Uh oh!
There was an error while loading. Please reload this page.
fix(explorer): fetch_batch_data_pointer in explorer reads the entire response body without any limitation - #1198
Conversation
Uh oh!
There was an error while loading. Please reload this page.
uri-99
left a comment
There was a problem hiding this comment.
It would be best to have another state for the batch.
For this a new ecto migrate is needed, adding an is_valid bool to the batches table.
Also the schemas should be updated, and the value should be set to false if the batch is not valid.
Also in the frontend, invalid proofs should be shown a red invalid status.
| {:error, reason} -> | ||
| Logger.error("Error fetching batch content: #{inspect(reason)}") | ||
| # Returning something ensures we avoid attempting to fetch the invalid data again. | ||
| ["invalid batch"] |
There was a problem hiding this comment.
This string is converted to hex in frontend, better handle invalids in a cleaner way
There was a problem hiding this comment.
Changed to [<<0>>] to show 0x0 in the frontend for now. I'm solving this in a different PR in case we need to merge this one.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Co-authored-by: Urix <43704209+uri-99@users.noreply.github.com>
Motivation
The function
fetch_batch_data_pointerin the explorer reads the entire response body without anylimitations, which can lead to an OOM attack.
Description
Uses a
max_batch_sizelimit when reading request bodies.How to Test
See #1202
Closes#1016