Explicit UTF8 json_metadata checks implemented #927

nemothenoone · 2017-03-10T14:46:52Z

Closes #926

mvandeberg · 2017-03-10T15:04:42Z

This PR will not correctly fix the problem. We cannot add another requirement to validate or else it would invalidate bad operations that are already in the blockchain. The added pruning on returning the comment is not needed. The reason we need to do it in the body is because sometimes we substring the body and need to make sure we split on a UTF-8 character boundary. This is not needed for title or category because those fields are never split.

mvandeberg · 2017-03-10T15:05:47Z

libraries/protocol/steem_operations.cpp

@@ -93,6 +93,7 @@ namespace steemit { namespace protocol {

      if( json_metadata.size() > 0 )
      {
+         FC_ASSERT( fc::is_utf8(json_metadata), "JSON Metadata not formatted in UTF8" );


Has to go into an evaluator and only take effect after a hardfork.

mvandeberg · 2017-03-10T20:28:57Z

#930 usurps this PR

Explicit UTF8 json_metadata checks implemented

bada8c2

mvandeberg suggested changes Mar 10, 2017

View reviewed changes

mvandeberg mentioned this pull request Mar 10, 2017

UTF8 json_metadata check absence leads to Condenser vulnerability #930

Merged

mvandeberg closed this Mar 10, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Explicit UTF8 json_metadata checks implemented #927

Explicit UTF8 json_metadata checks implemented #927

nemothenoone commented Mar 10, 2017

mvandeberg commented Mar 10, 2017

mvandeberg Mar 10, 2017

mvandeberg commented Mar 10, 2017

Explicit UTF8 json_metadata checks implemented #927

Explicit UTF8 json_metadata checks implemented #927

Conversation

nemothenoone commented Mar 10, 2017

mvandeberg commented Mar 10, 2017

mvandeberg Mar 10, 2017

Choose a reason for hiding this comment

mvandeberg commented Mar 10, 2017