Skip to content

fix(legacy): avoid possible panic on malformed block params#111

Merged
louisliu2048 merged 5 commits intomainfrom
vui-chee/fix-panic-on-malformed-block
Jan 26, 2026
Merged

fix(legacy): avoid possible panic on malformed block params#111
louisliu2048 merged 5 commits intomainfrom
vui-chee/fix-panic-on-malformed-block

Conversation

@Vui-Chee
Copy link
Contributor

@Vui-Chee Vui-Chee commented Jan 23, 2026

Fixes a critical security vulnerability where insufficient validation of block identifiers allowed JSON injection attacks, potentially causing service crashes via panic.

Changes

  • Added secure validation: Introduced is_valid_32_bytes_string() to validate that block hashes contain only valid hexadecimal characters, preventing JSON injection
  • Fixed panic vulnerability: Replaced .expect() calls with proper error propagation in call_eth_get_block_by_hash()

@Vui-Chee Vui-Chee requested a review from JimmyShi22 January 26, 2026 01:36
@louisliu2048 louisliu2048 merged commit ed04075 into main Jan 26, 2026
@Vui-Chee Vui-Chee deleted the vui-chee/fix-panic-on-malformed-block branch January 27, 2026 01:46
Vui-Chee added a commit that referenced this pull request Jan 30, 2026
* dev:
  fix: upgrade reth v1.10.2 version with bug fixes (#134)
  Update dependencies, use reth v1.10.2 and builder v0.3.0 (#133)
  chore: fix rust formatter (#132)
  chore: better rename, fix unused variable warning (#99) (#131)
  Fix comments (#127)
  Add trace log on tx cache hits (#126)
  replace magic error code number to INTERNAL_ERROR_CODE (#125)
  feat(legacy): remove eth_transactionPreExec (#124)
  fix tools readme (#123)
  fix(rpc): improve parameter validation in get_logs and service methods (#121)
  remove output file on error (#119)
  feat(legacy): support legacy routing for batch requests (#117)
  fix(legacy): avoid possible panic on malformed block params (#111)
  fallback to legacy if res is empty (#118)
  refactor(rpc): remove transaction_pre_exec API (#120)
  use XLayerPayloadServiceBuilder to simplify main() codes, merge to main branch (#112)
  fix(tools): check end block >= start block (#116)
  forward req to legacy on err (#110)
  fix: resolve audit issues related to flashblocks subscription (#113)
  fix(rpc): add trace_address for delegatecall and fix address format c… (#104)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants