fix: http wallet json_rpc route size limit#7324
fix: http wallet json_rpc route size limit#7324SWvheerden merged 1 commit intotari-project:developmentfrom
Conversation
WalkthroughThe maximum allowed request body size for the Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant HTTPServer
Client->>HTTPServer: POST /json_rpc (large payload)
HTTPServer-->>Client: Accepts payload up to 4 MiB
Assessment against linked issues
Possibly related PRs
Suggested reviewers
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
applications/minotari_node/src/http/server.rs (1)
80-80: Consider security implications and making the limit configurable.The 1000x increase in body limit (4 KiB → 4 MiB) for JSON-RPC requests is significant and could have security implications. While this change addresses the specific issue mentioned in the PR objectives, consider the following:
DoS Protection: Large payloads could be exploited for denial-of-service attacks. Ensure that downstream validation and processing can handle malicious large payloads appropriately.
Configuration: The hardcoded 4 MiB limit might benefit from being configurable via application settings to allow operators to tune based on their specific requirements.
Consider making this configurable:
- post(handler::json_rpc::handle::<B>).layer(DefaultBodyLimit::max(4 * 1024 * 1024)), // 4 MiB + post(handler::json_rpc::handle::<B>).layer(DefaultBodyLimit::max(config.json_rpc_max_body_size)), // Configurable limitAdditionally, ensure that the service layer validation (mentioned in the retrieved learnings) properly handles and validates larger JSON-RPC payloads to prevent resource exhaustion.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
applications/minotari_node/src/http/server.rs(1 hunks)
🧰 Additional context used
🧠 Learnings (2)
📓 Common learnings
Learnt from: ksrichard
PR: tari-project/tari#7129
File: applications/minotari_node/src/http/handler/sync_utxos_by_block.rs:21-29
Timestamp: 2025-05-29T20:59:32.020Z
Learning: In the Tari codebase, request validation for RPC services is handled at the service layer using the `serde_valid` crate rather than at the HTTP handler level. For example, `SyncUtxosByBlockRequest` validates that limit is between 1-5 and page is minimum 0. HTTP handlers should delegate validation to the service layer rather than implementing their own validation.
applications/minotari_node/src/http/server.rs (1)
Learnt from: ksrichard
PR: tari-project/tari#7129
File: applications/minotari_node/src/http/handler/sync_utxos_by_block.rs:21-29
Timestamp: 2025-05-29T20:59:32.020Z
Learning: In the Tari codebase, request validation for RPC services is handled at the service layer using the `serde_valid` crate rather than at the HTTP handler level. For example, `SyncUtxosByBlockRequest` validates that limit is between 1-5 and page is minimum 0. HTTP handlers should delegate validation to the service layer rather than implementing their own validation.
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)
- GitHub Check: Cucumber tests / FFI
- GitHub Check: test (mainnet, stagenet)
- GitHub Check: Cucumber tests / Base Layer
- GitHub Check: test (testnet, esmeralda)
- GitHub Check: test (nextnet, nextnet)
- GitHub Check: ci
- GitHub Check: cargo check with stable
hansieodendaal
changed the title
hansieodendaal
changed the title
hansieodendaal
changed the title
Test Results (CI) 3 files 135 suites 37m 55s ⏱️ Results for commit e110cc9. |
Test Results (Integration tests)1 tests 1 ✅ 0s ⏱️ For more details on these parsing errors, see this check. Results for commit e110cc9. |
3 participants
Description
Fixed http wallet json_rpc route size limit
Closes #7323
Motivation and Context
See above
How Has This Been Tested?
System-level testing succeeds
What process can a PR reviewer use to test or verify this change?
Breaking Changes
Summary by CodeRabbit
/json_rpcendpoint from 4 KiB to 4 MiB, enabling support for larger JSON-RPC payloads.