bugfix: Strict type checking for RPC boolean parameters

Author: MarcoFalke

doc/release-notes-26213.md

@@ -0,0 +1,8 @@
+Low-level changes
+=================
+
+- Previously `setban`, `addpeeraddress`, `walletcreatefundedpsbt`, methods
+  allowed non-boolean and non-null values to be passed as boolean parameters.
+  Any string, number, array, or object value that was passed would be treated
+  as false. After this change, passing any value except `true`, `false`, or
+  `null` now triggers a JSON value is not of expected type error. (#26213)

src/rpc/net.cpp

@@ -731,9 +731,7 @@ static RPCHelpMan setban()
         if (!request.params[2].isNull())
             banTime = request.params[2].getInt<int64_t>();
 
-        bool absolute = false;
-        if (request.params[3].isTrue())
-            absolute = true;
+        const bool absolute{request.params[3].isNull() ? false : request.params[3].get_bool()};
 
         if (isSubnet) {
             node.banman->Ban(subNet, banTime, absolute);
@@ -942,7 +940,7 @@ static RPCHelpMan addpeeraddress()
 
     const std::string& addr_string{request.params[0].get_str()};
     const auto port{request.params[1].getInt<uint16_t>()};
-    const bool tried{request.params[2].isTrue()};
+    const bool tried{request.params[2].isNull() ? false : request.params[2].get_bool()};
 
     UniValue obj(UniValue::VOBJ);
     CNetAddr net_addr;

src/wallet/rpc/spend.cpp

@@ -1651,11 +1651,8 @@ RPCHelpMan walletcreatefundedpsbt()
 
     CAmount fee;
     int change_position;
-    bool rbf{wallet.m_signal_rbf};
     const UniValue &replaceable_arg = options["replaceable"];
-    if (!replaceable_arg.isNull()) {
-        rbf = replaceable_arg.isTrue();
-    }
+    const bool rbf{replaceable_arg.isNull() ? wallet.m_signal_rbf : replaceable_arg.get_bool()};
     CMutableTransaction rawTx = ConstructTransaction(request.params[0], request.params[1], request.params[2], rbf);
     CCoinControl coin_control;
     // Automatically select coins, unless at least one is manually selected. Can

test/functional/rpc_net.py

@@ -307,6 +307,9 @@ def test_addpeeraddress(self):
         assert_equal(node.addpeeraddress(address="", port=8333), {"success": False})
         assert_equal(node.getnodeaddresses(count=0), [])
 
+        self.log.debug("Test that non-bool tried fails")
+        assert_raises_rpc_error(-3, "JSON value of type string is not of expected type bool", self.nodes[0].addpeeraddress, address="1.2.3.4", tried="True", port=1234)
+
         self.log.debug("Test that adding an address with invalid port fails")
         assert_raises_rpc_error(-1, "JSON integer out of range", self.nodes[0].addpeeraddress, address="1.2.3.4", port=-1)
         assert_raises_rpc_error(-1, "JSON integer out of range", self.nodes[0].addpeeraddress,address="1.2.3.4", port=65536)