staking: enforce length limit on validator info fields #2066
Labels
A-node
Area: System design and implementation for node software
A-staking
Area: Design and implementation of staking and delegation
C-bug
Category: a bug
E-easy
Effort: Easy
good first issue
A good issue for people without existing context on the project.
help wanted
Help on this issue is welcomed!
security
Issues or work related to security.
User
@what's_next?#1511
discovered that there is no length limit imposed on validator names, and uploaded the following validator definition to testnet 047-lysithea:https://gist.github.com/plaidfinch/67b043b9569dbefcdc4db26adb80f070
As you can see, both the
name
andwebsite
fields contain a 29kB base64-encoded GIF, specifically this one:We should enforce a reasonable maximum length limit for all fields in validator definitions, in consensus. We should also take this opportunity to check that any other freeform
String
fields that are user-controlled also have length maximums imposed.The text was updated successfully, but these errors were encountered: