fix: api: Length check the array sent to RPC

simlecode · simlecode · commit 9c2c4b6a31b3 · 2024-03-14T09:49:56.000+08:00
diff --git a/app/submodule/eth/eth_api.go b/app/submodule/eth/eth_api.go
@@ -36,6 +36,8 @@ import (
 	cbg "github.com/whyrusleeping/cbor-gen"
 )
 
+const maxEthFeeHistoryRewardPercentiles = 100
+
 var log = logging.Logger("eth_api")
 
 var ErrNullRound = errors.New("requested epoch was a null round")
@@ -665,6 +667,9 @@ func (a *ethAPI) EthFeeHistory(ctx context.Context, p jsonrpc.RawParams) (types.
 	}
 	rewardPercentiles := make([]float64, 0)
 	if params.RewardPercentiles != nil {
+		if len(*params.RewardPercentiles) > maxEthFeeHistoryRewardPercentiles {
+			return types.EthFeeHistory{}, errors.New("length of the reward percentile array cannot be greater than 100")
+		}
 		rewardPercentiles = append(rewardPercentiles, *params.RewardPercentiles...)
 	}
 	for i, rp := range rewardPercentiles {

Original file line number	Diff line number	Diff line change
`@@ -36,6 +36,8 @@ import (`
`36`	`36`	`cbg "github.com/whyrusleeping/cbor-gen"`
`37`	`37`	`)`
`38`	`38`
	`39`	`+const maxEthFeeHistoryRewardPercentiles = 100`
	`40`	`+`
`39`	`41`	`var log = logging.Logger("eth_api")`
`40`	`42`
`41`	`43`	`var ErrNullRound = errors.New("requested epoch was a null round")`
`@@ -665,6 +667,9 @@ func (a *ethAPI) EthFeeHistory(ctx context.Context, p jsonrpc.RawParams) (types.`
`665`	`667`	`}`
`666`	`668`	`rewardPercentiles := make([]float64, 0)`
`667`	`669`	`if params.RewardPercentiles != nil {`
	`670`	`+ if len(*params.RewardPercentiles) > maxEthFeeHistoryRewardPercentiles {`
	`671`	`+ return types.EthFeeHistory{}, errors.New("length of the reward percentile array cannot be greater than 100")`
	`672`	`+ }`
`668`	`673`	`rewardPercentiles = append(rewardPercentiles, *params.RewardPercentiles...)`
`669`	`674`	`}`
`670`	`675`	`for i, rp := range rewardPercentiles {`