diff options
| author | selsta <selsta@sent.at> | 2026-05-10 14:01:05 +0200 |
|---|---|---|
| committer | selsta <selsta@sent.at> | 2026-05-11 12:04:12 +0200 |
| commit | a16f514c67e95cec4946dc83dbad04ed1baad023 (patch) | |
| tree | fce83fb9e8b7a2a36abf82927755cb0f9a56305e | |
| parent | 3ca4c30f73fe22d16a46cfba122556437da3618d (diff) | |
| download | monzero-core-a16f514c67e95cec4946dc83dbad04ed1baad023.tar.gz monzero-core-a16f514c67e95cec4946dc83dbad04ed1baad023.tar.xz monzero-core-a16f514c67e95cec4946dc83dbad04ed1baad023.zip | |
rpc: reject invalid JSON-RPC ids in ZMQ requests
| -rw-r--r-- | src/rpc/message.cpp | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/src/rpc/message.cpp b/src/rpc/message.cpp index 005c40ea2..c7d79ef06 100644 --- a/src/rpc/message.cpp +++ b/src/rpc/message.cpp @@ -62,6 +62,17 @@ const rapidjson::Value& get_method_field(const rapidjson::Value& src) } } +void validate_id_field(const rapidjson::Value& src) +{ + const auto member = src.FindMember(id_field); + if (member == src.MemberEnd()) + return; + + // If present, JSON-RPC 2.0 request ids must be String, Number, or Null. + if (!member->value.IsString() && !member->value.IsNumber() && !member->value.IsNull()) + throw cryptonote::json::WRONG_TYPE{"Expected string, number or null"}; +} + void Message::toJson(rapidjson::Writer<epee::byte_stream>& dest) const { dest.StartObject(); @@ -92,6 +103,7 @@ FullMessage::FullMessage(std::string&& json_string, bool request) { get_method_field(doc); // throws on errors OBJECT_HAS_MEMBER_OR_THROW(doc, params_field) + validate_id_field(doc); } else { |