Json RPC method parameter validation

rskj-core/src/main/java/co/rsk/rpc/Web3EthModule.java

@@ -25,6 +25,8 @@
 import org.ethereum.rpc.dto.CompilationResultDTO;
 import org.ethereum.rpc.dto.TransactionReceiptDTO;
 import org.ethereum.rpc.dto.TransactionResultDTO;
+import org.ethereum.rpc.parameters.BlockHashParam;
+import org.ethereum.rpc.parameters.HexIndexParam;
 
 import java.math.BigInteger;
 import java.util.Map;
@@ -108,19 +110,19 @@ default String eth_sendTransaction(CallArguments args) {
         return getEthModule().sendTransaction(args);
     }
 
-    BlockResultDTO eth_getBlockByHash(String blockHash, Boolean fullTransactionObjects) throws Exception;
+    BlockResultDTO eth_getBlockByHash(BlockHashParam blockHash, Boolean fullTransactionObjects) throws Exception;
 
     BlockResultDTO eth_getBlockByNumber(String bnOrId, Boolean fullTransactionObjects) throws Exception;
 
     TransactionResultDTO eth_getTransactionByHash(String transactionHash) throws Exception;
 
-    TransactionResultDTO eth_getTransactionByBlockHashAndIndex(String blockHash, String index) throws Exception;
+    TransactionResultDTO eth_getTransactionByBlockHashAndIndex(BlockHashParam blockHash, HexIndexParam index) throws Exception;
 
     TransactionResultDTO eth_getTransactionByBlockNumberAndIndex(String bnOrId, String index) throws Exception;
 
     TransactionReceiptDTO eth_getTransactionReceipt(String transactionHash) throws Exception;
 
-    BlockResultDTO eth_getUncleByBlockHashAndIndex(String blockHash, String uncleIdx) throws Exception;
+    BlockResultDTO eth_getUncleByBlockHashAndIndex(BlockHashParam blockHash, HexIndexParam uncleIdx) throws Exception;
 
     BlockResultDTO eth_getUncleByBlockNumberAndIndex(String blockId, String uncleIdx) throws Exception;
 

rskj-core/src/main/java/co/rsk/util/HexUtils.java

@@ -22,12 +22,12 @@
 import org.bouncycastle.util.encoders.Hex;
 import org.ethereum.util.ByteUtil;
 
-import static org.ethereum.rpc.exception.RskJsonRpcRequestException.invalidParamError;
-
 import java.math.BigInteger;
 import java.nio.charset.StandardCharsets;
 import java.util.regex.Pattern;
 
+import static org.ethereum.rpc.exception.RskJsonRpcRequestException.invalidParamError;
+
 /**
  * Hex utils
  */
@@ -353,7 +353,7 @@ public static byte[] decode(byte[] dataBytes) {
      * decodes a hexadecimal encoded with the 0x prefix into a integer
      */
     public static int jsonHexToInt(final String param) {
-        if (!hasHexPrefix(param)) {
+        if (!hasHexPrefix(param) && !HexUtils.isHex(param)) {
             throw invalidParamError(INCORRECT_HEX_SYNTAX);
         }
 

rskj-core/src/main/java/org/ethereum/rpc/Web3Impl.java

@@ -59,6 +59,8 @@
 import org.ethereum.rpc.dto.CompilationResultDTO;
 import org.ethereum.rpc.dto.TransactionReceiptDTO;
 import org.ethereum.rpc.dto.TransactionResultDTO;
+import org.ethereum.rpc.parameters.BlockHashParam;
+import org.ethereum.rpc.parameters.HexIndexParam;
 import org.ethereum.util.BuildInfo;
 import org.ethereum.vm.DataWord;
 import org.slf4j.Logger;
@@ -235,8 +237,7 @@ public String net_version() {
         try {
             byte netVersion = config.getNetworkConstants().getChainId();
             return s = Byte.toString(netVersion);
-        }
-        finally {
+        } finally {
             if (logger.isDebugEnabled()) {
                 logger.debug("net_version(): {}", s);
             }
@@ -411,10 +412,10 @@ public String eth_getCode(String address, Map<String, String> inputs) {
     @Override
     public String eth_getBalance(String address, String block) {
         /* HEX String  - an integer block number
-        *  String "earliest"  for the earliest/genesis block
-        *  String "latest"  - for the latest mined block
-        *  String "pending"  - for the pending state/transactions
-        */
+         *  String "earliest"  for the earliest/genesis block
+         *  String "latest"  - for the latest mined block
+         *  String "pending"  - for the pending state/transactions
+         */
 
         AccountInformationProvider accountInformationProvider = web3InformationRetriever.getInformationProvider(block);
 
@@ -445,7 +446,7 @@ public String eth_getBalance(String address) {
 
     @Override
     public String eth_getStorageAt(String address, String storageIdx, Map<String, String> blockRef) {
-        return invokeByBlockRef(blockRef, blockNumber -> this.eth_getStorageAt(address,storageIdx, blockNumber));
+        return invokeByBlockRef(blockRef, blockNumber -> this.eth_getStorageAt(address, storageIdx, blockNumber));
     }
 
     @Override
@@ -485,16 +486,17 @@ public String eth_getTransactionCount(String address, Map<String, String> inputs
      * It processes inputs maps ex: { "blockNumber": "0x0" },
      * { "blockHash": "0xd4e56740f876aef8c010b86a40d5f56745a118d0906a34e69aec8c0db1cb8fa3", "requireCanonical": false }
      * and invoke a function after processing.
-     * @param inputs map
+     *
+     * @param inputs                map
      * @param toInvokeByBlockNumber a function that returns a string based on the block number
      * @return function invocation result
      */
     protected String invokeByBlockRef(Map<String, String> inputs, UnaryOperator<String> toInvokeByBlockNumber) {
         final boolean requireCanonical = Boolean.parseBoolean(inputs.get("requireCanonical"));
         return applyIfPresent(inputs, "blockHash", blockHash -> this.toInvokeByBlockHash(blockHash, requireCanonical, toInvokeByBlockNumber))
                 .orElseGet(() -> applyIfPresent(inputs, "blockNumber", toInvokeByBlockNumber)
-                .orElseThrow(() -> invalidParamError("Invalid block input"))
-        );
+                        .orElseThrow(() -> invalidParamError("Invalid block input"))
+                );
     }
 
     private String toInvokeByBlockHash(String blockHash, boolean requireCanonical, Function<String, String> toInvokeByBlockNumber) {
@@ -644,10 +646,14 @@ public BlockInformationResult[] eth_getBlocksByNumber(String number) {
     }
 
     @Override
-    public BlockResultDTO eth_getBlockByHash(String blockHash, Boolean fullTransactionObjects) {
+    public BlockResultDTO eth_getBlockByHash(BlockHashParam blockHash, Boolean fullTransactionObjects) {
+        if (blockHash == null) {
+            throw invalidParamError("blockHash is null");
+        }
+
         BlockResultDTO s = null;
         try {
-            Block b = getBlockByJSonHash(blockHash);
+            Block b = this.blockchain.getBlockByHash(blockHash.getHash().getBytes());
             s = (b == null ? null : getBlockResult(b, fullTransactionObjects));
             return s;
         } finally {
@@ -684,7 +690,7 @@ public TransactionResultDTO eth_getTransactionByHash(String transactionHash) {
             TransactionInfo txInfo = this.receiptStore.getInMainChain(txHash.getBytes(), blockStore).orElse(null);
 
             if (txInfo == null) {
-                List<Transaction> txs =     web3InformationRetriever.getTransactions("pending");
+                List<Transaction> txs = web3InformationRetriever.getTransactions("pending");
 
                 for (Transaction tx : txs) {
                     if (tx.getHash().equals(txHash)) {
@@ -713,16 +719,24 @@ public TransactionResultDTO eth_getTransactionByHash(String transactionHash) {
     }
 
     @Override
-    public TransactionResultDTO eth_getTransactionByBlockHashAndIndex(String blockHash, String index) {
+    public TransactionResultDTO eth_getTransactionByBlockHashAndIndex(BlockHashParam blockHash, HexIndexParam index) {
+        if (blockHash == null) {
+            throw invalidParamError("blockHash is null");
+        }
+
+        if (index == null) {
+            throw invalidParamError("index is null");
+        }
+
         TransactionResultDTO s = null;
         try {
-            Block b = getBlockByJSonHash(blockHash);
+            Block b = blockchain.getBlockByHash(blockHash.getHash().getBytes());
 
             if (b == null) {
                 return null;
             }
 
-            int idx = jsonHexToInt(index);
+            int idx = index.getIndex();
 
             if (idx >= b.getTransactionsList().size()) {
                 return null;
@@ -782,17 +796,17 @@ public TransactionReceiptDTO eth_getTransactionReceipt(String transactionHash) {
     }
 
     @Override
-    public BlockResultDTO eth_getUncleByBlockHashAndIndex(String blockHash, String uncleIdx) {
+    public BlockResultDTO eth_getUncleByBlockHashAndIndex(BlockHashParam blockHash, HexIndexParam uncleIdx) {
         BlockResultDTO s = null;
 
         try {
-            Block block = blockchain.getBlockByHash(stringHexToByteArray(blockHash));
+            Block block = blockchain.getBlockByHash(blockHash.getHash().getBytes());
 
             if (block == null) {
                 return null;
             }
 
-            s = getUncleResultDTO(uncleIdx, block);
+            s = getUncleResultDTO(uncleIdx.getIndex(), block);
 
             return s;
         } finally {
@@ -802,14 +816,13 @@ public BlockResultDTO eth_getUncleByBlockHashAndIndex(String blockHash, String u
         }
     }
 
-    private BlockResultDTO getUncleResultDTO(String uncleIdx, Block block) {
-        int idx = jsonHexToInt(uncleIdx);
+    private BlockResultDTO getUncleResultDTO(Integer uncleIdx, Block block) {
 
-        if (idx >= block.getUncleList().size()) {
+        if (uncleIdx >= block.getUncleList().size()) {
             return null;
         }
 
-        BlockHeader uncleHeader = block.getUncleList().get(idx);
+        BlockHeader uncleHeader = block.getUncleList().get(uncleIdx);
         Block uncle = blockchain.getBlockByHash(uncleHeader.getHash().getBytes());
 
         if (uncle == null) {
@@ -829,8 +842,8 @@ public BlockResultDTO eth_getUncleByBlockNumberAndIndex(String blockId, String u
             if (!block.isPresent()) {
                 return null;
             }
-
-            s = getUncleResultDTO(uncleIdx, block.get());
+            int idx = jsonHexToInt(uncleIdx);
+            s = getUncleResultDTO(idx, block.get());
 
             return s;
         } finally {
@@ -871,7 +884,7 @@ public Map<String, CompilationResultDTO> eth_compileSolidity(String contract) {
     public String eth_newFilter(FilterRequest fr) throws Exception {
         String str = null;
         try {
-            Filter filter = LogFilter.fromFilterRequest(fr, blockchain, blocksBloomStore, config.getRpcEthGetLogsMaxBlockToQuery(),config.getRpcEthGetLogsMaxLogsToReturn());
+            Filter filter = LogFilter.fromFilterRequest(fr, blockchain, blocksBloomStore, config.getRpcEthGetLogsMaxBlockToQuery(), config.getRpcEthGetLogsMaxLogsToReturn());
             int id = filterManager.registerFilter(filter);
 
             str = toQuantityJsonHex(id);
@@ -1103,7 +1116,7 @@ public RskModule getRskModule() {
     /**
      * Adds an address or block to the list of banned addresses
      * It supports IPV4 and IPV6 addresses with an optional number of bits to ignore
-     *
+     * <p>
      * "192.168.51.1" is a valid address
      * "192.168.51.1/16" is a valid block
      *
@@ -1125,7 +1138,7 @@ public void sco_banAddress(String address) {
     /**
      * Removes an address or block to the list of banned addresses
      * It supports IPV4 and IPV6 addresses with an optional number of bits to ignore
-     *
+     * <p>
      * "192.168.51.1" is a valid address
      * "192.168.51.1/16" is a valid block
      *
@@ -1182,7 +1195,6 @@ public PeerScoringReputationSummary sco_reputationSummary() {
      * Clears scoring for the received id
      *
      * @param id peer identifier: firstly tried as an InetAddress, used as a NodeId otherwise
-     *
      * @return the list of scoring information, per node id and address
      */
     @SuppressWarnings("squid:S1166")

rskj-core/src/main/java/org/ethereum/rpc/parameters/BlockHashParam.java

@@ -0,0 +1,42 @@
+/*
+ * This file is part of RskJ
+ * Copyright (C) 2023 RSK Labs Ltd.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.ethereum.rpc.parameters;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
+
+import java.io.IOException;
+
+@JsonDeserialize(using = BlockHashParam.Deserializer.class)
+public class BlockHashParam extends HashParam32 {
+    private static final String HASH_TYPE = "block hash";
+
+    public BlockHashParam(String hash) {
+        super(HASH_TYPE, hash);
+    }
+
+    public static class Deserializer extends JsonDeserializer<BlockHashParam> {
+        @Override
+        public BlockHashParam deserialize(JsonParser jp, DeserializationContext ctxt) throws IOException {
+            String hash = jp.getText();
+            return new BlockHashParam(hash);
+        }
+    }
+}

rskj-core/src/main/java/org/ethereum/rpc/parameters/HashParam32.java

@@ -0,0 +1,53 @@
+/*
+ * This file is part of RskJ
+ * Copyright (C) 2023 RSK Labs Ltd.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+package org.ethereum.rpc.parameters;
+
+import co.rsk.crypto.Keccak256;
+import co.rsk.util.HexUtils;
+import org.ethereum.rpc.exception.RskJsonRpcRequestException;
+
+import static co.rsk.util.HexUtils.stringHexToByteArray;
+
+public abstract class HashParam32 {
+    private static final int HASH_BYTE_LENGTH = 32;
+    private final Keccak256 hash;
+
+    HashParam32(String hashType, String hash) {
+        if (hash == null || hash.isEmpty()) {
+            throw RskJsonRpcRequestException.invalidParamError("Invalid " + hashType + ": empty or null.");
+        }
+
+        byte[] hashBytes;
+
+        try {
+            hashBytes = HexUtils.stringHexToByteArray(hash);
+        } catch (Exception e) {
+            throw RskJsonRpcRequestException.invalidParamError("Invalid " + hashType + " format. " + e.getMessage());
+        }
+
+        if (HASH_BYTE_LENGTH != hashBytes.length) {
+            throw RskJsonRpcRequestException.invalidParamError("Invalid " + hashType + ": incorrect length.");
+        }
+
+        this.hash = new Keccak256(stringHexToByteArray(hash));
+    }
+
+    public Keccak256 getHash() {
+        return hash;
+    }
+}