Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Clef: disallow invalid ABI #17632

Closed
holiman opened this issue Sep 11, 2018 · 0 comments
Closed

Clef: disallow invalid ABI #17632

holiman opened this issue Sep 11, 2018 · 0 comments
Assignees
@holiman
Labels
area:clef

Comments

@holiman
Copy link
Contributor

holiman commented Sep 11, 2018

Ref: NCC-EF-Clef-007

Clef currently allows (but warns) several cases of malformed transactions. Clef should reject instead of warn, unless configured explicitly to allow non-standard calls, (e.g. through --dev flag or similar, maybe --advanced)

Cases include:

  • data present, but shorter than 4 bytes (no method selector)
  • data present, and method selector, but calldata not a multiple of 32 (not properly formatted parameters)
  • 'data' and 'calldata' cannot be matched against ABI, and ABI is not supplied with the call (I'm not 100% certain if we should really reject this one -- depends on how good coverage the db has)
@holiman holiman self-assigned this Sep 11, 2018
holiman added a commit to holiman/go-ethereum that referenced this issue Sep 13, 2018
@holiman
signer,clef: default reject instead of warn + valideate new passwords. …
193f704 
…fixes ethereum#17632 and ethereum#17631
holiman added a commit to holiman/go-ethereum that referenced this issue Sep 25, 2018
@holiman
signer,clef: default reject instead of warn + valideate new passwords. …
8e41a5c 
…fixes ethereum#17632 and ethereum#17631
cryptomental pushed a commit to cryptomental/go-ethereum that referenced this issue Jan 9, 2019
@holiman
cmd/clef, signer: security fixes (ethereum#17554)
90f304a 
* signer: remove local path disclosure from extapi

* signer: show more data in cli ui

* rpc: make http server forward UA and Origin via Context

* signer, clef/core: ui changes + display UA and Origin

* signer: cliui - indicate less trust in remote headers, see ethereum#17637

* signer: prevent possibility swap KV-entries in aes_gcm storage, fixes ethereum#17635

* signer: remove ecrecover from external API

* signer,clef: default reject instead of warn + valideate new passwords. fixes ethereum#17632 and ethereum#17631

* signer: check calldata length even if no ABI signature is present

* signer: fix failing testcase

* clef: remove account import from external api

* signer: allow space in passwords, improve error messsage

* signer/storage: fix typos
cryptomental pushed a commit to cryptomental/go-ethereum that referenced this issue Jan 9, 2019
@holiman @cryptomental
cmd/clef, signer: security fixes (ethereum#17554)
9fba306 
* signer: remove local path disclosure from extapi

* signer: show more data in cli ui

* rpc: make http server forward UA and Origin via Context

* signer, clef/core: ui changes + display UA and Origin

* signer: cliui - indicate less trust in remote headers, see ethereum#17637

* signer: prevent possibility swap KV-entries in aes_gcm storage, fixes ethereum#17635

* signer: remove ecrecover from external API

* signer,clef: default reject instead of warn + valideate new passwords. fixes ethereum#17632 and ethereum#17631

* signer: check calldata length even if no ABI signature is present

* signer: fix failing testcase

* clef: remove account import from external api

* signer: allow space in passwords, improve error messsage

* signer/storage: fix typos
cryptomental pushed a commit to cryptomental/go-ethereum that referenced this issue Jan 9, 2019
@holiman @cryptomental
cmd/clef, signer: security fixes (ethereum#17554)
ca43f4a 
* signer: remove local path disclosure from extapi

* signer: show more data in cli ui

* rpc: make http server forward UA and Origin via Context

* signer, clef/core: ui changes + display UA and Origin

* signer: cliui - indicate less trust in remote headers, see ethereum#17637

* signer: prevent possibility swap KV-entries in aes_gcm storage, fixes ethereum#17635

* signer: remove ecrecover from external API

* signer,clef: default reject instead of warn + valideate new passwords. fixes ethereum#17632 and ethereum#17631

* signer: check calldata length even if no ABI signature is present

* signer: fix failing testcase

* clef: remove account import from external api

* signer: allow space in passwords, improve error messsage

* signer/storage: fix typos
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@holiman holiman

Labels
area:clef
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@holiman