Skip to content
This repository has been archived by the owner on Jun 11, 2024. It is now read-only.

Chain ID length not validated in interoperability endpoints #8604

Closed
Tracked by #7226
ishantiw opened this issue Jun 16, 2023 · 0 comments · Fixed by #8627
Closed
Tracked by #7226

Chain ID length not validated in interoperability endpoints #8604

ishantiw opened this issue Jun 16, 2023 · 0 comments · Fixed by #8627
Assignees
@Phanco
Labels
framework/module/interoperability Interoperability module type: bug
Milestone
Sprint 98

Comments

@ishantiw
Copy link
Contributor

Description

The BaseInteroperabilityEndpoint and MainchainInteroperabilityEndpoint classes provide several methods that take a hex-formatted chain ID as a parameter. These methods validate the chain ID using different schemas that are all aliases for getChainAccountRequestSchema

https://github.com/LiskHQ/lisk-sdk/blob/89e7504ef5eb6183aefe576a93be3d6052e56038/framework/src/modules/interoperability/schemas.ts#L561-L571

The chainID property in the above schema lacks the minLength and maxLength fields. As a result, arbitrary-length chain ID strings may be passed to internal functions that assume a correct length.

Affected version

v6.0.0-beta.2
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@Phanco Phanco

Labels
framework/module/interoperability Interoperability module type: bug
Projects
None yet
Milestone
Sprint 98
Development

Successfully merging a pull request may close this issue.

Fix length requirement and dataType on getChainAccountRequestSchema LiskArchive/lisk-sdk
3 participants
@ishantiw @Phanco @Madhulearn