Skip to content

Commit 6e71efa

Browse files
jonasschnellijonasschnelli
committed
[REST] remove json input for getutxos, limit to query max. 15 outpoints
Remove possibility to send json encoded parameters to `/rest/getutxos/` to avoid possible DoS scenarios. The JSON output option is untouched.
1 parent 64b8027 commit 6e71efa

File tree

3 files changed

+108
-92
lines changed

3 files changed

+108
-92
lines changed

‎doc/REST-interface.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,15 +47,15 @@ Only supports JSON as output format.
4747
* chainwork : (string) total amount of work in active chain, in hexadecimal
4848

4949
####Query UTXO set
50-
`GET /rest/getutxos.<bin|hex|json>`
50+
`GET /rest/getutxos/<checkmempool>/<txid>-<n>/<txid>-<n>/.../<txid>-<n>.<bin|hex|json>`
5151

5252
The getutxo command allows querying of the UTXO set given a set of outpoints.
5353
See BIP64 for input and output serialisation:
5454
https://github.com/bitcoin/bips/blob/master/bip-0064.mediawiki
5555

5656
Example:
5757
```
58-
$ curl --data '{"checkmempool":true,"outpoints":[{"txid":"b2cdfd7b89def827ff8af7cd9bff7627ff72e5e8b0f71210f92ea7a4000c5d75","n":0}]}' localhost:18332/rest/getutxos.json 2>/dev/null | json_pp
58+
$ curl localhost:18332/rest/getutxos/checkmempool/b2cdfd7b89def827ff8af7cd9bff7627ff72e5e8b0f71210f92ea7a4000c5d75-0.json 2>/dev/null | json_pp
5959
{
6060
"chaintipHash" : "00000000fb01a7f3745a717f8caebee056c484e6e0bfe4a9591c235bb70506fb",
6161
"chainHeight" : 325347,

‎qa/rpc-tests/rest.py

Lines changed: 56 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -54,78 +54,78 @@ def setup_network(self, split=False):
5454
connect_nodes_bi(self.nodes,0,2)
5555
self.is_network_split=False
5656
self.sync_all()
57-
57+
5858
def run_test(self):
5959
url = urlparse.urlparse(self.nodes[0].url)
6060
print "Mining blocks..."
61-
61+
6262
self.nodes[0].generate(1)
6363
self.sync_all()
6464
self.nodes[2].generate(100)
6565
self.sync_all()
66-
66+
6767
assert_equal(self.nodes[0].getbalance(), 50)
68-
68+
6969
txid = self.nodes[0].sendtoaddress(self.nodes[1].getnewaddress(), 0.1)
7070
self.sync_all()
7171
self.nodes[2].generate(1)
7272
self.sync_all()
7373
bb_hash = self.nodes[0].getbestblockhash()
74-
74+
7575
assert_equal(self.nodes[1].getbalance(), Decimal("0.1")) #balance now should be 0.1 on node 1
76-
76+
7777
# load the latest 0.1 tx over the REST API
7878
json_string = http_get_call(url.hostname, url.port, '/rest/tx/'+txid+self.FORMAT_SEPARATOR+"json")
7979
json_obj = json.loads(json_string)
8080
vintx = json_obj['vin'][0]['txid'] # get the vin to later check for utxo (should be spent by then)
81-
# get n of 0.1 outpoint
81+
# get n of 0.1 outpoint
8282
n = 0
8383
for vout in json_obj['vout']:
8484
if vout['value'] == 0.1:
8585
n = vout['n']
86-
87-
86+
87+
8888
######################################
8989
# GETUTXOS: query a unspent outpoint #
9090
######################################
91-
json_request = '{"checkmempool":true,"outpoints":[{"txid":"'+txid+'","n":'+str(n)+'}]}'
92-
json_string = http_get_call(url.hostname, url.port, '/rest/getutxos'+self.FORMAT_SEPARATOR+'json', json_request)
91+
json_request = '/checkmempool/'+txid+'-'+str(n)
92+
json_string = http_get_call(url.hostname, url.port, '/rest/getutxos'+json_request+self.FORMAT_SEPARATOR+'json')
9393
json_obj = json.loads(json_string)
94-
94+
9595
#check chainTip response
9696
assert_equal(json_obj['chaintipHash'], bb_hash)
97-
97+
9898
#make sure there is one utxo
9999
assert_equal(len(json_obj['utxos']), 1)
100100
assert_equal(json_obj['utxos'][0]['value'], 0.1)
101-
102-
101+
102+
103103
################################################
104104
# GETUTXOS: now query a already spent outpoint #
105105
################################################
106-
json_request = '{"checkmempool":true,"outpoints":[{"txid":"'+vintx+'","n":0}]}'
107-
json_string = http_get_call(url.hostname, url.port, '/rest/getutxos'+self.FORMAT_SEPARATOR+'json', json_request)
106+
json_request = '/checkmempool/'+vintx+'-0'
107+
json_string = http_get_call(url.hostname, url.port, '/rest/getutxos'+json_request+self.FORMAT_SEPARATOR+'json')
108108
json_obj = json.loads(json_string)
109-
109+
110110
#check chainTip response
111111
assert_equal(json_obj['chaintipHash'], bb_hash)
112112

113113
#make sure there is no utox in the response because this oupoint has been spent
114114
assert_equal(len(json_obj['utxos']), 0)
115-
115+
116116
#check bitmap
117117
assert_equal(json_obj['bitmap'], "0")
118-
119-
118+
119+
120120
##################################################
121121
# GETUTXOS: now check both with the same request #
122122
##################################################
123-
json_request = '{"checkmempool":true,"outpoints":[{"txid":"'+txid+'","n":'+str(n)+'},{"txid":"'+vintx+'","n":0}]}'
124-
json_string = http_get_call(url.hostname, url.port, '/rest/getutxos'+self.FORMAT_SEPARATOR+'json', json_request)
123+
json_request = '/checkmempool/'+txid+'-'+str(n)+'/'+vintx+'-0'
124+
json_string = http_get_call(url.hostname, url.port, '/rest/getutxos'+json_request+self.FORMAT_SEPARATOR+'json')
125125
json_obj = json.loads(json_string)
126126
assert_equal(len(json_obj['utxos']), 1)
127127
assert_equal(json_obj['bitmap'], "10")
128-
128+
129129
#test binary response
130130
bb_hash = self.nodes[0].getbestblockhash()
131131

@@ -134,19 +134,18 @@ def run_test(self):
134134
binaryRequest += pack("i", n);
135135
binaryRequest += binascii.unhexlify(vintx);
136136
binaryRequest += pack("i", 0);
137-
137+
138138
bin_response = http_get_call(url.hostname, url.port, '/rest/getutxos'+self.FORMAT_SEPARATOR+'bin', binaryRequest)
139-
140139
output = StringIO.StringIO()
141140
output.write(bin_response)
142141
output.seek(0)
143142
chainHeight = unpack("i", output.read(4))[0]
144143
hashFromBinResponse = hex(deser_uint256(output))[2:].zfill(65).rstrip("L")
145-
144+
146145
assert_equal(bb_hash, hashFromBinResponse) #check if getutxo's chaintip during calculation was fine
147146
assert_equal(chainHeight, 102) #chain height must be 102
148-
149-
147+
148+
150149
############################
151150
# GETUTXOS: mempool checks #
152151
############################
@@ -156,55 +155,56 @@ def run_test(self):
156155
json_string = http_get_call(url.hostname, url.port, '/rest/tx/'+txid+self.FORMAT_SEPARATOR+"json")
157156
json_obj = json.loads(json_string)
158157
vintx = json_obj['vin'][0]['txid'] # get the vin to later check for utxo (should be spent by then)
159-
# get n of 0.1 outpoint
158+
# get n of 0.1 outpoint
160159
n = 0
161160
for vout in json_obj['vout']:
162161
if vout['value'] == 0.1:
163162
n = vout['n']
164-
165-
json_request = '{"checkmempool":false,"outpoints":[{"txid":"'+txid+'","n":'+str(n)+'}]}'
166-
json_string = http_get_call(url.hostname, url.port, '/rest/getutxos'+self.FORMAT_SEPARATOR+'json', json_request)
163+
164+
json_request = '/'+txid+'-'+str(n)
165+
json_string = http_get_call(url.hostname, url.port, '/rest/getutxos'+json_request+self.FORMAT_SEPARATOR+'json')
167166
json_obj = json.loads(json_string)
168167
assert_equal(len(json_obj['utxos']), 0) #there should be a outpoint because it has just added to the mempool
169-
170-
json_request = '{"checkmempool":true,"outpoints":[{"txid":"'+txid+'","n":'+str(n)+'}]}'
171-
json_string = http_get_call(url.hostname, url.port, '/rest/getutxos'+self.FORMAT_SEPARATOR+'json', json_request)
168+
169+
json_request = '/checkmempool/'+txid+'-'+str(n)
170+
json_string = http_get_call(url.hostname, url.port, '/rest/getutxos'+json_request+self.FORMAT_SEPARATOR+'json')
172171
json_obj = json.loads(json_string)
173172
assert_equal(len(json_obj['utxos']), 1) #there should be a outpoint because it has just added to the mempool
174-
173+
175174
#do some invalid requests
176175
json_request = '{"checkmempool'
177176
response = http_get_call(url.hostname, url.port, '/rest/getutxos'+self.FORMAT_SEPARATOR+'json', json_request, True)
178177
assert_equal(response.status, 500) #must be a 500 because we send a invalid json request
179-
178+
180179
json_request = '{"checkmempool'
181180
response = http_get_call(url.hostname, url.port, '/rest/getutxos'+self.FORMAT_SEPARATOR+'bin', json_request, True)
182181
assert_equal(response.status, 500) #must be a 500 because we send a invalid bin request
183-
182+
183+
response = http_get_call(url.hostname, url.port, '/rest/getutxos/checkmempool'+self.FORMAT_SEPARATOR+'bin', '', True)
184+
assert_equal(response.status, 500) #must be a 500 because we send a invalid bin request
185+
184186
#test limits
185-
json_request = '{"checkmempool":true,"outpoints":['
186-
for x in range(0, 200):
187-
json_request += '{"txid":"'+txid+'","n":'+str(n)+'},'
188-
json_request = json_request.rstrip(",")
189-
json_request+="]}";
190-
response = http_get_call(url.hostname, url.port, '/rest/getutxos'+self.FORMAT_SEPARATOR+'json', json_request, True)
187+
json_request = '/checkmempool/'
188+
for x in range(0, 20):
189+
json_request += txid+'-'+str(n)+'/'
190+
json_request = json_request.rstrip("/")
191+
response = http_get_call(url.hostname, url.port, '/rest/getutxos'+json_request+self.FORMAT_SEPARATOR+'json', '', True)
191192
assert_equal(response.status, 500) #must be a 500 because we exceeding the limits
192-
193-
json_request = '{"checkmempool":true,"outpoints":['
194-
for x in range(0, 90):
195-
json_request += '{"txid":"'+txid+'","n":'+str(n)+'},'
196-
json_request = json_request.rstrip(",")
197-
json_request+="]}";
198-
response = http_get_call(url.hostname, url.port, '/rest/getutxos'+self.FORMAT_SEPARATOR+'json', json_request, True)
193+
194+
json_request = '/checkmempool/'
195+
for x in range(0, 15):
196+
json_request += txid+'-'+str(n)+'/'
197+
json_request = json_request.rstrip("/");
198+
response = http_get_call(url.hostname, url.port, '/rest/getutxos'+json_request+self.FORMAT_SEPARATOR+'json', '', True)
199199
assert_equal(response.status, 200) #must be a 500 because we exceeding the limits
200200

201201
self.nodes[0].generate(1) #generate block to not affect upcomming tests
202202
self.sync_all()
203-
203+
204204
################
205205
# /rest/block/ #
206206
################
207-
207+
208208
# check binary format
209209
response = http_get_call(url.hostname, url.port, '/rest/block/'+bb_hash+self.FORMAT_SEPARATOR+"bin", "", True)
210210
assert_equal(response.status, 200)
@@ -248,7 +248,7 @@ def run_test(self):
248248
hex_string = http_get_call(url.hostname, url.port, '/rest/tx/'+tx_hash+self.FORMAT_SEPARATOR+"hex", "", True)
249249
assert_equal(hex_string.status, 200)
250250
assert_greater_than(int(response.getheader('content-length')), 10)
251-
251+
252252

253253

254254
# check block tx details
@@ -278,7 +278,7 @@ def run_test(self):
278278

279279
#test rest bestblock
280280
bb_hash = self.nodes[0].getbestblockhash()
281-
281+
282282
json_string = http_get_call(url.hostname, url.port, '/rest/chaininfo.json')
283283
json_obj = json.loads(json_string)
284284
assert_equal(json_obj['bestblockhash'], bb_hash)

‎src/rest.cpp

Lines changed: 50 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
using namespace std;
2020
using namespace json_spirit;
2121

22-
static const int MAX_GETUTXOS_OUTPOINTS = 100; //allow a max of 100 outpoints to be queried at once
22+
static const int MAX_GETUTXOS_OUTPOINTS = 15; //allow a max of 15 outpoints to be queried at once
2323

2424
enum RetFormat {
2525
RF_UNDEF,
@@ -342,16 +342,51 @@ static bool rest_getutxos(AcceptedConnection* conn,
342342
vector<string> params;
343343
enum RetFormat rf = ParseDataFormat(params, strURIPart);
344344

345+
vector<string> uriParts;
346+
if (params.size() > 0 && params[0].length() > 1)
347+
{
348+
std::string strUriParams = params[0].substr(1);
349+
boost::split(uriParts, strUriParams, boost::is_any_of("/"));
350+
}
351+
345352
// throw exception in case of a empty request
346-
if (strRequest.length() == 0)
353+
if (strRequest.length() == 0 && uriParts.size() == 0)
347354
throw RESTERR(HTTP_INTERNAL_SERVER_ERROR, "Error: empty request");
348355

356+
bool fInputParsed = false;
349357
bool fCheckMemPool = false;
350358
vector<COutPoint> vOutPoints;
351359

352360
// parse/deserialize input
353361
// input-format = output-format, rest/getutxos/bin requires binary input, gives binary output, ...
354362

363+
if (uriParts.size() > 0)
364+
{
365+
366+
//inputs is sent over URI scheme (/rest/getutxos/checkmempool/txid1-n/txid2-n/...)
367+
if (uriParts.size() > 0 && uriParts[0] == "checkmempool")
368+
fCheckMemPool = true;
369+
370+
for (size_t i = (fCheckMemPool) ? 1 : 0; i < uriParts.size(); i++)
371+
{
372+
uint256 txid;
373+
int32_t nOutput;
374+
std::string strTxid = uriParts[i].substr(0, uriParts[i].find("-"));
375+
std::string strOutput = uriParts[i].substr(uriParts[i].find("-")+1);
376+
377+
if (!ParseInt32(strOutput, &nOutput) || !IsHex(strTxid))
378+
throw RESTERR(HTTP_INTERNAL_SERVER_ERROR, "Parse error");
379+
380+
txid.SetHex(strTxid);
381+
vOutPoints.push_back(COutPoint(txid, (uint32_t)nOutput));
382+
}
383+
384+
if (vOutPoints.size() > 0)
385+
fInputParsed = true;
386+
else
387+
throw RESTERR(HTTP_INTERNAL_SERVER_ERROR, "Error: empty request");
388+
}
389+
355390
string strRequestMutable = strRequest; //convert const string to string for allowing hex to bin converting
356391

357392
switch (rf) {
@@ -363,11 +398,17 @@ static bool rest_getutxos(AcceptedConnection* conn,
363398

364399
case RF_BINARY: {
365400
try {
366-
//deserialize
367-
CDataStream oss(SER_NETWORK, PROTOCOL_VERSION);
368-
oss << strRequestMutable;
369-
oss >> fCheckMemPool;
370-
oss >> vOutPoints;
401+
//deserialize only if user sent a request
402+
if (strRequestMutable.size() > 0)
403+
{
404+
if (fInputParsed) //don't allow sending input over URI and HTTP RAW DATA
405+
throw RESTERR(HTTP_INTERNAL_SERVER_ERROR, "Combination of URI scheme inputs and raw post data is not allowed");
406+
407+
CDataStream oss(SER_NETWORK, PROTOCOL_VERSION);
408+
oss << strRequestMutable;
409+
oss >> fCheckMemPool;
410+
oss >> vOutPoints;
411+
}
371412
} catch (const std::ios_base::failure& e) {
372413
// abort in case of unreadable binary data
373414
throw RESTERR(HTTP_INTERNAL_SERVER_ERROR, "Parse error");
@@ -376,33 +417,8 @@ static bool rest_getutxos(AcceptedConnection* conn,
376417
}
377418

378419
case RF_JSON: {
379-
try {
380-
// parse json request
381-
Value valRequest;
382-
if (!read_string(strRequest, valRequest))
383-
throw RESTERR(HTTP_INTERNAL_SERVER_ERROR, "Parse error");
384-
385-
Object jsonObject = valRequest.get_obj();
386-
const Value& checkMempoolValue = find_value(jsonObject, "checkmempool");
387-
388-
if (!checkMempoolValue.is_null()) {
389-
fCheckMemPool = checkMempoolValue.get_bool();
390-
}
391-
const Value& outpointsValue = find_value(jsonObject, "outpoints");
392-
if (!outpointsValue.is_null()) {
393-
Array outPoints = outpointsValue.get_array();
394-
BOOST_FOREACH (const Value& outPoint, outPoints) {
395-
Object outpointObject = outPoint.get_obj();
396-
uint256 txid = ParseHashO(outpointObject, "txid");
397-
Value nValue = find_value(outpointObject, "n");
398-
int nOutput = nValue.get_int();
399-
vOutPoints.push_back(COutPoint(txid, nOutput));
400-
}
401-
}
402-
} catch (...) {
403-
// return HTTP 500 if there was a json parsing error
404-
throw RESTERR(HTTP_INTERNAL_SERVER_ERROR, "Parse error");
405-
}
420+
if (!fInputParsed)
421+
throw RESTERR(HTTP_INTERNAL_SERVER_ERROR, "Error: empty request");
406422
break;
407423
}
408424
default: {

0 commit comments

Comments
 (0)