-
Notifications
You must be signed in to change notification settings - Fork 6
chore: Update u5c to 0.18.1 #97
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -1,21 +1,22 @@ | ||||||||||||||||||||||||||||||||||||||||
| #![cfg(test)] | ||||||||||||||||||||||||||||||||||||||||
| #![cfg(feature = "utxorpc")] | ||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
| use balius_runtime::{ledgers, Runtime, Store}; | ||||||||||||||||||||||||||||||||||||||||
| use serde_json::json; | ||||||||||||||||||||||||||||||||||||||||
| use std::collections::HashMap; | ||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
| #[tokio::test] | ||||||||||||||||||||||||||||||||||||||||
| async fn faucet_claim() { | ||||||||||||||||||||||||||||||||||||||||
| let store = Store::open("tests/balius.db", None).unwrap(); | ||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
| let ledger = ledgers::u5c::Ledger::new(ledgers::u5c::Config { | ||||||||||||||||||||||||||||||||||||||||
| let ledger = ledgers::u5c::Ledger::new(&ledgers::u5c::Config { | ||||||||||||||||||||||||||||||||||||||||
| endpoint_url: "https://mainnet.utxorpc-v0.demeter.run".to_string(), | ||||||||||||||||||||||||||||||||||||||||
| api_key: "dmtr_utxorpc1wgnnj0qcfj32zxsz2uc8d4g7uclm2s2w".to_string(), | ||||||||||||||||||||||||||||||||||||||||
| headers: Some(HashMap::from([ | ||||||||||||||||||||||||||||||||||||||||
| ("api-key".to_string(), "dmtr_utxorpc1wgnnj0qcfj32zxsz2uc8d4g7uclm2s2w".to_string()), | ||||||||||||||||||||||||||||||||||||||||
| ])), | ||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+10
to
+14
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Remove hardcoded API key from test source. Line 13 embeds a real credential in plaintext. This is a secret-leak risk and should be replaced with environment-based injection (or test skip when missing). 🔐 Suggested fix- let ledger = ledgers::u5c::Ledger::new(&ledgers::u5c::Config {
+ let api_key = match std::env::var("UTXORPC_API_KEY") {
+ Ok(v) => v,
+ Err(_) => {
+ eprintln!("Skipping test: UTXORPC_API_KEY is not set");
+ return;
+ }
+ };
+
+ let ledger = ledgers::u5c::Ledger::new(&ledgers::u5c::Config {
endpoint_url: "https://mainnet.utxorpc-v0.demeter.run".to_string(),
headers: Some(HashMap::from([
- ("api-key".to_string(), "dmtr_utxorpc1wgnnj0qcfj32zxsz2uc8d4g7uclm2s2w".to_string()),
+ ("api-key".to_string(), api_key),
])),
})📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||
| }) | ||||||||||||||||||||||||||||||||||||||||
| .await | ||||||||||||||||||||||||||||||||||||||||
| .unwrap(); | ||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
| let mut runtime = Runtime::builder(store) | ||||||||||||||||||||||||||||||||||||||||
| let runtime = Runtime::builder(store) | ||||||||||||||||||||||||||||||||||||||||
| .with_ledger(ledger.into()) | ||||||||||||||||||||||||||||||||||||||||
| .build() | ||||||||||||||||||||||||||||||||||||||||
| .unwrap(); | ||||||||||||||||||||||||||||||||||||||||
|
|
@@ -31,8 +32,9 @@ async fn faucet_claim() { | |||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||
| }); | ||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
| let wasm = std::fs::read("tests/faucet.wasm").unwrap(); | ||||||||||||||||||||||||||||||||||||||||
| runtime | ||||||||||||||||||||||||||||||||||||||||
| .register_worker("faucet", "tests/faucet.wasm", config) | ||||||||||||||||||||||||||||||||||||||||
| .register_worker("faucet", &wasm, config) | ||||||||||||||||||||||||||||||||||||||||
| .await | ||||||||||||||||||||||||||||||||||||||||
| .unwrap(); | ||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -281,6 +281,23 @@ pub struct Utxo<D> { | |||||||||||||
| pub datum: Option<D>, | ||||||||||||||
| } | ||||||||||||||
|
|
||||||||||||||
| impl<D> Utxo<D> { | ||||||||||||||
| pub fn coin(&self) -> u64 { | ||||||||||||||
| self.utxo | ||||||||||||||
| .coin | ||||||||||||||
| .as_ref() | ||||||||||||||
| .and_then(|x| { | ||||||||||||||
| x.big_int.as_ref().and_then(|y| match y { | ||||||||||||||
| utxorpc_spec::utxorpc::v1alpha::cardano::big_int::BigInt::Int(z) => { | ||||||||||||||
| Some(*z as u64) | ||||||||||||||
| } | ||||||||||||||
|
Comment on lines
+291
to
+293
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🏁 Script executed: # First, let's find and examine the qol.rs file
find . -name "qol.rs" -type fRepository: txpipe/balius Length of output: 80 🏁 Script executed: # Check the structure of the repository
git ls-files | head -20Repository: txpipe/balius Length of output: 552 🏁 Script executed: # Search for the coin() method in the codebase
rg "fn coin" -A 15Repository: txpipe/balius Length of output: 843 🏁 Script executed: # Look for the utxorpc-spec dependency version
fd "Cargo.toml" | xargs grep -l "utxorpc" 2>/dev/nullRepository: txpipe/balius Length of output: 140 🏁 Script executed: # Check the balius-sdk Cargo.toml for utxorpc-spec version
cat balius-sdk/Cargo.tomlRepository: txpipe/balius Length of output: 892 🏁 Script executed: # Search for BigInt type definition in the codebase
rg "enum BigInt" -A 10Repository: txpipe/balius Length of output: 39 🏁 Script executed: # Also search for where BigInt is imported from
rg "BigInt::" | head -20Repository: txpipe/balius Length of output: 673 🏁 Script executed: # Check how BigInt::Int is handled in dsl.rs
rg "BigInt::Int" -B 3 -A 3 balius-sdk/src/txbuilder/dsl.rsRepository: txpipe/balius Length of output: 347 🏁 Script executed: # Let's also check the full context around the coin() method in qol.rs
cat -n balius-sdk/src/qol.rs | sed -n '280,300p'Repository: txpipe/balius Length of output: 750 🌐 Web query:
💡 Result: In pub enum BigInt {
Int(i64),
BigUInt(Bytes),
BigNInt(Bytes),
}So the 🏁 Script executed: # Check the similar pattern in dsl.rs to see if it has the same issue
cat -n balius-sdk/src/txbuilder/dsl.rs | grep -B 5 -A 5 "BigInt::Int"Repository: txpipe/balius Length of output: 512 Fix lossy cast in Line 292 casts an 💡 Suggested fix impl<D> Utxo<D> {
pub fn coin(&self) -> u64 {
self.utxo
.coin
.as_ref()
.and_then(|x| {
x.big_int.as_ref().and_then(|y| match y {
utxorpc_spec::utxorpc::v1alpha::cardano::big_int::BigInt::Int(z) => {
- Some(*z as u64)
+ u64::try_from(*z).ok()
}
_ => None,
})
})
.unwrap_or_default()
}
}📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||
| _ => None, | ||||||||||||||
| }) | ||||||||||||||
| }) | ||||||||||||||
| .unwrap_or_default() | ||||||||||||||
| } | ||||||||||||||
| } | ||||||||||||||
|
|
||||||||||||||
| impl<D> TryFrom<wit::Event> for Utxo<D> { | ||||||||||||||
| type Error = Error; | ||||||||||||||
|
|
||||||||||||||
|
|
||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -340,7 +340,22 @@ impl ValueExpr for MinUtxoLovelace { | |
| }; | ||
|
|
||
| let serialized = pallas_codec::minicbor::to_vec(parent).unwrap(); | ||
| let min_lovelace = (160u64 + serialized.len() as u64) * ctx.pparams.coins_per_utxo_byte; | ||
| let coins_per_utxo_byte = ctx | ||
| .pparams | ||
| .coins_per_utxo_byte | ||
| .as_ref() | ||
| .and_then(|x| { | ||
| x.big_int.as_ref().and_then(|y| match y { | ||
| utxorpc_spec::utxorpc::v1alpha::cardano::big_int::BigInt::Int(z) => { | ||
| Some(*z as u64) | ||
| } | ||
|
Comment on lines
+349
to
+351
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🏁 Script executed: # First, let's find the file and examine the specific lines
find . -name "dsl.rs" -path "*/txbuilder/*" | head -5Repository: txpipe/balius Length of output: 90 🏁 Script executed: # Get a broader context around the lines in question
sed -n '340,365p' balius-sdk/src/txbuilder/dsl.rsRepository: txpipe/balius Length of output: 1016 🏁 Script executed: # Search for all occurrences of coins_per_utxo_byte in the file
rg "coins_per_utxo_byte" balius-sdk/src/txbuilder/dsl.rs -A 5 -B 5Repository: txpipe/balius Length of output: 1026 🏁 Script executed: # Let's check the type definition of BigInt::Int to confirm the type
rg "BigInt::Int" balius-sdk/src/txbuilder/dsl.rs -B 10 -A 10 | head -40Repository: txpipe/balius Length of output: 881 🏁 Script executed: # Check if utxorpc-spec is in the dependencies
find . -name "Cargo.toml" -exec grep -l "utxorpc" {} \;Repository: txpipe/balius Length of output: 146 🏁 Script executed: # Check the Cargo.toml for utxorpc-spec version
grep -A 10 "utxorpc" balius-sdk/Cargo.toml | head -20Repository: txpipe/balius Length of output: 521 🏁 Script executed: # Check around lines 355-357 to see if there's a similar pattern
sed -n '355,365p' balius-sdk/src/txbuilder/dsl.rsRepository: txpipe/balius Length of output: 513 🏁 Script executed: # Search for type definition of BigInt in the dependencies/source
rg "BigInt" balius-sdk/Cargo.lock -A 3 | head -30Repository: txpipe/balius Length of output: 118 🏁 Script executed: # Check if there's a utxorpc-spec definition file in the repo
find . -path "*/utxorpc*" -name "*.rs" | head -10Repository: txpipe/balius Length of output: 39 🏁 Script executed: # Look at the imports in dsl.rs to understand the full path
head -50 balius-sdk/src/txbuilder/dsl.rs | grep -E "use|import"Repository: txpipe/balius Length of output: 261 🏁 Script executed: # Let's check for the second occurrence mentioned "Also applies to: 355-357"
# First get the full context around these lines
sed -n '349,365p' balius-sdk/src/txbuilder/dsl.rsRepository: txpipe/balius Length of output: 730 🏁 Script executed: # Search for all similar patterns in the file that might have the same issue
rg "as u64" balius-sdk/src/txbuilder/dsl.rs -B 5 -A 2Repository: txpipe/balius Length of output: 986 🏁 Script executed: # Check the struct/module definitions to understand the full picture
ast-grep --pattern 'BigInt::Int($_) => { $$$ }'Repository: txpipe/balius Length of output: 39 🌐 Web query:
💡 Result: In utxorpc-spec 0.18.1 (Rust bindings):
Implication: Sources: [1] [2] 🏁 Script executed: # Let's check if there are other similar patterns with BigInt::Int casting
rg "BigInt::Int" balius-sdk/src/txbuilder/dsl.rs -B 3 -A 3Repository: txpipe/balius Length of output: 347 🏁 Script executed: # Count all occurrences of "as u64" specifically after BigInt::Int
grep -n "as u64" balius-sdk/src/txbuilder/dsl.rsRepository: txpipe/balius Length of output: 272 🏁 Script executed: # Let's look at the complete function to understand both locations
sed -n '330,375p' balius-sdk/src/txbuilder/dsl.rsRepository: txpipe/balius Length of output: 1667 🏁 Script executed: # Search for other occurrences of BigInt in the codebase that might match the "Also applies to" claim
rg "BigInt::" balius-sdk/src/txbuilder/dsl.rs -nRepository: txpipe/balius Length of output: 150 🏁 Script executed: # Check if there might be another function with similar pattern
rg "as u64" balius-sdk/src/txbuilder/ -B 5 -A 2Repository: txpipe/balius Length of output: 2380 🏁 Script executed: # Verify the line numbers more carefully - check what's at lines 355-357
sed -n '354,358p' balius-sdk/src/txbuilder/dsl.rs | cat -nRepository: txpipe/balius Length of output: 330 Replace unsafe cast with proper validation for Line 350 uses 💡 Suggested fix .and_then(|x| {
x.big_int.as_ref().and_then(|y| match y {
utxorpc_spec::utxorpc::v1alpha::cardano::big_int::BigInt::Int(z) => {
- Some(*z as u64)
+ u64::try_from(*z).ok()
}
_ => None,
})
})
.ok_or(BuildError::LedgerError(
- "Missing coins_per_utxo_byte protocol parameter".to_string(),
+ "Invalid coins_per_utxo_byte protocol parameter".to_string(),
))?;🤖 Prompt for AI Agents |
||
| _ => None, | ||
| }) | ||
| }) | ||
| .ok_or(BuildError::LedgerError( | ||
| "Missing coins_per_utxo_byte protocol parameter".to_string(), | ||
| ))?; | ||
| let min_lovelace = (160u64 + serialized.len() as u64) * coins_per_utxo_byte; | ||
| let current_value = match parent { | ||
| conway::PseudoTransactionOutput::PostAlonzo(x) => &x.value, | ||
| _ => unimplemented!(), | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Remove committed API key from test code.
Lines 25–30 expose a live credential (including in a comment). This is a security blocker; move it to environment/config secrets and rotate the leaked key.
🔐 Suggested fix
🧰 Tools
🪛 Gitleaks (8.30.0)
[high] 29-29: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents