svatantrya
b8d87ecabd
bal-server: - Wire independent actix-governor buckets per endpoint class (pushtxs, searchtx, info/stats, default) so polling a cheap endpoint can no longer exhaust the push-txs budget; previously every limit was dead config - Enforce BAL_SERVER_ACTIX_TIMEOUT_SECS via a request-timeout middleware that returns 408 Request Timeout, covering slow request bodies - De-duplicate txids within a single /pushtxs request body - Replace the byte-slice xpub detection (panic on non-ASCII) with a safe prefix check bal-pusher: - Handle malformed/empty ZMQ frames without indexing panics or UTF-8 expect - Return an error from sign_message and skip the stats report instead of panicking when the private key cannot be parsed validation / db: - Reject IPv4-mapped IPv6 targets (::ffff:a.b.c.d) in is_valid_welist_url to close an SSRF bypass, with unit tests - Use Path::starts_with for the SQLite forbidden-directory check so paths like /etcfoo are not misclassified misc: - Add explicit secret patterns to .gitignore and sync the docs
60 lines
788 B
Plaintext
60 lines
788 B
Plaintext
# Secrets and environment files - NEVER commit
|
|
.env
|
|
.env.*
|
|
.env.local
|
|
*.env.local
|
|
.env.production
|
|
.env.secret
|
|
!.env.example
|
|
*.pem
|
|
private_key.pem
|
|
privkey.pem
|
|
!public_key.pem
|
|
*.key
|
|
ec.key
|
|
chiave_privata.key
|
|
|
|
# Databases
|
|
*.db
|
|
*.db-shm
|
|
*.db-wal
|
|
|
|
# Rust build artifacts
|
|
/target
|
|
|
|
# Release artifacts
|
|
/releases/
|
|
*.tar.gz
|
|
*.tar.gz.asc
|
|
*.tar.gz.sig
|
|
*.tar.gz.sha256
|
|
bal-server-*/
|
|
|
|
# Deployment configs (keep in deploy scripts, not in repo)
|
|
bal-server.env
|
|
bal-pusher.env
|
|
bitcoind.service
|
|
tbitcoind.service
|
|
|
|
# Test data and scratch files
|
|
invalid_txs
|
|
valid_txs
|
|
test
|
|
update
|
|
update_codebase.txt
|
|
|
|
# Utility scripts (keep local, not in repo)
|
|
sendtx.sh
|
|
lib.sh
|
|
generate_random_ascii.sh
|
|
start_postgres_docker.sh
|
|
make_release.sh
|
|
download_bal_db.sh
|
|
|
|
# Misc
|
|
*.swp
|
|
*.swo
|
|
src/xpub.rs2
|
|
public_key.pem
|
|
.gitsecret/
|