fix: cap electrum probe response lines

[piotr-iohk]

This PR caps Electrum probe response lines so a user-supplied endpoint cannot grow readLine() until the process OOMs.

Follow-up to the Greptile note on #1174: #1174 (comment)

We left it off the 2.4.1 hotfix on purpose. The risk is a local crash after the user taps Connect on an Electrum URL they typed or scanned — not remote, not funds, not unlock. soTimeout already covers a silent peer. This only bounds the remaining “stream bytes without a newline” case before the next store build.

Description

• Replaces unbounded readLine() in the Electrum probe with a 16 KiB byte-capped line read
• Treats an oversized or incomplete line as NotElectrum, same as any other failed handshake
• Adds coverage for the oversized-line path

Preview

N/A

QA Notes

Manual Tests

• 1. Settings → Electrum → Connect to a working server: probe succeeds and the node keeps the server.
• 2.regression: Settings → Electrum → Connect to a closed or non-Electrum port: still rejected, wallet stays up.

Automated Checks

• Unit tests added: oversized-line rejection and cause text in ElectrumProbeServiceTest.kt.

Made with Cursor

[greptile-apps]

Greptile Summary

The PR replaces the Electrum probe’s unbounded response-line read with a 16 KiB byte-capped reader, converting oversized or incomplete responses into the existing probe-failure path.

• Preserves LF and CRLF decoding while rejecting oversized, unterminated, and prematurely closed responses.
• Adds regression coverage for oversized response rejection and diagnostic cause text.
• Documents the crash-prevention fix in the security changelog.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete correctness, security, or test-lifecycle defect identified.

The bounded reader stops retaining bytes beyond the configured limit, preserves bytes for sequential requests, handles normal newline framing, and routes malformed responses through the existing NotElectrum result.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/ElectrumProbeService.kt	Introduces a bounded byte-level response reader while preserving sequential JSON-RPC framing and existing probe error handling.
app/src/test/java/to/bitkit/services/ElectrumProbeServiceTest.kt	Adds deterministic loopback coverage proving oversized response lines are rejected with the configured cap in the cause.
changelog.d/next/electrum-probe.security.md	Accurately records that oversized custom-server responses no longer crash the application.

_{Reviews (1): Last reviewed commit: "chore: add electrum probe changelog frag..." | Re-trigger Greptile}

[ovitrif]

utAck; looks good

[piotr-iohk]

This PR caps Electrum probe response lines so a user-supplied endpoint cannot grow readLine() until the process OOMs.

Follow-up to the Greptile note on #1174: #1174 (comment)

We left it off the 2.4.1 hotfix on purpose. The risk is a local crash after the user taps Connect on an Electrum URL they typed or scanned — not remote, not funds, not unlock. soTimeout already covers a silent peer. This only bounds the remaining “stream bytes without a newline” case before the next store build.

Description

• Replaces unbounded readLine() in the Electrum probe with a 16 KiB byte-capped line read
• Treats an oversized or incomplete line as NotElectrum, same as any other failed handshake
• Adds coverage for the oversized-line path

Preview

N/A

QA Notes

Manual Tests

• 1. Settings → Electrum → Connect to a working server: probe succeeds and the node keeps the server.
• 2.regression: Settings → Electrum → Connect to a closed or non-Electrum port: still rejected, wallet stays up.

Automated Checks

• Unit tests added: oversized-line rejection and cause text in ElectrumProbeServiceTest.kt.

Made with Cursor

[greptile-apps]

Greptile Summary

The PR replaces the Electrum probe’s unbounded response-line read with a 16 KiB byte-capped reader, converting oversized or incomplete responses into the existing probe-failure path.

• Preserves LF and CRLF decoding while rejecting oversized, unterminated, and prematurely closed responses.
• Adds regression coverage for oversized response rejection and diagnostic cause text.
• Documents the crash-prevention fix in the security changelog.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete correctness, security, or test-lifecycle defect identified.

The bounded reader stops retaining bytes beyond the configured limit, preserves bytes for sequential requests, handles normal newline framing, and routes malformed responses through the existing NotElectrum result.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/ElectrumProbeService.kt	Introduces a bounded byte-level response reader while preserving sequential JSON-RPC framing and existing probe error handling.
app/src/test/java/to/bitkit/services/ElectrumProbeServiceTest.kt	Adds deterministic loopback coverage proving oversized response lines are rejected with the configured cap in the cause.
changelog.d/next/electrum-probe.security.md	Accurately records that oversized custom-server responses no longer crash the application.

_{Reviews (1): Last reviewed commit: "chore: add electrum probe changelog frag..." | Re-trigger Greptile}

[ovitrif]

utAck; looks good

[piotr-iohk]

This PR caps Electrum probe response lines so a user-supplied endpoint cannot grow readLine() until the process OOMs.

Follow-up to the Greptile note on #1174: #1174 (comment)

We left it off the 2.4.1 hotfix on purpose. The risk is a local crash after the user taps Connect on an Electrum URL they typed or scanned — not remote, not funds, not unlock. soTimeout already covers a silent peer. This only bounds the remaining “stream bytes without a newline” case before the next store build.

Description

• Replaces unbounded readLine() in the Electrum probe with a 16 KiB byte-capped line read
• Treats an oversized or incomplete line as NotElectrum, same as any other failed handshake
• Adds coverage for the oversized-line path

Preview

N/A

QA Notes

Manual Tests

• 1. Settings → Electrum → Connect to a working server: probe succeeds and the node keeps the server.
• 2.regression: Settings → Electrum → Connect to a closed or non-Electrum port: still rejected, wallet stays up.

Automated Checks

• Unit tests added: oversized-line rejection and cause text in ElectrumProbeServiceTest.kt.

Made with Cursor

[greptile-apps]

Greptile Summary

The PR replaces the Electrum probe’s unbounded response-line read with a 16 KiB byte-capped reader, converting oversized or incomplete responses into the existing probe-failure path.

• Preserves LF and CRLF decoding while rejecting oversized, unterminated, and prematurely closed responses.
• Adds regression coverage for oversized response rejection and diagnostic cause text.
• Documents the crash-prevention fix in the security changelog.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete correctness, security, or test-lifecycle defect identified.

The bounded reader stops retaining bytes beyond the configured limit, preserves bytes for sequential requests, handles normal newline framing, and routes malformed responses through the existing NotElectrum result.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/ElectrumProbeService.kt	Introduces a bounded byte-level response reader while preserving sequential JSON-RPC framing and existing probe error handling.
app/src/test/java/to/bitkit/services/ElectrumProbeServiceTest.kt	Adds deterministic loopback coverage proving oversized response lines are rejected with the configured cap in the cause.
changelog.d/next/electrum-probe.security.md	Accurately records that oversized custom-server responses no longer crash the application.

_{Reviews (1): Last reviewed commit: "chore: add electrum probe changelog frag..." | Re-trigger Greptile}

[ovitrif]

utAck; looks good

[piotr-iohk]

This PR caps Electrum probe response lines so a user-supplied endpoint cannot grow readLine() until the process OOMs.

Follow-up to the Greptile note on #1174: #1174 (comment)

We left it off the 2.4.1 hotfix on purpose. The risk is a local crash after the user taps Connect on an Electrum URL they typed or scanned — not remote, not funds, not unlock. soTimeout already covers a silent peer. This only bounds the remaining “stream bytes without a newline” case before the next store build.

Description

• Replaces unbounded readLine() in the Electrum probe with a 16 KiB byte-capped line read
• Treats an oversized or incomplete line as NotElectrum, same as any other failed handshake
• Adds coverage for the oversized-line path

Preview

N/A

QA Notes

Manual Tests

• 1. Settings → Electrum → Connect to a working server: probe succeeds and the node keeps the server.
• 2.regression: Settings → Electrum → Connect to a closed or non-Electrum port: still rejected, wallet stays up.

Automated Checks

• Unit tests added: oversized-line rejection and cause text in ElectrumProbeServiceTest.kt.

Made with Cursor

[greptile-apps]

Greptile Summary

The PR replaces the Electrum probe’s unbounded response-line read with a 16 KiB byte-capped reader, converting oversized or incomplete responses into the existing probe-failure path.

• Preserves LF and CRLF decoding while rejecting oversized, unterminated, and prematurely closed responses.
• Adds regression coverage for oversized response rejection and diagnostic cause text.
• Documents the crash-prevention fix in the security changelog.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete correctness, security, or test-lifecycle defect identified.

The bounded reader stops retaining bytes beyond the configured limit, preserves bytes for sequential requests, handles normal newline framing, and routes malformed responses through the existing NotElectrum result.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/ElectrumProbeService.kt	Introduces a bounded byte-level response reader while preserving sequential JSON-RPC framing and existing probe error handling.
app/src/test/java/to/bitkit/services/ElectrumProbeServiceTest.kt	Adds deterministic loopback coverage proving oversized response lines are rejected with the configured cap in the cause.
changelog.d/next/electrum-probe.security.md	Accurately records that oversized custom-server responses no longer crash the application.

_{Reviews (1): Last reviewed commit: "chore: add electrum probe changelog frag..." | Re-trigger Greptile}

[ovitrif]

utAck; looks good

[piotr-iohk]

This PR caps Electrum probe response lines so a user-supplied endpoint cannot grow readLine() until the process OOMs.

Follow-up to the Greptile note on #1174: #1174 (comment)

We left it off the 2.4.1 hotfix on purpose. The risk is a local crash after the user taps Connect on an Electrum URL they typed or scanned — not remote, not funds, not unlock. soTimeout already covers a silent peer. This only bounds the remaining “stream bytes without a newline” case before the next store build.

Description

• Replaces unbounded readLine() in the Electrum probe with a 16 KiB byte-capped line read
• Treats an oversized or incomplete line as NotElectrum, same as any other failed handshake
• Adds coverage for the oversized-line path

Preview

N/A

QA Notes

Manual Tests

• 1. Settings → Electrum → Connect to a working server: probe succeeds and the node keeps the server.
• 2.regression: Settings → Electrum → Connect to a closed or non-Electrum port: still rejected, wallet stays up.

Automated Checks

• Unit tests added: oversized-line rejection and cause text in ElectrumProbeServiceTest.kt.

Made with Cursor

[greptile-apps]

Greptile Summary

The PR replaces the Electrum probe’s unbounded response-line read with a 16 KiB byte-capped reader, converting oversized or incomplete responses into the existing probe-failure path.

• Preserves LF and CRLF decoding while rejecting oversized, unterminated, and prematurely closed responses.
• Adds regression coverage for oversized response rejection and diagnostic cause text.
• Documents the crash-prevention fix in the security changelog.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete correctness, security, or test-lifecycle defect identified.

The bounded reader stops retaining bytes beyond the configured limit, preserves bytes for sequential requests, handles normal newline framing, and routes malformed responses through the existing NotElectrum result.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/ElectrumProbeService.kt	Introduces a bounded byte-level response reader while preserving sequential JSON-RPC framing and existing probe error handling.
app/src/test/java/to/bitkit/services/ElectrumProbeServiceTest.kt	Adds deterministic loopback coverage proving oversized response lines are rejected with the configured cap in the cause.
changelog.d/next/electrum-probe.security.md	Accurately records that oversized custom-server responses no longer crash the application.

_{Reviews (1): Last reviewed commit: "chore: add electrum probe changelog frag..." | Re-trigger Greptile}

[ovitrif]

utAck; looks good

[piotr-iohk]

This PR caps Electrum probe response lines so a user-supplied endpoint cannot grow readLine() until the process OOMs.

Follow-up to the Greptile note on #1174: #1174 (comment)

We left it off the 2.4.1 hotfix on purpose. The risk is a local crash after the user taps Connect on an Electrum URL they typed or scanned — not remote, not funds, not unlock. soTimeout already covers a silent peer. This only bounds the remaining “stream bytes without a newline” case before the next store build.

Description

• Replaces unbounded readLine() in the Electrum probe with a 16 KiB byte-capped line read
• Treats an oversized or incomplete line as NotElectrum, same as any other failed handshake
• Adds coverage for the oversized-line path

Preview

N/A

QA Notes

Manual Tests

• 1. Settings → Electrum → Connect to a working server: probe succeeds and the node keeps the server.
• 2.regression: Settings → Electrum → Connect to a closed or non-Electrum port: still rejected, wallet stays up.

Automated Checks

• Unit tests added: oversized-line rejection and cause text in ElectrumProbeServiceTest.kt.

Made with Cursor

[greptile-apps]

Greptile Summary

The PR replaces the Electrum probe’s unbounded response-line read with a 16 KiB byte-capped reader, converting oversized or incomplete responses into the existing probe-failure path.

• Preserves LF and CRLF decoding while rejecting oversized, unterminated, and prematurely closed responses.
• Adds regression coverage for oversized response rejection and diagnostic cause text.
• Documents the crash-prevention fix in the security changelog.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete correctness, security, or test-lifecycle defect identified.

The bounded reader stops retaining bytes beyond the configured limit, preserves bytes for sequential requests, handles normal newline framing, and routes malformed responses through the existing NotElectrum result.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/ElectrumProbeService.kt	Introduces a bounded byte-level response reader while preserving sequential JSON-RPC framing and existing probe error handling.
app/src/test/java/to/bitkit/services/ElectrumProbeServiceTest.kt	Adds deterministic loopback coverage proving oversized response lines are rejected with the configured cap in the cause.
changelog.d/next/electrum-probe.security.md	Accurately records that oversized custom-server responses no longer crash the application.

_{Reviews (1): Last reviewed commit: "chore: add electrum probe changelog frag..." | Re-trigger Greptile}

[ovitrif]

utAck; looks good

[piotr-iohk]

This PR caps Electrum probe response lines so a user-supplied endpoint cannot grow readLine() until the process OOMs.

Follow-up to the Greptile note on #1174: #1174 (comment)

We left it off the 2.4.1 hotfix on purpose. The risk is a local crash after the user taps Connect on an Electrum URL they typed or scanned — not remote, not funds, not unlock. soTimeout already covers a silent peer. This only bounds the remaining “stream bytes without a newline” case before the next store build.

Description

• Replaces unbounded readLine() in the Electrum probe with a 16 KiB byte-capped line read
• Treats an oversized or incomplete line as NotElectrum, same as any other failed handshake
• Adds coverage for the oversized-line path

Preview

N/A

QA Notes

Manual Tests

• 1. Settings → Electrum → Connect to a working server: probe succeeds and the node keeps the server.
• 2.regression: Settings → Electrum → Connect to a closed or non-Electrum port: still rejected, wallet stays up.

Automated Checks

• Unit tests added: oversized-line rejection and cause text in ElectrumProbeServiceTest.kt.

Made with Cursor

[greptile-apps]

Greptile Summary

The PR replaces the Electrum probe’s unbounded response-line read with a 16 KiB byte-capped reader, converting oversized or incomplete responses into the existing probe-failure path.

• Preserves LF and CRLF decoding while rejecting oversized, unterminated, and prematurely closed responses.
• Adds regression coverage for oversized response rejection and diagnostic cause text.
• Documents the crash-prevention fix in the security changelog.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete correctness, security, or test-lifecycle defect identified.

The bounded reader stops retaining bytes beyond the configured limit, preserves bytes for sequential requests, handles normal newline framing, and routes malformed responses through the existing NotElectrum result.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/ElectrumProbeService.kt	Introduces a bounded byte-level response reader while preserving sequential JSON-RPC framing and existing probe error handling.
app/src/test/java/to/bitkit/services/ElectrumProbeServiceTest.kt	Adds deterministic loopback coverage proving oversized response lines are rejected with the configured cap in the cause.
changelog.d/next/electrum-probe.security.md	Accurately records that oversized custom-server responses no longer crash the application.

_{Reviews (1): Last reviewed commit: "chore: add electrum probe changelog frag..." | Re-trigger Greptile}

[ovitrif]

utAck; looks good

[piotr-iohk]

This PR caps Electrum probe response lines so a user-supplied endpoint cannot grow readLine() until the process OOMs.

Follow-up to the Greptile note on #1174: #1174 (comment)

We left it off the 2.4.1 hotfix on purpose. The risk is a local crash after the user taps Connect on an Electrum URL they typed or scanned — not remote, not funds, not unlock. soTimeout already covers a silent peer. This only bounds the remaining “stream bytes without a newline” case before the next store build.

Description

• Replaces unbounded readLine() in the Electrum probe with a 16 KiB byte-capped line read
• Treats an oversized or incomplete line as NotElectrum, same as any other failed handshake
• Adds coverage for the oversized-line path

Preview

N/A

QA Notes

Manual Tests

• 1. Settings → Electrum → Connect to a working server: probe succeeds and the node keeps the server.
• 2.regression: Settings → Electrum → Connect to a closed or non-Electrum port: still rejected, wallet stays up.

Automated Checks

• Unit tests added: oversized-line rejection and cause text in ElectrumProbeServiceTest.kt.

Made with Cursor

[greptile-apps]

Greptile Summary

The PR replaces the Electrum probe’s unbounded response-line read with a 16 KiB byte-capped reader, converting oversized or incomplete responses into the existing probe-failure path.

• Preserves LF and CRLF decoding while rejecting oversized, unterminated, and prematurely closed responses.
• Adds regression coverage for oversized response rejection and diagnostic cause text.
• Documents the crash-prevention fix in the security changelog.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete correctness, security, or test-lifecycle defect identified.

The bounded reader stops retaining bytes beyond the configured limit, preserves bytes for sequential requests, handles normal newline framing, and routes malformed responses through the existing NotElectrum result.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/ElectrumProbeService.kt	Introduces a bounded byte-level response reader while preserving sequential JSON-RPC framing and existing probe error handling.
app/src/test/java/to/bitkit/services/ElectrumProbeServiceTest.kt	Adds deterministic loopback coverage proving oversized response lines are rejected with the configured cap in the cause.
changelog.d/next/electrum-probe.security.md	Accurately records that oversized custom-server responses no longer crash the application.

_{Reviews (1): Last reviewed commit: "chore: add electrum probe changelog frag..." | Re-trigger Greptile}

[ovitrif]

utAck; looks good