You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The new WebsocketProviderV2 depends on the JSON-RPC 2.0 specification to be correct for providers. This means it depends on a request id matching with a response id. Because of the asynchronous nature of a websocket connection, and sometimes many-to-one response-to-request relationship (e.g. eth_subscribe), this is the only way to know how to format a response based on its request and to know which response from the socket to return for a particular request.
We don't currently validate that a response has an id very strictly. Starting with v7 of web3.py, we should check if an id is present and if it isn't we should make sure that the response matches that of a subscription. If it doesn't, it should be an invalid response.
How can it be fixed?
Validate whether an RPCResponse contains an id and if it doesn't, it is required to match all fields of an eth_subscribe subscription. There should be no reason for our library to make any assumptions based on malformed responses.
The text was updated successfully, but these errors were encountered:
What was wrong?
The new
WebsocketProviderV2
depends on the JSON-RPC 2.0 specification to be correct for providers. This means it depends on a requestid
matching with a responseid
. Because of the asynchronous nature of a websocket connection, and sometimes many-to-one response-to-request relationship (e.g. eth_subscribe), this is the only way to know how to format a response based on its request and to know which response from the socket to return for a particular request.We don't currently validate that a response has an
id
very strictly. Starting withv7
of web3.py, we should check if anid
is present and if it isn't we should make sure that the response matches that of a subscription. If it doesn't, it should be an invalid response.How can it be fixed?
Validate whether an
RPCResponse
contains anid
and if it doesn't, it is required to match all fields of aneth_subscribe
subscription. There should be no reason for our library to make any assumptions based on malformed responses.The text was updated successfully, but these errors were encountered: