Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security: RPC-API-CALL sendrawtransaction needs validation #116

Open
silkroadnomad opened this issue Oct 29, 2019 · 1 comment
Open

Security: RPC-API-CALL sendrawtransaction needs validation #116

silkroadnomad opened this issue Oct 29, 2019 · 1 comment
Labels
A priority bounty make money enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed security

Comments

@silkroadnomad
Copy link
Collaborator

silkroadnomad commented Oct 29, 2019

When calling RPC-API sendrawtransaction please validate and limit the data given over the body parameters to prevent dDoS attacks.

This RPC-Call is located in:
meteor-api package: https://github.com/Doichain/meteor-api
inside file: server/api/rest/imports/send.js
around line 639: Api.addRoute(DOICHAIN_BROADCAST_TX, {
parameter*: !params.templateDataEncrypted || ... etc. is not yet limited.
The size of this parameter (size of data) should be able to be limited in settings

The question here is if restivus (the REST API package of meteor) already has such capabilities or we must do it AFTER we received 1 GB of data. I think this could be already too late here.

@silkroadnomad silkroadnomad added enhancement New feature or request help wanted Extra attention is needed good first issue Good for newcomers security bounty make money labels Oct 29, 2019
@jay-dee7
Copy link
Contributor

hey @inspiraluna, i just blocked this bounty, can i get more context regarding to this task? Little more detail for the workflow would make things easier for me to work on this

@silkroadnomad silkroadnomad changed the title Security: REST-API-CALL sendrawtransaction needs validation Security: RPC-API-CALL sendrawtransaction needs validation Apr 2, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A priority bounty make money enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed security
Projects
None yet
Development

No branches or pull requests

2 participants