bitcoinafterlife/bal-server
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity
66 Commits 1 Branch 7 Tags
7999902cc014d2409d6904ec84f244ab175ec4b7
Commit Graph

10 Commits

Author SHA1 Message Date
svatantrya
36219c49a0 fix: bug fixes, dead code removal, improved ZMQ logging 
- Fix SQL syntax error in create_database (trailing parenthesis)
- Fix typo i27.0.0.1 -> 127.0.0.1 in Testnet/Testnet4 defaults
- Replace hardcoded VERSION with CARGO_PKG_VERSION in bal-pusher
- Remove unwrap() in DB update loops (status push/invalid)
- Remove duplicate init_network call in bal-server startup
- Use INSERT OR IGNORE for idempotent xpub initialization
- Remove debug println! left in production code
- Remove dead code: check_zmq_connection, ConnectionMonitor, seq_to_str
- Remove all commented-out code blocks
- ZMQ timeout logging: trace instead of warn, error only after 1 hour
 2026-07-20 08:48:54 -04:00
svatantrya
cd24eda111 fix(pusher): improve welist response logging, error handling, and add request timeout 
- Always log HTTP status code and response body from welist (info level)
- Log send_stats_report errors at call site instead of silently discarding
- Add 10s timeout to reqwest client to prevent indefinite hangs
- Apply clippy fixes (is_empty, if-let chains, dead_code, etc.)
 2026-07-18 22:58:42 -04:00
svatantrya
fbe61a5862 fix: Docker support, WAL race condition, pusher panic fixes 
- Add multi-stage Dockerfile with tini, non-root user, healthcheck
- Fix SQLite WAL mode race between bal-server and bal-pusher (busy_timeout + retry)
- Fix tbl_stats missing UNIQUE index for ON CONFLICT clause
- Replace unwrap() panics in bal-pusher with graceful error handling
- Add docker/entrypoint.sh with BAL_PUSHER_NETWORK support
- cargo fmt across all files
 2026-07-16 21:24:09 -04:00
svatantrya
4fc0790fe7 security: fix audit points 5-9 + optimize echo_push/info endpoints 
- Point 5 (SSRF): Add URL validation for WELIST_SERVER_URL (src/validation.rs)
- Point 6 (DB Access): Add DB path validation, symlink check, WAL mode (open_db)
- Point 8 (HTTPS): Extract nginx config, add deployment checklist, bind warnings
- Point 9 (Input Validation): Add NETWORKS check (404 for unknown), txid 64-hex validation
- Optimize echo_push: parse transactions outside DB lock, batch duplicate check, N+1 xpub lookup eliminated via HashSet cache
- Optimize echo_info: derive BIP32 address outside DB lock, minimize lock duration
- Fix echo_stats SQL injection via parameter binding + add idx_stats_chain index
- New regression tests: ssrf_tests, db_path_validation, input_validation_tests
 2026-07-16 18:59:30 -04:00
svatantrya
167869b881 security: eliminate unwrap/expect/panic on untrusted input paths (Fase 2 HIGH) 
- db.rs: Replace all stmt.read/bind().unwrap() with safe match/if let + error logging
- db.rs: Replace execute_insert() expect() with safe prepare + rollback on error
- db.rs: Replace get_total_transaction_number() unwrap() with safe match/Result propagation
- bal-server.rs: Replace fs::read_to_string().expect() with match + 500 error
- bal-server.rs: Replace idx/amount.try_into().unwrap() with i64::try_from(...).unwrap_or()
- bal-server.rs: echo_pub_key returns 500 instead of panic on file read failure
- docs/08_security_audit.md: Update status for panic/DoS vulnerabilities to 'Fixed'
- All tests pass: cargo test (5 tests: 3 SQL injection + 2 panic regression)
- Build verified: cargo check --bin=bal-server --bin=bal-pusher (0 errors)
 2026-07-16 14:56:25 -04:00
svatantrya
c2797420a1 expose stats 2026-01-21 00:08:47 -04:00
bitcoinafterlife
056aa414e5 release: bal-server-0.2.2 2025-10-31 15:13:09 -04:00
bitcoinafterlife
72fc39b787 fixed db field network 2025-07-15 15:12:21 -04:00
bitcoinafterlife
713eb8fbaa xpub related update 2025-05-22 19:41:05 -04:00
bitcoinafterlife
793b6dccf0 xpub & Some improvement 2025-05-06 21:21:13 -04:00