fix(blocks): bound public block pagination offset (#9)

Author: NateIsern

server/index.ts

@@ -11,7 +11,7 @@ import path from 'path'
 import fs from 'fs'
 import { fileURLToPath } from 'url'
 import { blockCache } from './lib/cache'
-import { handleRouteError, parseNetwork, parseLimit, parseOffset, ValidationError } from './lib/http'
+import { handleRouteError, parseNetwork, parseLimit, parseOffset, parseBlockOffset, ValidationError } from './lib/http'
 import { computeCirculatingSupply, currentBlockReward } from './lib/supply'
 import { rpcWithNetwork } from '@fairco.in/rpc-client'
 import priceRouter from './routes/price'
@@ -122,7 +122,7 @@ app.get('/api/blocks', async (req, res) => {
   try {
     const network = parseNetwork(req.query.network)
     const limit = parseLimit(req.query.limit)
-    const offset = parseOffset(req.query.offset)
+    const offset = parseBlockOffset(req.query.offset)
     const [blocks, height] = await Promise.all([
       blockCache.getRecentBlocks(network, limit, offset),
       blockCache.getBlockCount(network),

server/lib/cache.ts

@@ -1,6 +1,6 @@
 import { MongoClient, Db } from 'mongodb'
 import { rpcWithNetwork, type NetworkType, type RpcParam } from '@fairco.in/rpc-client'
-import { escapeRegex } from './http'
+import { escapeRegex, MAX_BLOCK_OFFSET } from './http'
 
 const MONGODB_URI = process.env.MONGODB_URI || 'mongodb://localhost:27017/faircoin-explorer'
 
@@ -639,7 +639,7 @@ export class BlockCache extends BlockchainCache {
   // Get recent blocks with caching
   async getRecentBlocks(network: NetworkType, limit: number = 20, offset: number = 0): Promise<any[]> {
     assertValidNetwork(network)
-    const safeOffset = Math.max(0, Math.floor(offset))
+    const safeOffset = Math.min(MAX_BLOCK_OFFSET, Math.max(0, Math.floor(offset)))
     const safeLimit = Math.max(1, Math.floor(limit))
     const db = await this.getDb()
     const collection = db.collection('recent_blocks')

server/lib/http.test.ts

@@ -3,11 +3,13 @@ import {
   parseNetwork,
   parseLimit,
   parseOffset,
+  parseBlockOffset,
   parseAddress,
   escapeRegex,
   ValidationError,
   MIN_LIMIT,
   MAX_LIMIT,
+  MAX_BLOCK_OFFSET,
 } from './http'
 
 describe('parseNetwork', () => {
@@ -54,6 +56,14 @@ describe('parseOffset', () => {
   })
 })
 
+describe('parseBlockOffset', () => {
+  it('bounds public block pagination offsets', () => {
+    expect(parseBlockOffset('-10')).toBe(0)
+    expect(parseBlockOffset('25')).toBe(25)
+    expect(parseBlockOffset(String(MAX_BLOCK_OFFSET + 1))).toBe(MAX_BLOCK_OFFSET)
+  })
+})
+
 describe('parseAddress', () => {
   // A 34-char base58 address (valid shape).
   const validAddress = 'fVALIDADDRESSEEEEEEEEEEEEEEEEEEEEEE'.replace(/0|O|I|l/g, 'a')

server/lib/http.ts

@@ -16,6 +16,7 @@ import type { NetworkType } from '@fairco.in/rpc-client'
 /** Inclusive bounds for any list `limit` query parameter. */
 export const MIN_LIMIT = 1
 export const MAX_LIMIT = 100
+export const MAX_BLOCK_OFFSET = 10_000
 const DEFAULT_LIMIT = 20
 
 const NETWORKS = ['mainnet', 'testnet'] as const
@@ -69,8 +70,7 @@ export function parseLimit(value: unknown): number {
 }
 
 /**
- * Coerce the `offset` query parameter into a non-negative integer (no upper
- * bound — callers may legitimately page far back into the chain). Returns 0
+ * Coerce the `offset` query parameter into a non-negative integer. Returns 0
  * when absent or non-numeric; clamps negatives to 0.
  */
 export function parseOffset(value: unknown): number {
@@ -80,6 +80,15 @@ export function parseOffset(value: unknown): number {
   return Math.max(0, result.data)
 }
 
+/**
+ * Coerce the public block-list `offset` into a bounded range. Block windows are
+ * expensive to materialize on cache misses, so keeping this edge-bounded limits
+ * attacker-controlled recent-block cache keys and RPC walks.
+ */
+export function parseBlockOffset(value: unknown): number {
+  return Math.min(MAX_BLOCK_OFFSET, parseOffset(value))
+}
+
 /** Escape a string for safe interpolation into a MongoDB `$regex` pattern. */
 export function escapeRegex(value: string): string {
   return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')