-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
account_objects CLI usage statement is wrong (Version: 1.5.0) #3329
Comments
Considering #3330, for account_objects specifically, I think a reasonable path forward would be to change it so that |
The API would allow seeds (and public keys) to be used in place of accounts at several locations in the API. For example, when calling account_info, you could pass `"account": "foo"`. The string "foo" is treated like a seed, so the method returns `actNotFound` (instead of `actMalformed`, as most developers would expect). In the early days, this was a convenience to make testing easier. However, it allows for poor security practices, so it is no longer a good idea. Allowing a secret or passphrase is now considered a bug. Previously, it was controlled by the `strict` option on some methods. With this commit, since the API does not interpret `account` as `seed`, the option `strict` is no longer needed and is removed. Removing this behavior from the API is a [breaking change](https://xrpl.org/request-formatting.html#breaking-changes). One could argue that it shouldn't be done without bumping the API version; however, in this instance, there is no evidence that anyone is using the API in the "legacy" way. Furthermore, it is a potential security hole, as it allows users to send secrets to places where they are not needed, where they could end up in logs, error messages, etc. There's no reason to take such a risk with a seed/secret, since only the public address is needed. Resolves: #3329, #3330, #4337 BREAKING CHANGE: Remove non-strict account parsing (#3330)
Issue Description
(Discovered while documenting #3196.) The usage statement for the
account_objects
method is wrong. [Source code]The account_objects method does not support the
strict
parameter, but the commandline implies it does.Steps to Reproduce
Start rippled in stand-alone mode, then run this command:
Expected Result
The result should be an
actMalformed
error, similar to what you get if you doaccount_info
with the same arguments.The "easy" fix is to correct the usage statement not to mention the
strict
parameter, which is not supported in any interface foraccount_objects
. But my preferred fix is to addstrict
support toaccount_objects
for consistency with other account_* methods.Actual Result
The server returns a successful response for the genesis account:
The text was updated successfully, but these errors were encountered: