Fix tact injection

src/check-prerequisites.ts

@@ -1,7 +1,7 @@
 import fs from "fs";
 import path from "path";
 import { binaryPath } from "./binaries";
-import { getFuncVersions } from "./fetch-func-versions";
+import { getSupportedVersions } from "./fetch-compiler-versions";
 export async function checkPrerequisites() {
   const missingEnvVars = [
     "VERIFIER_ID",
@@ -19,7 +19,7 @@ export async function checkPrerequisites() {
 
   if (missingEnvVars) throw new Error("Missing env vars: " + missingEnvVars);
 
-  const funcVersions = await getFuncVersions();
+  const { funcVersions } = await getSupportedVersions();
 
   const missingFiles = funcVersions!
     .map((versionDir: string) => [

src/fetch-compiler-versions.ts

@@ -0,0 +1,20 @@
+import axios from "axios";
+let versions: {
+  funcVersions: string[];
+  tactVersions: string[];
+} | null = null;
+
+export async function getSupportedVersions() {
+  if (!versions) {
+    const { data } = await axios.get(
+      "https://raw.githubusercontent.com/ton-community/contract-verifier-config/main/config.json",
+      { responseType: "json" },
+    );
+    versions = {
+      funcVersions: data.funcVersions,
+      tactVersions: data.tactVersions,
+    };
+  }
+
+  return versions;
+}

src/server.ts

@@ -21,8 +21,7 @@ import { TactSourceVerifier, FileSystem } from "./source-verifier/tact-source-ve
 import { TonReaderClientImpl } from "./ton-reader-client";
 import { getLatestVerified } from "./latest-known-contracts";
 import { DeployController } from "./deploy-controller";
-import axios from "axios";
-import { getFuncVersions } from "./fetch-func-versions";
+import { getSupportedVersions } from "./fetch-compiler-versions";
 
 const app = express();
 app.use(idMiddleware());
@@ -207,7 +206,7 @@ app.get("/hc", (req, res) => {
     },
   );
 
-  await getFuncVersions();
+  await getSupportedVersions();
 
   if (process.env.NODE_ENV === "production") checkPrerequisites();
 

src/source-verifier/tact-source-verifier.ts

@@ -4,6 +4,7 @@ import { PackageFileFormat } from "tact-1.1.5";
 import type { verify as VerifyFunction } from "tact-1.1.5";
 import path from "path";
 import { timeoutPromise } from "../utils";
+import { getSupportedVersions } from "../fetch-compiler-versions";
 
 export type FileSystem = {
   readFile: (path: string) => Promise<Buffer>;
@@ -34,6 +35,12 @@ export class TactSourceVerifier implements SourceVerifier {
 
       const output: string[] = [];
 
+      const { tactVersions } = await getSupportedVersions();
+
+      if (!tactVersions.includes(pkgParsed.compiler.version)) {
+        throw new Error("Unsupported tact version: " + pkgParsed.compiler.version);
+      }
+
       const verify: typeof VerifyFunction = await import(`tact-${pkgParsed.compiler.version}`)
         .then((m) => m.verify)
         .catch((e) => {
@@ -67,7 +74,7 @@ export class TactSourceVerifier implements SourceVerifier {
 
       const sources = await Promise.all(
         Object.entries(v.files)
-          .filter(([filename]) => !filename.match(/\.(fif|boc|ts|md|pkg)/))
+          .filter(([filename]) => filename.match(/\.(abi|tact|pkg)$/) && !filename.match(/\.\./))
           .map(async ([filename, contentB64]) => {
             const writePath = path.join(payload.tmpDir, filename);
             let content = Buffer.from(contentB64, "base64").toString("utf-8");