fix(dagcbor): don't accept trailing bytes

codec/dagcbor/unmarshal.go

@@ -18,6 +18,7 @@ import (
 var (
 	ErrInvalidMultibase         = errors.New("invalid multibase on IPLD link")
 	ErrAllocationBudgetExceeded = errors.New("message structure demanded too many resources to process")
+	ErrTrailingBytes            = errors.New("unexpected content after end of cbor object")
 )
 
 const (
@@ -49,9 +50,24 @@ func (cfg DecodeOptions) Decode(na datamodel.NodeAssembler, r io.Reader) error {
 		return na2.DecodeDagCbor(r)
 	}
 	// Okay, generic builder path.
-	return Unmarshal(na, cbor.NewDecoder(cbor.DecodeOptions{
+	err := Unmarshal(na, cbor.NewDecoder(cbor.DecodeOptions{
 		CoerceUndefToNull: true,
 	}, r), cfg)
+
+	if err != nil {
+		return err
+	}
+
+	var buf [1]byte
+	_, err = io.ReadFull(r, buf[:])
+	switch err {
+	case io.EOF:
+		return nil
+	case nil:
+		return ErrTrailingBytes
+	default:
+		return err
+	}
 }
 
 // Future work: we would like to remove the Unmarshal function,

codec/dagcbor/unmarshal_test.go

@@ -49,4 +49,10 @@ func TestFunBlocks(t *testing.T) {
 		qt.Assert(t, err, qt.IsNil)
 		qt.Assert(t, nb.Build().Kind(), qt.Equals, datamodel.Kind_Null)
 	})
+	t.Run("extra bytes", func(t *testing.T) {
+		buf := strings.NewReader("\xa0\x00")
+		nb := basicnode.Prototype.Any.NewBuilder()
+		err := Decode(nb, buf)
+		qt.Assert(t, err, qt.Equals, ErrTrailingBytes)
+	})
 }

node/bindnode/fuzz_test.go

@@ -238,9 +238,7 @@ func FuzzBindnodeViaDagCBOR(f *testing.F) {
 			t.Logf("decode successful: %#v", reflect.ValueOf(bindnode.Unwrap(node)).Elem().Interface())
 			reenc := marshalDagCBOR(t, node)
 			if !bytes.Equal(reenc, nodeDagCBOR) {
-				// TODO: reenable this once the dagcbor codec rejects non-canonical
-				// inputs like "00" and "a000", "0" and "a0" respectively.
-				// t.Errorf("node reencoded as %q rather than %q", reenc, nodeDagCBOR)
+				t.Errorf("node reencoded as %q rather than %q", reenc, nodeDagCBOR)
 			}
 			t.Logf("re-encode successful: %q", reenc)
 		}