forks/go-ethereum
1
0
Fork 1
mirror of https://github.com/ethereum/go-ethereum.git synced 2026-08-19 10:22:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

signer: remove local path disclosure from extapi

Browse source
This commit is contained in:
Martin Holst Swende 2018-08-30 14:07:53 +02:00
parent a95a601f35
commit c66a50dfea
No known key found for this signature in database
GPG key ID: 683B438C05A5DDF0
5 changed files with 19 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
cmd/clef/extapi_changelog.md
View file

@ -1,6 +1,9 @@
### Changelog for external API
#### 3.0.0
* The external `account_List`-method was changed to not expose `url`, which contained info about the local filesystem. It now returns only a list of addresses.
#### 2.0.0

2
cmd/clef/main.go
View file

@ -48,7 +48,7 @@ import (
)
// ExternalAPIVersion -- see extapi_changelog.md
const ExternalAPIVersion = "2.0.0"
const ExternalAPIVersion = "3.0.0"
// InternalAPIVersion -- see intapi_changelog.md
const InternalAPIVersion = "2.0.0"

12
signer/core/api.go
View file

@ -39,7 +39,7 @@ import (
// ExternalAPI defines the external API through which signing requests are made.
type ExternalAPI interface {
// List available accounts
List(ctx context.Context) (Accounts, error)
List(ctx context.Context) ([]common.Address, error)
// New request to create a new account
New(ctx context.Context) (accounts.Account, error)
// SignTransaction request to sign the specified transaction
@ -227,7 +227,7 @@ func NewSignerAPI(chainID int64, ksLocation string, noUSB bool, ui SignerUI, abi
// List returns the set of wallet this signer manages. Each wallet can contain
// multiple accounts.
func (api *SignerAPI) List(ctx context.Context) (Accounts, error) {
func (api *SignerAPI) List(ctx context.Context) ([]common.Address, error) {
var accs []Account
for _, wallet := range api.am.Wallets() {
for _, acc := range wallet.Accounts() {
@ -243,7 +243,13 @@ func (api *SignerAPI) List(ctx context.Context) (Accounts, error) {
return nil, ErrRequestDenied
}
return result.Accounts, nil
addresses := make([]common.Address,0)
for _, acc := range result.Accounts{
addresses = append(addresses, acc.Address)
}
return addresses, nil
}
// New creates a new password protected Account. The private key is protected with

8
signer/core/api_test.go
View file

@ -162,7 +162,7 @@ func failCreateAccount(control chan string, api *SignerAPI, t *testing.T) {
t.Fatal("Empty address should be returned")
}
}
func list(control chan string, api *SignerAPI, t *testing.T) []Account {
func list(control chan string, api *SignerAPI, t *testing.T) []common.Address {
control <- "A"
list, err := api.List(context.Background())
if err != nil {
@ -222,7 +222,7 @@ func TestSignData(t *testing.T) {
if err != nil {
t.Fatal(err)
}
a := common.NewMixedcaseAddress(list[0].Address)
a := common.NewMixedcaseAddress(list[0])
control <- "Y"
control <- "wrongpassword"
@ -275,7 +275,7 @@ func mkTestTx(from common.MixedcaseAddress) SendTxArgs {
func TestSignTx(t *testing.T) {
var (
list Accounts
list []common.Address
res, res2 *ethapi.SignTransactionResult
err error
)
@ -287,7 +287,7 @@ func TestSignTx(t *testing.T) {
if err != nil {
t.Fatal(err)
}
a := common.NewMixedcaseAddress(list[0].Address)
a := common.NewMixedcaseAddress(list[0])
methodSig := "test(uint)"
tx := mkTestTx(a)

5
signer/core/auditlog.go
View file

@ -33,11 +33,10 @@ type AuditLogger struct {
api ExternalAPI
}
func (l *AuditLogger) List(ctx context.Context) (Accounts, error) {
func (l *AuditLogger) List(ctx context.Context) ([]common.Address, error) {
l.log.Info("List", "type", "request", "metadata", MetadataFromContext(ctx).String())
res, e := l.api.List(ctx)
l.log.Info("List", "type", "response", "data", res.String())
l.log.Info("List", "type", "response", "data", res)
return res, e
}