diff --git a/.github/workflows/amoy_deb_profiles.yml b/.github/workflows/amoy_deb_profiles.yml index 80b73335cf..0031a1d5c4 100644 --- a/.github/workflows/amoy_deb_profiles.yml +++ b/.github/workflows/amoy_deb_profiles.yml @@ -384,7 +384,7 @@ jobs: uses: softprops/action-gh-release@v2 with: tag_name: ${{ env.GIT_TAG }} - prerelease: true + make_latest: false files: | packaging/deb/bor-amoy-**.deb packaging/deb/bor-pbss-amoy-**.deb diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 292212e609..eb3aba1c0a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -110,7 +110,7 @@ jobs: - name: Test run: make test - - uses: actions/upload-artifact@v4.4.0 + - uses: PaloAltoNetworks/upload-secure-artifact@main with: name: unitTest-coverage path: cover.out @@ -161,7 +161,7 @@ jobs: - name: test-integration run: make test-integration - - uses: actions/upload-artifact@v4.4.0 + - uses: PaloAltoNetworks/upload-secure-artifact@main with: name: integrationTest-coverage path: cover.out @@ -275,13 +275,17 @@ jobs: echo "Starting RPC Tests..." timeout 5m bash bor/integration-tests/rpc_test.sh + - name: Resolve absolute path for logs + id: pathfix + run: | + echo "ABS_LOG_PATH=$(realpath matic-cli/devnet/logs)" >> $GITHUB_ENV + - name: Upload logs if: always() - uses: actions/upload-artifact@v4.4.0 + uses: PaloAltoNetworks/upload-secure-artifact@main with: name: logs_${{ github.run_id }} - path: | - matic-cli/devnet/logs + path: ${{ env.ABS_LOG_PATH }} - name: Package code and chain data if: always() @@ -292,11 +296,11 @@ jobs: mkdir -p ${{ github.run_id }}/matic-cli sudo mv bor ${{ github.run_id }} sudo mv matic-cli/devnet ${{ github.run_id }}/matic-cli - sudo tar czf code.tar.gz ${{ github.run_id }} + sudo tar --warning=no-file-changed --exclude='.git' -czf code.tar.gz ${{ github.run_id }} - name: Upload code and chain data if: always() - uses: actions/upload-artifact@v4.4.0 + - uses: PaloAltoNetworks/upload-secure-artifact@main with: name: code_${{ github.run_id }} path: code.tar.gz diff --git a/.github/workflows/mainnet_deb_profiles.yml b/.github/workflows/mainnet_deb_profiles.yml index 893e5dce80..1edf37ee78 100644 --- a/.github/workflows/mainnet_deb_profiles.yml +++ b/.github/workflows/mainnet_deb_profiles.yml @@ -394,7 +394,7 @@ jobs: uses: softprops/action-gh-release@v2 with: tag_name: ${{ env.GIT_TAG }} - prerelease: true + make_latest: false files: | packaging/deb/bor-mainnet-**.deb packaging/deb/bor-pbss-mainnet-**.deb diff --git a/.github/workflows/packager_deb.yml b/.github/workflows/packager_deb.yml index 6d178e7293..fb733cd43b 100644 --- a/.github/workflows/packager_deb.yml +++ b/.github/workflows/packager_deb.yml @@ -122,7 +122,7 @@ jobs: uses: softprops/action-gh-release@v2 with: tag_name: ${{ env.GIT_TAG }} - prerelease: true + make_latest: false files: | packaging/deb/bor**.deb packaging/deb/bor**.deb.checksum diff --git a/accounts/usbwallet/ledger.go b/accounts/usbwallet/ledger.go index eb6c729594..f48008d3f4 100644 --- a/accounts/usbwallet/ledger.go +++ b/accounts/usbwallet/ledger.go @@ -531,6 +531,12 @@ func (w *ledgerDriver) ledgerSignTypedMessage(derivationPath []uint32, domainHas // APDU length | 1 byte // Optional APDU data | arbitrary func (w *ledgerDriver) ledgerExchange(opcode ledgerOpcode, p1 ledgerParam1, p2 ledgerParam2, data []byte) ([]byte, error) { + // max safe length check + const maxDataLength = 128 * 1024 * 1024 // 128 MB + if len(data) > maxDataLength { + return nil, errors.New("data too large") + } + // Construct the message payload, possibly split into multiple chunks apdu := make([]byte, 2, 7+len(data)) diff --git a/go.mod b/go.mod index 0f4ffa5471..4fc424268d 100644 --- a/go.mod +++ b/go.mod @@ -87,11 +87,11 @@ require ( go.opentelemetry.io/otel/sdk v1.27.0 go.uber.org/automaxprocs v1.5.3 go.uber.org/goleak v1.3.0 - golang.org/x/crypto v0.31.0 + golang.org/x/crypto v0.35.0 golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 - golang.org/x/sync v0.10.0 - golang.org/x/sys v0.28.0 - golang.org/x/text v0.21.0 + golang.org/x/sync v0.11.0 + golang.org/x/sys v0.30.0 + golang.org/x/text v0.22.0 golang.org/x/time v0.5.0 golang.org/x/tools v0.22.0 google.golang.org/grpc v1.64.1 @@ -168,7 +168,7 @@ require ( github.com/tklauser/numcpus v0.6.0 // indirect github.com/xrash/smetrics v0.0.0-20240312152122-5f08fbb34913 // indirect golang.org/x/mod v0.18.0 // indirect - golang.org/x/net v0.33.0 // indirect + golang.org/x/net v0.36.0 // indirect google.golang.org/protobuf v1.34.1 gopkg.in/yaml.v2 v2.4.0 // indirect gotest.tools v2.2.0+incompatible diff --git a/go.sum b/go.sum index 542bd72bfe..8831d677bc 100644 --- a/go.sum +++ b/go.sum @@ -2983,8 +2983,9 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs= golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM= -golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U= golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= +golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs= +golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ= golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= @@ -3159,8 +3160,8 @@ golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE= -golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I= -golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4= +golang.org/x/net v0.36.0 h1:vWF2fRbw4qslQsQzgFqZff+BItCvGFQqKzKIzx1rmoA= +golang.org/x/net v0.36.0/go.mod h1:bFmbeoIPfrw4sMHNhb4J9f6+tPziuGjq7Jk/38fxi1I= golang.org/x/oauth2 v0.0.0-20170207211851-4464e7848382/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -3231,8 +3232,9 @@ golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= -golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ= golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= +golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w= +golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -3373,8 +3375,9 @@ golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA= golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc= +golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/telemetry v0.0.0-20240208230135-b75ee8823808/go.mod h1:KG1lNk5ZFNssSZLrpVb4sMXKMpGwGXOxSG3rnu2gZQQ= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0= @@ -3425,8 +3428,9 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI= -golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo= golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ= +golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM= +golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= diff --git a/trie/encoding.go b/trie/encoding.go index 8d98f67464..cb54ad2a29 100644 --- a/trie/encoding.go +++ b/trie/encoding.go @@ -16,6 +16,8 @@ package trie +import "math" + // Trie keys are dealt with in three distinct encodings: // // KEYBYTES encoding contains the actual key and nothing else. This encoding is the @@ -104,6 +106,9 @@ func compactToHex(compact []byte) []byte { } func keybytesToHex(str []byte) []byte { + if len(str) > math.MaxInt/2 { + panic("input too large") + } l := len(str)*2 + 1 var nibbles = make([]byte, l)