gateway/blocks-backend: GetBlock should not perform IPLD decoding #673
Open
Labels
kind/bug
A bug in existing code (including security flaws)
need/analysis
Needs further analysis before proceeding
need/maintainers-input
Needs input from the current maintainer(s)
P2
Medium: Good to have, but can wait until someone steps up
The gateway BlocksBackend's
GetBlock
function under the hood uses the dagservice's Get function which means it attempts to do an IPLD decoding of the block. This is not good because it means the gateway needs to understand the blocks codec in order to return it even when it doesn't really need to.boxo/gateway/backend_blocks.go
Line 213 in 171b0b7
boxo/gateway/backend_blocks.go
Line 553 in 171b0b7
As an example: rainbow does not support dag-jose and so sending a
format=raw
request to a rainbow gateway will fail even though it could pass.A fix here is to use the blockservice directly instead of the dagservice for the GetBlock function's retrieval purposes after doing any path traversals required to get to the final block.
The text was updated successfully, but these errors were encountered: