Securize ConsensusContext Deserialization #618
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jsolman
reviewed
Mar 4, 2019
There was a problem hiding this comment.
I originally had some safeguards like this; however Erik made the point that it wasn’t necessary for the consensus context, since the consensus context itself is never sent over the network it is only serialized and deserialized locally from the same node. So there should not be any vulnerability by not checking these maximums on deserialization.
|
This kind of checks is necessary, there is no reason for don't establish a safe maximum, although the process is trustable |
jsolman
approved these changes
Mar 4, 2019
|
While, I don’t think this fixes any actual security vulnerability in this case, I agree with being defensive on the deserialization and having the safeguards, so I approved. It is a general good practice to always validate input. |
igormcoelho
approved these changes
Mar 4, 2019
Thacryba
pushed a commit
to simplitech/neo
that referenced
this pull request
Feb 17, 2020
* 2.9.0 * updates for 2.9.0 * Update v2.9.0.md (neo-project#610) Adjustment for instruction of getting nep-5 applicationlog. * Update invokescript.md (neo-project#613) Add tx * Update invokefunction.md (neo-project#612) Add tx for response. * Create getwalletheight (neo-project#611) Add getwalletheight api. * updates for 2.9.0 * minor updates * Update setup.md (neo-project#617) Add introduction of Plugins. * Update v2.9.0.md (neo-project#615) Add introduction for setting config.json * final updates * Update v2.9.0.md (neo-project#618) Add notes for install plugins. * plugin related
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.