fix: (webapi) check offledger byte prefix before deserialization

packages/isc/requestimpl.go

@@ -22,6 +22,14 @@ const (
 	requestKindOffLedgerEVMCall
 )
 
+func IsOffledgerKind(b byte) bool {
+	switch RequestKind(b) {
+	case requestKindOffLedgerISC, requestKindOffLedgerEVMTx:
+		return true
+	}
+	return false
+}
+
 func RequestFromBytes(data []byte) (Request, error) {
 	rr := rwutil.NewBytesReader(data)
 	return RequestFromReader(rr), rr.Err

packages/webapi/services/offledger.go

@@ -26,6 +26,10 @@ func NewOffLedgerService(chainService interfaces.ChainService, networkProvider p
 }
 
 func (c *OffLedgerService) ParseRequest(binaryRequest []byte) (isc.OffLedgerRequest, error) {
+	// check offledger kind (avoid deserialization otherwise)
+	if !isc.IsOffledgerKind(binaryRequest[0]) {
+		return nil, errors.New("error parsing request: off-ledger request expected")
+	}
 	request, err := isc.RequestFromBytes(binaryRequest)
 	if err != nil {
 		return nil, errors.New("error parsing request from payload")

tools/wasp-cli/chain/governance.go

@@ -81,7 +81,7 @@ func initDisableFeePolicyCmd() *cobra.Command {
 	var chain string
 
 	cmd := &cobra.Command{
-		Use:   "disable-gas-policy",
+		Use:   "disable-feepolicy",
 		Short: "set token charged by each gas to free.",
 		Run: func(cmd *cobra.Command, args []string) {
 			node = waspcmd.DefaultWaspNodeFallback(node)