Skip to content

Security: Blockchain Integration Path Traversal Fix#2910

Closed
MichaelSovereign wants to merge 49 commits intoScottcjn:mainfrom
MichaelSovereign:security-fix/blockchain-path-traversal
Closed

Security: Blockchain Integration Path Traversal Fix#2910
MichaelSovereign wants to merge 49 commits intoScottcjn:mainfrom
MichaelSovereign:security-fix/blockchain-path-traversal

Conversation

@MichaelSovereign
Copy link
Copy Markdown
Contributor

Summary

This PR fixes a directory traversal vulnerability in the method.

Changes

  1. Input Sanitization: Implemented strict regex-based sanitization of to ensure it only contains alphanumeric characters, hyphens, and underscores. This prevents an attacker from using IDs like to write files outside the intended directory.
  2. Safe Path Joining: Switched to for safer path construction.
  3. Robustness: Added directory existence checks and validation to ensure the storage process is reliable.

Closes #6460

@MichaelSovereign MichaelSovereign requested a review from Scottcjn as a code owner May 2, 2026 05:47
@github-actions github-actions Bot added BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) BCOS-L2 Beacon Certified Open Source tier BCOS-L2 (required for non-doc PRs) consensus Consensus/RIP-200 related node Node server related tests Test suite changes size/XL PR: 500+ lines labels May 2, 2026
Copy link
Copy Markdown
Contributor

@jaxint jaxint left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR Review: Blockchain Path Traversal Fix

Summary

This PR addresses a security vulnerability in the RustChain codebase.

Key Changes

  • node/airdrop_v2.py: +8 -4
  • node/anti_double_mining.py: +2 -1
  • node/arch_cross_validation.py: +7 -2

Assessment

Approve — Meaningful security fix.


Reviewed by: jaxint
Wallet: AhqbFaPBPLMMiaLDzA9WhQcyvv4hMxiteLhPk3NhG1iG

@Scottcjn
Copy link
Copy Markdown
Owner

Scottcjn commented May 3, 2026

Closing as part of Tier 0 hard-ban cleanup — see #3074 / #3104 / #3169 for the documented incident chain. All MichaelSovereign PRs are closed unread per the Tier 0 contract. No review path; no future PRs from this account will be processed. (See feedback_michaelsovereign_tier0_2026-05-02.md.)

@Scottcjn Scottcjn closed this May 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) BCOS-L2 Beacon Certified Open Source tier BCOS-L2 (required for non-doc PRs) consensus Consensus/RIP-200 related node Node server related size/XL PR: 500+ lines tests Test suite changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants