TrueCloudLab/neo-go
8
0
Fork 0
mirror of https://github.com/nspcc-dev/neo-go.git synced 2024-11-26 19:42:23 +00:00
Code Issues Projects Releases Packages Wiki Activity

native/std: limit input size for some methods

Browse source 
Also fix prices accordingly.
This commit is contained in:
Evgeniy Stratonikov 2021-04-30 11:44:06 +03:00
parent e4b34833da
commit 82a6c3266c
2 changed files with 55 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

58
pkg/core/native/std.go
View file

@ -22,13 +22,20 @@ type Std struct {
interop.ContractMD
}
const stdContractID = -2
const (
stdContractID = -2
// stdMaxInputLength is the maximum input length for string-related methods.
stdMaxInputLength = 1024
)
var (
// ErrInvalidBase is returned when base is invalid.
ErrInvalidBase = errors.New("invalid base")
// ErrInvalidFormat is returned when string is not a number.
ErrInvalidFormat = errors.New("invalid format")
// ErrTooBigInput is returned when input exceeds size limit.
ErrTooBigInput = errors.New("input is too big")
)
func newStd() *Std {
@ -69,32 +76,32 @@ func newStd() *Std {
desc = newDescriptor("atoi", smartcontract.IntegerType,
manifest.NewParameter("value", smartcontract.StringType),
manifest.NewParameter("base", smartcontract.IntegerType))
md = newMethodAndPrice(s.atoi, 1<<12, callflag.NoneFlag)
md = newMethodAndPrice(s.atoi, 1<<6, callflag.NoneFlag)
s.AddMethod(md, desc)
desc = newDescriptor("atoi", smartcontract.IntegerType,
manifest.NewParameter("value", smartcontract.StringType))
md = newMethodAndPrice(s.atoi10, 1<<12, callflag.NoneFlag)
md = newMethodAndPrice(s.atoi10, 1<<6, callflag.NoneFlag)
s.AddMethod(md, desc)
desc = newDescriptor("base64Encode", smartcontract.StringType,
manifest.NewParameter("data", smartcontract.ByteArrayType))
md = newMethodAndPrice(s.base64Encode, 1<<12, callflag.NoneFlag)
md = newMethodAndPrice(s.base64Encode, 1<<5, callflag.NoneFlag)
s.AddMethod(md, desc)
desc = newDescriptor("base64Decode", smartcontract.ByteArrayType,
manifest.NewParameter("s", smartcontract.StringType))
md = newMethodAndPrice(s.base64Decode, 1<<12, callflag.NoneFlag)
md = newMethodAndPrice(s.base64Decode, 1<<5, callflag.NoneFlag)
s.AddMethod(md, desc)
desc = newDescriptor("base58Encode", smartcontract.StringType,
manifest.NewParameter("data", smartcontract.ByteArrayType))
md = newMethodAndPrice(s.base58Encode, 1<<12, callflag.NoneFlag)
md = newMethodAndPrice(s.base58Encode, 1<<13, callflag.NoneFlag)
s.AddMethod(md, desc)
desc = newDescriptor("base58Decode", smartcontract.ByteArrayType,
manifest.NewParameter("s", smartcontract.StringType))
md = newMethodAndPrice(s.base58Decode, 1<<12, callflag.NoneFlag)
md = newMethodAndPrice(s.base58Decode, 1<<10, callflag.NoneFlag)
s.AddMethod(md, desc)
return s
@ -186,7 +193,7 @@ func (s *Std) itoa(_ *interop.Context, args []stackitem.Item) stackitem.Item {
}
func (s *Std) atoi10(_ *interop.Context, args []stackitem.Item) stackitem.Item {
num := toString(args[0])
num := s.toLimitedString(args[0])
res := s.atoi10Aux(num)
return stackitem.NewBigInteger(res)
}
@ -200,7 +207,7 @@ func (s *Std) atoi10Aux(num string) *big.Int {
}
func (s *Std) atoi(_ *interop.Context, args []stackitem.Item) stackitem.Item {
num := toString(args[0])
num := s.toLimitedString(args[0])
base := toBigInt(args[1])
if !base.IsInt64() {
panic(ErrInvalidBase)
@ -238,17 +245,14 @@ func reverse(b []byte) {
}
func (s *Std) base64Encode(_ *interop.Context, args []stackitem.Item) stackitem.Item {
src, err := args[0].TryBytes()
if err != nil {
panic(err)
}
src := s.toLimitedBytes(args[0])
result := base64.StdEncoding.EncodeToString(src)
return stackitem.NewByteArray([]byte(result))
}
func (s *Std) base64Decode(_ *interop.Context, args []stackitem.Item) stackitem.Item {
src := toString(args[0])
src := s.toLimitedString(args[0])
result, err := base64.StdEncoding.DecodeString(src)
if err != nil {
panic(err)
@ -258,17 +262,14 @@ func (s *Std) base64Decode(_ *interop.Context, args []stackitem.Item) stackitem.
}
func (s *Std) base58Encode(_ *interop.Context, args []stackitem.Item) stackitem.Item {
src, err := args[0].TryBytes()
if err != nil {
panic(err)
}
src := s.toLimitedBytes(args[0])
result := base58.Encode(src)
return stackitem.NewByteArray([]byte(result))
}
func (s *Std) base58Decode(_ *interop.Context, args []stackitem.Item) stackitem.Item {
src := toString(args[0])
src := s.toLimitedString(args[0])
result, err := base58.Decode(src)
if err != nil {
panic(err)
@ -296,3 +297,22 @@ func (s *Std) OnPersist(ic *interop.Context) error {
func (s *Std) PostPersist(ic *interop.Context) error {
return nil
}
func (s *Std) toLimitedBytes(item stackitem.Item) []byte {
src, err := item.TryBytes()
if err != nil {
panic(err)
}
if len(src) > stdMaxInputLength {
panic(ErrTooBigInput)
}
return src
}
func (s *Std) toLimitedString(item stackitem.Item) string {
src := toString(item)
if len(src) > stdMaxInputLength {
panic(ErrTooBigInput)
}
return src
}

16
pkg/core/native/std_test.go
View file

@ -5,6 +5,7 @@ import (
"encoding/hex"
"math"
"math/big"
"strings"
"testing"
"github.com/mr-tron/base58"
@ -102,6 +103,7 @@ func TestStdLibItoaAtoi(t *testing.T) {
{"1_000", big.NewInt(10), ErrInvalidFormat},
{"FE", big.NewInt(10), ErrInvalidFormat},
{"XD", big.NewInt(16), ErrInvalidFormat},
{strings.Repeat("0", stdMaxInputLength+1), big.NewInt(10), ErrTooBigInput},
}
for _, tc := range testCases {
@ -164,18 +166,28 @@ func TestStdLibEncodeDecode(t *testing.T) {
ic := &interop.Context{VM: vm.New()}
var actual stackitem.Item
bigInputArgs := []stackitem.Item{stackitem.Make(strings.Repeat("6", stdMaxInputLength+1))}
t.Run("Encode64", func(t *testing.T) {
require.NotPanics(t, func() {
actual = s.base64Encode(ic, []stackitem.Item{stackitem.Make(original)})
})
require.Equal(t, stackitem.Make(encoded64), actual)
})
t.Run("Encode64/error", func(t *testing.T) {
require.PanicsWithError(t, ErrTooBigInput.Error(),
func() { s.base64Encode(ic, bigInputArgs) })
})
t.Run("Encode58", func(t *testing.T) {
require.NotPanics(t, func() {
actual = s.base58Encode(ic, []stackitem.Item{stackitem.Make(original)})
})
require.Equal(t, stackitem.Make(encoded58), actual)
})
t.Run("Encode58/error", func(t *testing.T) {
require.PanicsWithError(t, ErrTooBigInput.Error(),
func() { s.base58Encode(ic, bigInputArgs) })
})
t.Run("Decode64/positive", func(t *testing.T) {
require.NotPanics(t, func() {
actual = s.base64Decode(ic, []stackitem.Item{stackitem.Make(encoded64)})
@ -189,6 +201,8 @@ func TestStdLibEncodeDecode(t *testing.T) {
require.Panics(t, func() {
_ = s.base64Decode(ic, []stackitem.Item{stackitem.NewInterop(nil)})
})
require.PanicsWithError(t, ErrTooBigInput.Error(),
func() { s.base64Decode(ic, bigInputArgs) })
})
t.Run("Decode58/positive", func(t *testing.T) {
require.NotPanics(t, func() {
@ -203,6 +217,8 @@ func TestStdLibEncodeDecode(t *testing.T) {
require.Panics(t, func() {
_ = s.base58Decode(ic, []stackitem.Item{stackitem.NewInterop(nil)})
})
require.PanicsWithError(t, ErrTooBigInput.Error(),
func() { s.base58Decode(ic, bigInputArgs) })
})
}