bitcoinafterlife/bal-server
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

security: fix audit points 5-9 + optimize echo_push/info endpoints

Browse Source 
- Point 5 (SSRF): Add URL validation for WELIST_SERVER_URL (src/validation.rs)
- Point 6 (DB Access): Add DB path validation, symlink check, WAL mode (open_db)
- Point 8 (HTTPS): Extract nginx config, add deployment checklist, bind warnings
- Point 9 (Input Validation): Add NETWORKS check (404 for unknown), txid 64-hex validation
- Optimize echo_push: parse transactions outside DB lock, batch duplicate check, N+1 xpub lookup eliminated via HashSet cache
- Optimize echo_info: derive BIP32 address outside DB lock, minimize lock duration
- Fix echo_stats SQL injection via parameter binding + add idx_stats_chain index
- New regression tests: ssrf_tests, db_path_validation, input_validation_tests
This commit is contained in:
svatantrya
2026-07-16 18:59:30 -04:00
parent 237e62d4be
commit 4fc0790fe7
20 changed files with 2762 additions and 1022 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/xpub.rs
View File

@@ -125,11 +125,7 @@ pub fn get_bitcoincore_descriptor(xpub: &String) -> String {
Ok(c) => c,
Err(_) => return String::new(), // Invalid xpub, return empty descriptor
};
let descriptor = format!(
"wpkh([{}/84h/0h/0h]{}/0/*)",
fingerprint,
xpub_converted
);
let descriptor = format!("wpkh([{}/84h/0h/0h]{}/0/*)", fingerprint, xpub_converted);
let descriptor = match calc_checksum(&descriptor) {
Ok(checksum) => {
let clean_descriptor = descriptor.split('#').next().unwrap_or(&descriptor);
@@ -144,16 +140,20 @@ pub fn get_bitcoincore_descriptor(xpub: &String) -> String {
//format!("{}#{}",descriptor,checksum)
}
fn convert_xpub(xpub: &String) -> Result<String, String> {
if xpub.len() >= 4 && (&xpub[0..4] == "xpub" || &xpub[0..4] == "ypub" || &xpub[0..4] == "zpub") {
if xpub.len() >= 4 && (&xpub[0..4] == "xpub" || &xpub[0..4] == "ypub" || &xpub[0..4] == "zpub")
{
convert_to(xpub, BS58Prefix::Xpub)
} else if xpub.len() >= 4 && (&xpub[0..4] == "tpub" || &xpub[0..4] == "vpub" || &xpub[0..4] == "upub") {
} else if xpub.len() >= 4
&& (&xpub[0..4] == "tpub" || &xpub[0..4] == "vpub" || &xpub[0..4] == "upub")
{
convert_to(xpub, BS58Prefix::Tpub)
} else {
Err("Invalid xpub prefix: expected xpub, ypub, zpub, tpub, vpub, or upub".to_string())
}
}
pub fn calculate_fingerprint(tpub: &str) -> Result<String, String> {
let xpub = Xpub::from_str(&convert_to(tpub, BS58Prefix::Xpub)?).map_err(|e| format!("Invalid xpub: {}", e))?;
let xpub = Xpub::from_str(&convert_to(tpub, BS58Prefix::Xpub)?)
.map_err(|e| format!("Invalid xpub: {}", e))?;
let fp = xpub.fingerprint();
let _pp = xpub.parent_fingerprint;
Ok(format!("{}", fp))