Skip to content
This repository was archived by the owner on Nov 10, 2025. It is now read-only.

MaxParamsDepth and MaxRequestBodySize in RpcServer#827

Merged
superboyiii merged 6 commits intomasterfrom
fix-820
Nov 8, 2023
Merged

MaxParamsDepth and MaxRequestBodySize in RpcServer#827
superboyiii merged 6 commits intomasterfrom
fix-820

Conversation

@shargon
Copy link
Member

@shargon shargon commented Sep 18, 2023

Copy link
Member

@vncoelho vncoelho left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure if this will solve the issue completely.
But these limits are needed.

@shargon
Copy link
Member Author

shargon commented Sep 19, 2023

@superboyiii could you test it?

@shargon
Copy link
Member Author

shargon commented Nov 8, 2023

Ping @superboyiii

Copy link
Member

@superboyiii superboyiii left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good for me.

@cschuchardt88
Copy link
Member

cschuchardt88 commented Nov 16, 2023

@shargon @Liaojinghui @superboyiii this doesnt fix the problem..... it has to do with a string in a parameter

WitnessCondition keep creating an object, that could eat memory if crafted right

See:

https://github.com/neo-project/neo/blob/4e9314d6b33fb8158e4f2527f889a9cbe7377a73/src/Neo/Network/P2P/Payloads/Conditions/WitnessCondition.cs#L107

Rules = ((JArray)u["rules"])?.Select(r => WitnessRule.FromJson((JObject)r)).ToArray() ?? Array.Empty<WitnessRule>(),

@cschuchardt88
Copy link
Member

cschuchardt88 commented Nov 16, 2023

here is an example of what im talking about example.txt

@shargon
Copy link
Member Author

shargon commented Nov 17, 2023

But this

here is an example of what im talking about example.txt

But this send a lot of accounts not Rules, is a different one.

@shargon shargon mentioned this pull request Nov 17, 2023
AnnaShaleva added a commit to nspcc-dev/neo-go that referenced this pull request Nov 23, 2023
A part of #3131, follow the neo-project/neo-modules#827.

Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>
AnnaShaleva added a commit to nspcc-dev/neo-go that referenced this pull request Nov 23, 2023
A part of #3131, follow the notion of neo-project/neo-modules#827,
but don't restrict request line size due to golang/go#15494.

Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>
AnnaShaleva added a commit to nspcc-dev/neo-go that referenced this pull request Nov 23, 2023
A part of #3131, follow the neo-project/neo-modules#827.

Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>
AnnaShaleva added a commit to nspcc-dev/neo-go that referenced this pull request Nov 23, 2023
A part of #3131, follow the notion of neo-project/neo-modules#827,
but don't restrict request line size due to golang/go#15494.

Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>
AnnaShaleva added a commit to nspcc-dev/neo-go that referenced this pull request Nov 23, 2023
A part of #3131, follow the neo-project/neo-modules#827.

Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>
AnnaShaleva added a commit to nspcc-dev/neo-go that referenced this pull request Nov 23, 2023
A part of #3131, follow the notion of neo-project/neo-modules#827,
but don't restrict request line size due to golang/go#15494.

Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Rpc Server: WitnessRules potential DDOS

5 participants