aarifullin/neoneo-go
1
0
Fork 0
forked from TrueCloudLab/neoneo-go
Code Pull requests Activity

rpc/server: limit the maximum number of elements for get*transfers

Browse source
This commit is contained in:
Roman Khimov 2020-09-14 17:48:17 +03:00
parent 970de84130
commit 6b7ca0ce3f
2 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
pkg/rpc/server/server.go
View file

@ -77,6 +77,9 @@ const (
// treated like subscriber, so technically it's a limit on websocket
// connections.
maxSubscribers = 64
// Maximum number of elements for get*transfers requests.
maxTransfersLimit = 1000
)
var rpcHandlers = map[string]func(*Server, request.Params) (interface{}, *response.Error){
@ -548,6 +551,8 @@ func (s *Server) getNEP5Balances(ps request.Params) (interface{}, *response.Erro
func getTimestampsAndLimit(ps request.Params, index int) (uint64, uint64, int, int, error) {
var start, end uint64
var limit, page int
limit = maxTransfersLimit
pStart, pEnd, pLimit, pPage := ps.Value(index), ps.Value(index+1), ps.Value(index+2), ps.Value(index+3)
if pPage != nil {
p, err := pPage.GetInt()
@ -567,6 +572,9 @@ func getTimestampsAndLimit(ps request.Params, index int) (uint64, uint64, int, i
if l <= 0 {
return 0, 0, 0, 0, errors.New("can't use negative or zero limit")
}
if l > maxTransfersLimit {
return 0, 0, 0, 0, errors.New("too big limit requested")
}
limit = l
}
if pEnd != nil {

5
pkg/rpc/server/server_test.go
View file

@ -175,6 +175,11 @@ var rpcTestCases = map[string][]rpcTestCase{
params: `["` + testchain.PrivateKeyByID(0).Address() + `", "1", "2", "bleh"]`,
fail: true,
},
{
name: "invalid limit 3",
params: `["` + testchain.PrivateKeyByID(0).Address() + `", "1", "2", "100500"]`,
fail: true,
},
{
name: "invalid page",
params: `["` + testchain.PrivateKeyByID(0).Address() + `", "1", "2", "3", "-1"]`,