/KeyPairTest.java

@@ -177,6 +177,8 @@ public void testFromAccountIdThrows() {
             "",
             "hello",
             "GAXDYNIBA5E4DXR5TJN522RRYESFQ5UNUXHIPTFGVLLD5O5K552DFBAD",
+            "GA7QYNF7SOWQ3GLR2BGMZEHXAVIRZA4KVWLTJJFC7MGXUA74P7UJUACUSI",
+            "GA7QYNF7SOWQ3GLR2BGMZEHXAVIRZA4KVWLTJJFC7MGXUA74P7UJVSGZA",
             "GAXDYNIBA5E4DXR5TJN522RRYESFQ5UNUXHIPTFGVLLD5O5K552DF5Z",
             "masterpassphrasemasterpassphrase",
             "gsYRSEQhTffqA9opPepAENCr2WG6z5iBHHubxxbRzWaHf8FBWcu");

src/test/java/org/stellar/sdk/MuxedAccountTest.java

@@ -5,6 +5,8 @@
 import static org.junit.Assert.assertThrows;
 
 import java.math.BigInteger;
+import java.util.Arrays;
+import java.util.List;
 import org.junit.Test;
 import org.stellar.sdk.xdr.CryptoKeyType;
 import org.stellar.sdk.xdr.Uint256;
@@ -72,8 +74,20 @@ public void testFromAccountEd25519Account() {
 
   @Test
   public void testFromAccountInvalidAccountRaise() {
-    String invalidAccount =
-        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
-    assertThrows(IllegalArgumentException.class, () -> new MuxedAccount(invalidAccount));
+    List<String> invalidAccounts =
+        Arrays.asList(
+            "GAAAAAAAACGC6",
+            "MA7QYNF7SOWQ3GLR2BGMZEHXAVIRZA4KVWLTJJFC7MGXUA74P7UJUAAAAAAAAAAAACJUR",
+            "GA7QYNF7SOWQ3GLR2BGMZEHXAVIRZA4KVWLTJJFC7MGXUA74P7UJVSGZA",
+            "GA7QYNF7SOWQ3GLR2BGMZEHXAVIRZA4KVWLTJJFC7MGXUA74P7UJUACUSI",
+            "G47QYNF7SOWQ3GLR2BGMZEHXAVIRZA4KVWLTJJFC7MGXUA74P7UJVP2I",
+            "MA7QYNF7SOWQ3GLR2BGMZEHXAVIRZA4KVWLTJJFC7MGXUA74P7UJVAAAAAAAAAAAAAJLKA",
+            "MA7QYNF7SOWQ3GLR2BGMZEHXAVIRZA4KVWLTJJFC7MGXUA74P7UJVAAAAAAAAAAAAAAV75I",
+            "M47QYNF7SOWQ3GLR2BGMZEHXAVIRZA4KVWLTJJFC7MGXUA74P7UJUAAAAAAAAAAAACJUQ",
+            "MA7QYNF7SOWQ3GLR2BGMZEHXAVIRZA4KVWLTJJFC7MGXUA74P7UJUAAAAAAAAAAAACJUK===",
+            "MA7QYNF7SOWQ3GLR2BGMZEHXAVIRZA4KVWLTJJFC7MGXUA74P7UJUAAAAAAAAAAAACJUO");
+    for (String invalidAccount : invalidAccounts) {
+      assertThrows(IllegalArgumentException.class, () -> new MuxedAccount(invalidAccount));
+    }
   }
 }