algorand / algorand/go-algorand
Unlimited transaction decoding on transaction submission
Offen
Security
- Vorherrschende Sprache
- Go
- Sterne
- 1.4k
- Forks
- 537
- Ø Merge
- 1 T. 6 Std.
- Gemergte PRs (30 T.)
- 17
Beschreibung
### Subject of the issue
The `POST /v*/transactions` will currently decode transactions off of the wire until the client stops sending them. This is an easy DoS vector, since we'll just keep filling up memory until the client stops.
### Your environment
Still applies as of commit `a204c43c228baf1bb5c1854a236332b873fae477`
### Steps to reproduce
Submit an endless stream of transactions to the `/v*/transactions` endpoint.
### Expected behaviour
We should stop reading transactions after we determine there is no possibility the group could be valid.
### Actual behaviour
We will read them all.
Beitragsleitfaden
Bewertung
Dieses Issue wurde noch nicht bewertet.