forked from bitcoinafterlife/bal-server
svatantrya
b8d87ecabd
bal-server: - Wire independent actix-governor buckets per endpoint class (pushtxs, searchtx, info/stats, default) so polling a cheap endpoint can no longer exhaust the push-txs budget; previously every limit was dead config - Enforce BAL_SERVER_ACTIX_TIMEOUT_SECS via a request-timeout middleware that returns 408 Request Timeout, covering slow request bodies - De-duplicate txids within a single /pushtxs request body - Replace the byte-slice xpub detection (panic on non-ASCII) with a safe prefix check bal-pusher: - Handle malformed/empty ZMQ frames without indexing panics or UTF-8 expect - Return an error from sign_message and skip the stats report instead of panicking when the private key cannot be parsed validation / db: - Reject IPv4-mapped IPv6 targets (::ffff:a.b.c.d) in is_valid_welist_url to close an SSRF bypass, with unit tests - Use Path::starts_with for the SQLite forbidden-directory check so paths like /etcfoo are not misclassified misc: - Add explicit secret patterns to .gitignore and sync the docs
59 lines
1.9 KiB
TOML
59 lines
1.9 KiB
TOML
[package]
|
|
name = "bal_server"
|
|
version = "0.3.2"
|
|
edition = "2024"
|
|
|
|
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
|
[features]
|
|
default = ["server", "pusher"]
|
|
server = ["dep:actix-web", "dep:actix-governor", "dep:actix-rt", "dep:chrono", "dep:hex-conservative"]
|
|
pusher = ["dep:zmq", "dep:reqwest", "dep:byteorder", "dep:base64", "dep:ed25519-dalek"]
|
|
|
|
[dependencies]
|
|
bs58 = { version = "0.4.0" }
|
|
bytes = { version = "1.2" }
|
|
bitcoin = { version = "0.32.5" }
|
|
bitcoincore-rpc = { version = "0.19.0" }
|
|
bitcoincore-rpc-json = { version = "0.19.0" }
|
|
env_logger = { version = "0.11.5" }
|
|
hex = { version = "0.4.3" }
|
|
log = { version = "0.4.21" }
|
|
serde = { version = "1.0.152", features = ["derive"] }
|
|
serde_json = { version = "1.0.116" }
|
|
sqlx = { version = "0.8", features = ["runtime-tokio", "sqlite", "postgres", "chrono"] }
|
|
regex = { version = "1.10.4" }
|
|
tokio = { version = "1", features = ["rt", "net","macros","rt-multi-thread","time"] }
|
|
url = { version = "2" }
|
|
|
|
# server-only
|
|
actix-web = { version = "4.9.0", optional = true }
|
|
actix-governor = { version = "0.6.0", optional = true }
|
|
actix-rt = { version = "2.10.0", optional = true }
|
|
chrono = { version = "0.4.40", optional = true }
|
|
hex-conservative = { version = "0.1.1", optional = true }
|
|
|
|
# pusher-only
|
|
zmq = { version = "0.10.0", optional = true }
|
|
reqwest = { version = "0.12.24", features = ["json","socks"], optional = true }
|
|
byteorder = { version = "1.5.0", optional = true }
|
|
base64 = { version = "0.22.1", optional = true }
|
|
ed25519-dalek = { version = "2", features = ["pem", "pkcs8"], optional = true }
|
|
sha2 = { version = "0.10.8" }
|
|
|
|
[profile.release]
|
|
opt-level = "z"
|
|
lto = true
|
|
codegen-units = 1
|
|
strip = true
|
|
panic = "abort"
|
|
|
|
[[bin]]
|
|
name = "bal-server"
|
|
path = "src/bin/bal-server.rs"
|
|
required-features = ["server"]
|
|
|
|
[[bin]]
|
|
name = "bal-pusher"
|
|
path = "src/bin/bal-pusher.rs"
|
|
required-features = ["pusher"]
|