n0-computer / iroh-car Goto Github PK

Hi !
I need a library to write CAR files in rust, and this crate looks really promising.

The issue is that I need to run this code client-side (and in the future on webassembly), so an async implementation is a dealbreaker for me.

Would that be possible to export a non-async writer ?

I'm considering using this library to accept CAR files submitted by end users, who are not necessarily trusted parties. Upon reviewing the code, I noticed that there doesn't appear to be any re-hashing of the data before it's processed.

Could this lack of re-hashing pose a security risk, specifically allowing users to submit a malformed CAR file where the data could be stored under an incorrect CID?