Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

MaxParamsDepth and MaxRequestBodySize in RpcServer #827

Merged
merged 6 commits into from
Nov 8, 2023
Merged

MaxParamsDepth and MaxRequestBodySize in RpcServer #827

merged 6 commits into from
Nov 8, 2023

Conversation

shargon
Copy link
Member

@shargon shargon commented Sep 18, 2023

vncoelho
vncoelho reviewed Sep 18, 2023
View reviewed changes
Copy link
Member

@vncoelho vncoelho left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure if this will solve the issue completely.
But these limits are needed.

@roman-khimov roman-khimov mentioned this pull request Sep 18, 2023
Closed
@shargon shargon requested a review from superboyiii September 19, 2023 11:57
@shargon
Copy link
Member Author

shargon commented Sep 19, 2023

@superboyiii could you test it?

@shargon
Copy link
Member Author

shargon commented Nov 8, 2023

Ping @superboyiii

superboyiii
superboyiii approved these changes Nov 8, 2023
View reviewed changes
Copy link
Member

@superboyiii superboyiii left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good for me.

@superboyiii superboyiii merged commit 3f19028 into master Nov 8, 2023
@superboyiii superboyiii deleted the fix-820 branch November 8, 2023 08:46
@AnnaShaleva AnnaShaleva mentioned this pull request Nov 9, 2023
Closed
@cschuchardt88
Copy link
Member

cschuchardt88 commented Nov 16, 2023 •
edited
Loading

@shargon @Liaojinghui @superboyiii this doesnt fix the problem..... it has to do with a string in a parameter

WitnessCondition keep creating an object, that could eat memory if crafted right

See:

https://github.com/neo-project/neo/blob/4e9314d6b33fb8158e4f2527f889a9cbe7377a73/src/Neo/Network/P2P/Payloads/Conditions/WitnessCondition.cs#L107

neo-modules/src/RpcServer/RpcServer.SmartContract.cs

Line 175 in 2d7fb27

Rules = ((JArray)u["rules"])?.Select(r => WitnessRule.FromJson((JObject)r)).ToArray() ?? Array.Empty<WitnessRule>(),

@cschuchardt88
Copy link
Member

cschuchardt88 commented Nov 16, 2023 •
edited
Loading

here is an example of what im talking about example.txt

@shargon
Copy link
Member Author

shargon commented Nov 17, 2023

But this

here is an example of what im talking about example.txt

But this send a lot of accounts not Rules, is a different one.

@shargon shargon mentioned this pull request Nov 17, 2023
Merged
AnnaShaleva added a commit to nspcc-dev/neo-go that referenced this pull request Nov 23, 2023
@AnnaShaleva
config: add MaxRequestBodySize RPC configuration
c3466f5 
A part of #3131, follow the neo-project/neo-modules#827.

Signed-off-by: Anna Shaleva <[email protected]>
AnnaShaleva added a commit to nspcc-dev/neo-go that referenced this pull request Nov 23, 2023
@AnnaShaleva
confi: add MaxRequestHeaderBytes RPC configuration option
e6e1558 
A part of #3131, follow the notion of neo-project/neo-modules#827,
but don't restrict request line size due to golang/go#15494.

Signed-off-by: Anna Shaleva <[email protected]>
AnnaShaleva added a commit to nspcc-dev/neo-go that referenced this pull request Nov 23, 2023
@AnnaShaleva
config: add MaxRequestBodySize RPC configuration option
a671952 
A part of #3131, follow the neo-project/neo-modules#827.

Signed-off-by: Anna Shaleva <[email protected]>
AnnaShaleva added a commit to nspcc-dev/neo-go that referenced this pull request Nov 23, 2023
@AnnaShaleva
confi: add MaxRequestHeaderBytes RPC configuration option
22c032b 
A part of #3131, follow the notion of neo-project/neo-modules#827,
but don't restrict request line size due to golang/go#15494.

Signed-off-by: Anna Shaleva <[email protected]>
@AnnaShaleva AnnaShaleva mentioned this pull request Nov 23, 2023
Open
AnnaShaleva added a commit to nspcc-dev/neo-go that referenced this pull request Nov 23, 2023
@AnnaShaleva
config: add MaxRequestBodySize RPC configuration option
802d8d2 
A part of #3131, follow the neo-project/neo-modules#827.

Signed-off-by: Anna Shaleva <[email protected]>
AnnaShaleva added a commit to nspcc-dev/neo-go that referenced this pull request Nov 23, 2023
@AnnaShaleva
confi: add MaxRequestHeaderBytes RPC configuration option
d511f6e 
A part of #3131, follow the notion of neo-project/neo-modules#827,
but don't restrict request line size due to golang/go#15494.

Signed-off-by: Anna Shaleva <[email protected]>
@mialbu mialbu mentioned this pull request Dec 1, 2023
Closed
@mialbu mialbu mentioned this pull request Dec 1, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cschuchardt88 cschuchardt88 cschuchardt88 approved these changes

@vncoelho vncoelho vncoelho left review comments

@Jim8y Jim8y Jim8y approved these changes

@superboyiii superboyiii superboyiii approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Rpc Server: WitnessRules potential DDOS
5 participants
@shargon @cschuchardt88 @Jim8y @vncoelho @superboyiii