Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(dpp)!: data contract validation issues #1851

Merged
merged 7 commits into from
Jul 9, 2024

Conversation

shumkov
Copy link
Member

@shumkov shumkov commented May 21, 2024

Issue being fixed or feature implemented

Revisit Data Contract validation logic to make sure we don't have any potential vulnerabilities and bugs.

What was done?

  • Switched rs-jsonschema to the latest version of upstream instead of our forks. All required modifications were done there with additional fixes and optimizations.
  • Mitigated ReDoS attack. Based on feat: configure patterns regex engine Stranger6667/jsonschema#487
  • Removed unnecessary array-based rules from document meta schema since we do not support arrays for now (except byte arrays)
  • Compile document schema after validation against meta schema (compilation is heavier)
  • Removed unnecessary traversal validators since they are doing double work
  • Fixed an error when use still can use arrays but they will be encoded as booleans
  • Removed duplicated Value to JSON Value conversion

How Has This Been Tested?

With existing tests. Wrote unit tests for ByteArraay keyword.

Breaking Changes

Data Contract validation logic is changed so previously created blockchain data might not be valid.

Checklist:

  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have added or updated relevant unit/integration/functional/e2e tests
  • I have added "!" to the title and described breaking changes in the corresponding section if my code contains any
  • I have made corresponding changes to the documentation if needed

For repository code-owners and collaborators only

  • I have assigned this pull request to a milestone

@shumkov shumkov changed the title fix: Data Contract validation issues fix: data contract validation issues May 21, 2024
@shumkov shumkov changed the title fix: data contract validation issues fix(dpp): data contract validation issues May 21, 2024
@shumkov shumkov changed the title fix(dpp): data contract validation issues fix(dpp)!: data contract validation issues May 21, 2024
@shumkov shumkov added this to the v1.0.0 milestone May 22, 2024
@shumkov shumkov marked this pull request as ready for review May 22, 2024 09:02
@shumkov shumkov marked this pull request as draft July 1, 2024 13:54
@shumkov shumkov marked this pull request as ready for review July 1, 2024 13:54
QuantumExplorer
QuantumExplorer previously approved these changes Jul 1, 2024
@shumkov shumkov merged commit bff4b65 into v1.0-dev Jul 9, 2024
81 checks passed
@shumkov shumkov deleted the chore/dpp/data-contract-validation branch July 9, 2024 08:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants