Skip to content

Commit

Permalink
fix(security): address CVE-2021-23358
Browse files Browse the repository at this point in the history 
fixes: hyperledger-cacti#1775
Signed-off-by: zondervancalvez <[email protected]>
  • Loading branch information
@zondervancalvez @petermetz
zondervancalvez authored and petermetz committed Mar 29, 2022
1 parent 92a48e7 commit 75849db
Show file tree
Hide file tree
Showing 16 changed files with 656 additions and 127 deletions.
2 changes: 1 addition & 1 deletion packages/cactus-plugin-htlc-eth-besu/package.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@
"openapi-types": "9.1.0",
"typescript-optional": "2.0.1",
"web3": "1.5.2",
"web3-eea": "0.11.0"
"web3js-quorum": "21.7.0-rc1"
},
"devDependencies": {
"@hyperledger/cactus-plugin-keychain-memory": "1.0.0",
Expand Down
4 changes: 2 additions & 2 deletions packages/cactus-plugin-ledger-connector-besu/package.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -67,9 +67,9 @@
"typescript-optional": "2.0.1",
"web3": "1.5.2",
"web3-core": "1.5.2",
"web3-eea": "0.11.0",
"web3-eth": "1.5.2",
"web3-utils": "1.5.2"
"web3-utils": "1.5.2",
"web3js-quorum": "21.7.0-rc1"
},
"devDependencies": {
"@hyperledger/cactus-plugin-keychain-memory": "1.0.0",
Expand Down
34 changes: 18 additions & 16 deletions ...s/cactus-plugin-ledger-connector-besu/src/main/typescript/plugin-ledger-connector-besu.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,8 @@ import OAS from "../json/openapi.json";
import Web3 from "web3";

import type { WebsocketProvider } from "web3-core";
import EEAClient, { ICallOptions, IWeb3InstanceExtended } from "web3-eea";
//import EEAClient, { ICallOptions, IWeb3InstanceExtended } from "web3-eea";
import Web3JsQuorum, { IWeb3Quorum } from "web3js-quorum";

import { Contract, ContractSendMethod } from "web3-eth-contract";
import { TransactionReceipt } from "web3-eth";
Expand Down Expand Up @@ -120,7 +121,7 @@ export class PluginLedgerConnectorBesu
private readonly log: Logger;
private readonly web3Provider: WebsocketProvider;
private readonly web3: Web3;
private web3EEA: IWeb3InstanceExtended | undefined;
private web3Quorum: IWeb3Quorum | undefined;
private readonly pluginRegistry: PluginRegistry;
private contracts: {
[name: string]: Contract;
Expand Down Expand Up @@ -183,8 +184,7 @@ export class PluginLedgerConnectorBesu
}

public async onPluginInit(): Promise<void> {
const chainId = await this.web3.eth.getChainId();
this.web3EEA = EEAClient(this.web3, chainId);
this.web3Quorum = Web3JsQuorum(this.web3);
}

public async shutdown(): Promise<void> {
Expand Down Expand Up @@ -471,18 +471,19 @@ export class PluginLedgerConnectorBesu
privateKey: privKey,
privateFor: req.privateTransactionConfig.privateFor,
};
if (!this.web3EEA) {
throw new RuntimeError(`InvalidState: web3EEA not initialized.`);
if (!this.web3Quorum) {
throw new RuntimeError(`InvalidState: web3Quorum not initialized.`);
}

const privacyGroupId = this.web3EEA.priv.generatePrivacyGroup(fnParams);
const privacyGroupId = this.web3Quorum.utils.generatePrivacyGroup(
fnParams,
);
this.log.debug("Generated privacyGroupId: ", privacyGroupId);
callOutput = await this.web3EEA.priv.call({
privacyGroupId,
callOutput = await this.web3Quorum.priv.call(privacyGroupId, {
to: contractInstance.options.address,
data,
// TODO: Update the "from" property of ICallOptions to be optional
} as ICallOptions);
});

success = true;
this.log.debug(`Web3 EEA Call output: `, callOutput);
Expand Down Expand Up @@ -636,11 +637,13 @@ export class PluginLedgerConnectorBesu
public async transactPrivate(options: any): Promise<RunTransactionResponse> {
const fnTag = `${this.className}#transactPrivate()`;

if (!this.web3EEA) {
if (!this.web3Quorum) {
throw new Error(`${fnTag} Web3 EEA client not initialized.`);
}

const txHash = await this.web3EEA.eea.sendRawTransaction(options);
const txHash = await this.web3Quorum.priv.generateAndSendRawTransaction(
options,
);

if (!txHash) {
throw new Error(`${fnTag} eea.sendRawTransaction provided no tx hash.`);
Expand All @@ -654,13 +657,12 @@ export class PluginLedgerConnectorBesu
): Promise<RunTransactionResponse> {
const fnTag = `${this.className}#getPrivateTxReceipt()`;

if (!this.web3EEA) {
throw new Error(`${fnTag} Web3 EEA client not initialized.`);
if (!this.web3Quorum) {
throw new Error(`${fnTag} Web3 Quorum client not initialized.`);
}

const txPoolReceipt = await this.web3EEA.priv.getTransactionReceipt(
const txPoolReceipt = await this.web3Quorum.priv.waitForTransactionReceipt(
txHash,
privateFrom,
);
if (!txPoolReceipt) {
throw new RuntimeError(`priv.getTransactionReceipt provided no receipt.`);
Expand Down
68 changes: 32 additions & 36 deletions ...in-ledger-connector-besu/deploy-contract/private-deploy-contract-from-json-cactus.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ import test, { Test } from "tape-promise/tape";
import { v4 as uuidv4 } from "uuid";
import HelloWorldContractJson from "../../../../solidity/hello-world-contract/HelloWorld.json";
import Web3 from "web3";
import Web3EEAClient, { IPrivateTransactionReceipt } from "web3-eea";
import Web3JsQuorum, { IPrivateTransactionReceipt } from "web3js-quorum";
import { BesuMpTestLedger } from "@hyperledger/cactus-test-tooling";
import { LogLevelDesc } from "@hyperledger/cactus-common";
import {
Expand Down Expand Up @@ -189,14 +189,14 @@ test(testCase, async (t: Test) => {
const chainIdMember3 = await web3Member3.eth.getChainId();
t.comment(`chainIdMember3=${chainIdMember3}`);

const web3EeaMember1 = Web3EEAClient(web3Member1, chainIdMember1);
t.ok(web3EeaMember1, "web3EeaMember1 truthy OK");
const web3QuorumMember1 = Web3JsQuorum(web3Member1);
t.ok(web3QuorumMember1, "web3QuorumMember1 truthy OK");

const web3EeaMember2 = Web3EEAClient(web3Member2, chainIdMember2);
t.ok(web3EeaMember2, "web3EeaMember2 truthy OK");
const web3QuorumMember2 = Web3JsQuorum(web3Member2);
t.ok(web3QuorumMember2, "web3QuorumMember2 truthy OK");

const web3EeaMember3 = Web3EEAClient(web3Member3, chainIdMember3);
t.ok(web3EeaMember3, "web3EeaMember3 truthy OK");
const web3QuorumMember3 = Web3JsQuorum(web3Member3);
t.ok(web3QuorumMember3, "web3QuorumMember3 truthy OK");

const deployRes = await connector1.deployContract({
bytecode: HelloWorldContractJson.bytecode,
Expand Down Expand Up @@ -239,9 +239,8 @@ test(testCase, async (t: Test) => {

// t.ok(privacyMarkerTxHash, "privacyMarkerTxHash truthy OK");

const contractDeployReceipt = (await web3EeaMember1.priv.getTransactionReceipt(
const contractDeployReceipt = (await web3QuorumMember1.priv.waitForTransactionReceipt(
deployRes.transactionReceipt.commitmentHash,
keys.tessera.member1.publicKey,
)) as IPrivateTransactionReceipt;

t.ok(contractDeployReceipt, "contractDeployReceipt truthy OK");
Expand All @@ -253,29 +252,26 @@ test(testCase, async (t: Test) => {

// Check that the third node does not see the transaction of the contract
// deployment that was sent to node 1 and 2 only, not 3.
const txReceiptNever = await web3EeaMember3.priv.getTransactionReceipt(
const txReceiptNever = await web3QuorumMember3.priv.waitForTransactionReceipt(
deployRes.transactionReceipt.commitmentHash,
keys.tessera.member3.publicKey,
);
t.notok(txReceiptNever, "txReceiptNever falsy OK");

// Check that node 1 and 2 can indeed see the transaction for the contract
// deployment that was sent to them and them only (node 3 was left out)

// Note that changing this to use web3EeaMember3 breaks it and I'm suspecting
// Note that changing this to use web3QuorumMember3 breaks it and I'm suspecting
// that this is what's plaguing the tests that are based on the connector
// which is instantiated with a single web3+web3 EEA client.
// What I will try next is to have 3 connectors each with a web3 EEA client
// which is instantiated with a single web3+web3 Quorum client.
// What I will try next is to have 3 connectors each with a web3 Quorum client
// that points to one of the 3 nodes and see if that makes it work.
const txReceiptAlways1 = await web3EeaMember1.priv.getTransactionReceipt(
const txReceiptAlways1 = await web3QuorumMember1.priv.waitForTransactionReceipt(
deployRes.transactionReceipt.commitmentHash,
keys.tessera.member1.publicKey,
);
t.ok(txReceiptAlways1, "txReceiptAlways1 truthy OK");

const txReceiptAlways2 = await web3EeaMember2.priv.getTransactionReceipt(
const txReceiptAlways2 = await web3QuorumMember2.priv.waitForTransactionReceipt(
deployRes.transactionReceipt.commitmentHash,
keys.tessera.member2.publicKey,
);
t.ok(txReceiptAlways2, "txReceiptAlways2 truthy OK");

Expand All @@ -293,15 +289,14 @@ test(testCase, async (t: Test) => {
privateFor: [keys.tessera.member2.publicKey],
privateKey: keys.besu.member1.privateKey,
};
const transactionHash = await web3EeaMember1.eea.sendRawTransaction(
const transactionHash = await web3QuorumMember1.priv.generateAndSendRawTransaction(
functionParams,
);
t.comment(`Transaction hash: ${transactionHash}`);
t.ok(transactionHash, "transactionHash truthy OK");

const result = await web3EeaMember1.priv.getTransactionReceipt(
const result = await web3QuorumMember1.priv.waitForTransactionReceipt(
transactionHash,
keys.tessera.member1.publicKey,
);
t.comment(`Transaction receipt for set() call: ${JSON.stringify(result)}`);
t.ok(result, "set() result member 1 truthy OK");
Expand All @@ -318,16 +313,19 @@ test(testCase, async (t: Test) => {
privateKey: keys.besu.member1.privateKey,
};

const privacyGroupId = web3EeaMember1.priv.generatePrivacyGroup(fnParams);
const callOutput = await web3EeaMember1.priv.call({
privacyGroupId,
const privacyGroupId = web3QuorumMember1.utils.generatePrivacyGroup(
fnParams,
);
const callOutput = await web3QuorumMember1.priv.call(privacyGroupId, {
to: contractDeployReceipt.contractAddress,
data: contract.methods.getName().encodeABI(),
from: "LieutenantCactus",
});
t.comment(`getName Call output: ${JSON.stringify(callOutput)}`);
t.ok(callOutput, "callOutput truthy OK");
const name = web3EeaMember1.eth.abi.decodeParameter("string", callOutput);
const name = web3QuorumMember1.eth.abi.decodeParameter(
"string",
callOutput,
);
t.equal(name, "ProfessorCactus - #1", "getName() member 1 equals #1");
}

Expand All @@ -344,12 +342,12 @@ test(testCase, async (t: Test) => {
privateKey: keys.besu.member3.privateKey,
};

const privacyGroupId = web3EeaMember3.priv.generatePrivacyGroup(fnParams);
const callOutput = await web3EeaMember3.priv.call({
privacyGroupId,
const privacyGroupId = web3QuorumMember3.utils.generatePrivacyGroup(
fnParams,
);
const callOutput = await web3QuorumMember3.priv.call(privacyGroupId, {
to: contractDeployReceipt.contractAddress,
data,
from: "LieutenantCactus",
});
t.comment(`getName member3 output: ${JSON.stringify(callOutput)}`);
t.equal(callOutput, "0x", "member3 getName callOutput === 0x OK");
Expand All @@ -365,15 +363,14 @@ test(testCase, async (t: Test) => {
privateFor: [keys.tessera.member2.publicKey],
privateKey: keys.besu.member2.privateKey,
};
const transactionHash = await web3EeaMember2.eea.sendRawTransaction(
const transactionHash = await web3QuorumMember2.priv.generateAndSendRawTransaction(
functionParams,
);
t.comment(`Transaction hash: ${transactionHash}`);
t.ok(transactionHash, "transactionHash truthy OK");

const result = await web3EeaMember2.priv.getTransactionReceipt(
const result = await web3QuorumMember2.priv.waitForTransactionReceipt(
transactionHash,
keys.tessera.member1.publicKey,
);
t.comment(`Transaction receipt for set() call: ${JSON.stringify(result)}`);
t.ok(result, "set() result member 2 truthy OK");
Expand All @@ -389,15 +386,14 @@ test(testCase, async (t: Test) => {
privateKey: keys.besu.member3.privateKey,
privateFor: [keys.tessera.member2.publicKey],
};
const transactionHash = await web3EeaMember3.eea.sendRawTransaction(
const transactionHash = await web3QuorumMember3.priv.generateAndSendRawTransaction(
functionParams,
);
t.comment(`setName tx hash for member 3: ${transactionHash}`);
t.ok(transactionHash, "setName tx hash for member 3 truthy OK");

const result = await web3EeaMember3.priv.getTransactionReceipt(
const result = await web3QuorumMember3.priv.waitForTransactionReceipt(
transactionHash,
keys.tessera.member1.publicKey,
);
t.comment(`Transaction receipt for set() call: ${JSON.stringify(result)}`);
t.ok(result, "set() result for member 3 truthy OK");
Expand Down
Loading

0 comments on commit 75849db

Please sign in to comment.