[Bug] Admin IPC accepts malformed request bytes that admin HTTP rejects

Ouverte
  • Quelque chose ne va pas ?
#7,044 4 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
70/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
java
Domaine
backend-api-design

Piste de recherche

Read IpcRequestHandler.readRequest, IpcService.handleClient, and IpcRequestHandler.handleCommand, then compare their input handling with AdminRpcServlet and AdminJsonRpcRequestHandler.handleRequest. Reproduce the malformed-byte request using the commands in the issue. Done means IPC and admin HTTP reject the same invalid UTF-8 or surrounding control characters with -32700, without calling the method.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Bug Description

Admin IPC changes a request's bytes before it parses them. Invalid UTF-8 inside the request is replaced with U+FFFD, and control characters before or after the JSON object are removed, so admin_example runs with input the client didn't send. Admin HTTP passes the same bytes to the parser unchanged and returns -32700.

Environment

Network
Mainnet configuration, local node started with --p2p-disable true

Software Versions

OS: Fedora 44, Linux 7.2.9-200.fc44.x86_64
JVM: Temurin 1.8.0_504 amd64
Git Commit: 2d99513742d92af4f7b5f68791d809582a9e4549
Version: 4.8.2.3
Code: 18830

Configuration
FullNode built from release_v4.8.3 with the shipped config.conf plus node.admin.ipc.enable = true and node.admin.http.enable = true.

Expected Behavior

The same request bytes get the same reply over IPC and admin HTTP. A request that isn't valid UTF-8 JSON gets -32700 and the method isn't called.

Actual Behavior

Over IPC, a request with an 0xff byte inside a string runs admin_example and returns a result with U+FFFD where the 0xff byte was. Over admin HTTP the same bytes return -32700. A truncated UTF-8 sequence behaves the same way. A NUL after the object or a vertical tab before it also succeeds over IPC and returns -32700 over HTTP. The node logs nothing for any of these IPC requests.

Frequency

  • Always (100%)
  • Frequently (>50%)
  • Sometimes (10-50%)
  • Rarely (<10%)

Steps to Reproduce

  1. Start a FullNode with node.admin.ipc.enable = true and node.admin.http.enable = true.
  2. Send a request with an 0xff byte inside a string over IPC, then the same bytes to admin HTTP.
printf '{"jsonrpc":"2.0","method":"admin_example","params":["a\xffb","b"],"id":7}\n' | socat - UNIX-CONNECT:output-directory/ipc/<pid>.sock
printf '{"jsonrpc":"2.0","method":"admin_example","params":["a\xffb","b"],"id":7}' | curl -s -H 'Content-Type: application/json' --data-binary @- http://127.0.0.1:8575/admin

Logs and Error Messages

IPC   {"jsonrpc":"2.0","id":7,"result":"a�b:b"}
HTTP  {"jsonrpc":"2.0","id":null,"error":{"code":-32700,"message":"JSON parse error"}}

The � in the IPC reply is U+FFFD, sent as the bytes EF BF BD.

Additional Context (Optional)

Possible Solution
IpcRequestHandler.readRequest decodes the line into a String, IpcService.handleClient trims it, and IpcRequestHandler.handleCommand encodes it again before calling AdminJsonRpcRequestHandler.handleRequest. AdminRpcServlet calls the same method with the raw body. Passing the IPC line bytes straight through, without the trim, gives both transports the same input.

Langage dominant
Java
Étoiles
4.2k
Forks
1.8k
Merge moyen
2 j 15 h
PR mergées (30 j)
41

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de tronprotocol/java-tron

Toutes les issues de tronprotocol/java-tron

Issues similaires

Plus d'issues Java

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.