Doichain/dapp
Security: RPC-API-CALL sendrawtransaction needs validation
Offen
#116 geöffnet am 29.10.2019
A prioritybountyenhancementgood first issuehelp wantedsecurity
Repository-Metriken
- Stars
- (6 Sterne)
- PR-Merge-Metriken
- (PR-Metriken ausstehend)
Beschreibung
When calling RPC-API sendrawtransaction please validate and limit the data given over the body parameters to prevent dDoS attacks.
This RPC-Call is located in: meteor-api package: https://github.com/Doichain/meteor-api inside file: server/api/rest/imports/send.js around line 639: Api.addRoute(DOICHAIN_BROADCAST_TX, { parameter*: !params.templateDataEncrypted || ... etc. is not yet limited. The size of this parameter (size of data) should be able to be limited in settings
The question here is if restivus (the REST API package of meteor) already has such capabilities or we must do it AFTER we received 1 GB of data. I think this could be already too late here.