Added defaults for remote-limt-api so sensitive calls are blocked by … #944
Conversation
| int API_PORT = 14265; | ||
| String API_HOST = "localhost"; | ||
| String[] REMOTE_LIMIT_API = new String[] {"addNeighbors", "getNeighbors", "removeNeighbors"}; |
There was a problem hiding this comment.
I think we should also add attachToTangle & interruptAttachingToTangle to the default list.
There was a problem hiding this comment.
Change to List<String> REMOTE_LIMIT_API
In IotaUtils you can add the following method:
public static <T> List<T> createImmutableList(T... a) {
return Collections.unmodifiableList(Arrays.asList(a));
}
Note that once we upgrade Java we can start using List.of() instead of doing this ugly thing.
See:
https://docs.oracle.com/javase/9/docs/api/java/util/List.html
There was a problem hiding this comment.
@alon-e isnt attachToTangle used in a lot of tutorials? That will probably confuse people if its disabled by default
There was a problem hiding this comment.
Since this is also a product decision I am tagging @jakubcech.
I want to remind everyone that since changing the defaults breaks backwards compatibility, perhaps it shouldn't be released together with the changes we made for configurations in #724.
There was a problem hiding this comment.
attachToTangle & interruptAttachingToTangle should be in the list. We should update our docs if it's broken by this change somewhere.
| @@ -600,9 +601,10 @@ protected void setBelowMaxDepthTransactionLimit(int maxAnalyzedTransactions) { | |||
| } | |||
|
|
|||
| public interface Defaults { | |||
| //API | |||
| //API | |||
There was a problem hiding this comment.
Not sure why it did that, i checked in code and it doesnt look like that :o
There was a problem hiding this comment.
It might happen if you use tabs instead of spaces (https://www.youtube.com/watch?v=SsoOG6ZeyUI 
)
There was a problem hiding this comment.
Hmm I don't see it fixed yet... You can configure your IDE to convert tabs to spaces.
| @@ -25,7 +26,7 @@ | |||
| //API | |||
| protected int port = Defaults.API_PORT; | |||
| protected String apiHost = Defaults.API_HOST; | |||
| protected List<String> remoteLimitApi = new ArrayList<>(); | |||
| protected List<String> remoteLimitApi = new ArrayList<>(Arrays.asList(Defaults.REMOTE_LIMIT_API)); | |||
There was a problem hiding this comment.
Hmm I think wrapping with Collections.unmodifiableList() would have been more suitable than ArrayList...
| int API_PORT = 14265; | ||
| String API_HOST = "localhost"; | ||
| String[] REMOTE_LIMIT_API = new String[] {"addNeighbors", "getNeighbors", "removeNeighbors"}; |
There was a problem hiding this comment.
Change to List<String> REMOTE_LIMIT_API
In IotaUtils you can add the following method:
public static <T> List<T> createImmutableList(T... a) {
return Collections.unmodifiableList(Arrays.asList(a));
}
Note that once we upgrade Java we can start using List.of() instead of doing this ugly thing.
See:
https://docs.oracle.com/javase/9/docs/api/java/util/List.html
kwek20
changed the title
| @@ -600,9 +601,10 @@ protected void setBelowMaxDepthTransactionLimit(int maxAnalyzedTransactions) { | |||
| } | |||
|
|
|||
| public interface Defaults { | |||
| //API | |||
| //API | |||
There was a problem hiding this comment.
Hmm I don't see it fixed yet... You can configure your IDE to convert tabs to spaces.
| int API_PORT = 14265; | ||
| String API_HOST = "localhost"; | ||
| List<String> REMOTE_LIMIT_API = IotaUtils.createImmutableList("addNeighbors", "getNeighbors", "removeNeighbors", "attachToTangle", "interruptAttachingToTangle"); |
There was a problem hiding this comment.
Can you set your IDE to have a column width of 120.
I will try to add more checkstyle rules real soon. I know style comments are annoying. A computer should give them and not a human.
|
@jakubcech and @DyrellC |
Description
Provides defaults for keeping an iri node secure when you do not provide flags.
Fixes #306
Type of change
How Has This Been Tested?
Started default IRI node with port parameter -> correct calls are blocked
Started IRI with --remote-api-limit for just blocking getNeighbors, and only that call is blocked
Checklist: