Skip to content

fix(jsonrpc): add blockNumOrHashOrTag length check #6596

Open
Sunny6889 wants to merge 4 commits intotronprotocol:developfrom
Sunny6889:fix_hexbiginteger
Open

fix(jsonrpc): add blockNumOrHashOrTag length check #6596
Sunny6889 wants to merge 4 commits intotronprotocol:developfrom
Sunny6889:fix_hexbiginteger

Conversation

@Sunny6889
Copy link
Contributor

@Sunny6889 Sunny6889 commented Mar 23, 2026

What does this PR do?

  • Reliable Fixes: Added input validation for JSON-RPC block identifiers and hex parsing to reject null/overlong inputs, reducing risk of malformed-request abuse. Add ThreadLocal safety.
  • Chores: Centralised rate limiter default values and lowered API rate limiter defaults (global and per-IP) for safer defaults.

Why are these changes required?

This PR has been tested by:

  • Unit Tests
  • Manual Testing

Follow up

Extra details

Squashed commits:
[cd5159c] fix lint
[214bf5f] fix lint
[ac528da] clean code
[b1970a6] update jsonrpcTest
[eb0cf8d] fix qps config
[370c972] fix test
[8591199] add ByteArrayTest
[6841903] lower the default QPS limit
[ccc0a26] remove check
[7d02487] revert some changes
[7f78fb0] fix merge
[7e5bbbd] refactor(config): extract CLIParameter and restructure Args init flow (tronprotocol#6569)
[3fc3b53] ci: add multi-platform build tests and system-test workflows (tronprotocol#6574)
[5044c82] fix(docs): github issue template (tronprotocol#6572)
[ba73305] refactor(config): remove unused config files (tronprotocol#6566)

Removed 4 config files from framework/src/main/resources that were
not referenced anywhere in the codebase:
- config-backup.conf: no references
- config-beta.conf: no references
- config-test-net.conf: no references
- config-localtest.conf: only used in tests, shadowed by
  src/test/resources/config-localtest.conf on the test classpath
[67fc14e] refactor(config): extract ConfigKey and remove testnet config (tronprotocol#6565)
[13b68ea] ci: enhance PR lint and add PR guidelines to CONTRIBUTING.md (tronprotocol#6564)
[d61e134] ci: make build job depend on PR lint check (tronprotocol#6559)
[3aa591f] refactor: move test constant out of production code and rename NET_CONF (tronprotocol#6555)
[111b967] fix readme typo and format (tronprotocol#6556)

* fix readme typo and format
[b526ede] update getByJsonBlockId
Squashed commits:
[f15651c] fix(doc): revert mis-change
[ded714c] fix(doc): revert mis-change
[54bbdc9] fix format (+16 squashed commits)
Squashed commits:
[5e642e991c] update issue template
[0f9134a3eb] update issue template
[886b8a3d8f] fix review
[221e1eac7a] fix lint
[2c6a4d2f3d] fix lint
[87873db079] clean code
[d9190dc0d9] update jsonrpcTest
[67cb174618] fix qps config
[0c97a6908b] fix test
[21561c41c3] add ByteArrayTest
[761246f31e] lower the default QPS limit
[28d265ecf6] remove check
[67ffbf652e] revert some changes
[eb0290b87c] fix merge
[a798968c7a] update getByJsonBlockId
[bb112b59aa] fix rpc blockNum or hash or tag too long risk
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants