Skip to content

Commit 2965556

Browse files
SurbhiAgarwal1SurbhiAgarwal1
committed
security: enforce strict input validation and payload bounds in tokens.Service
This commit implements a comprehensive security validation layer to mitigate resource exhaustion and DoS risks. - Refactored Validator layer to serve as the primary enforcement point for payload and action constraints before transaction commitment. - Updated ValidationConfig to incorporate configurable limits for total token request size and action counts. - Added strict protobuf unmarshaling bounds in driver/request.go for all message types. - Propagated configurable validation limits through TMS and service layers for consistent enforcement. - Updated validator mocks and test suites to verify new security bounds. Fixes #1608 Signed-off-by: SurbhiAgarwal1 <agarwalsurbhi1807@gmail.com>
1 parent f96ff8b commit 2965556

11 files changed

Lines changed: 516 additions & 5 deletions

File tree

‎token/config.go‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,24 @@ func (m *Configuration) IsSet(key string) bool {
2929
func (m *Configuration) UnmarshalKey(key string, rawVal interface{}) error {
3030
return m.cm.UnmarshalKey(key, rawVal)
3131
}
32+
33+
// GetValidationConfig returns the validation configuration
34+
func (m *Configuration) GetValidationConfig() (driver.ValidationConfig, error) {
35+
config := driver.ValidationConfig{
36+
MaxTokenPayloadSize: 2 * 1024 * 1024,
37+
MaxTokenOutputsPerTx: 1000,
38+
MaxBulkDeleteSize: 10000,
39+
MaxWalletIDSize: 1024,
40+
MaxOwnerRawSize: 16 * 1024,
41+
MaxIssuerRawSize: 16 * 1024,
42+
MaxTokenRequestSize: 2 * 1024 * 1024,
43+
MaxActionCount: 1000,
44+
}
45+
if m.cm.IsSet("validation") {
46+
if err := m.cm.UnmarshalKey("validation", &config); err != nil {
47+
return config, err
48+
}
49+
}
50+
51+
return config, nil
52+
}

‎token/core/common/validator.go‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,9 @@ type Validator[P driver.PublicParameters, T driver.Input, TA driver.TransferActi
7272
// If set to a specific version (e.g., driver.ProtocolV2), only requests with that version
7373
// or higher will be accepted, rejecting older protocol versions.
7474
MinProtocolVersion uint32
75+
76+
// ValidationConfig specifies the resource limits for token requests.
77+
ValidationConfig driver.ValidationConfig
7578
}
7679

7780
// NewValidator returns a new Validator instance for the passed arguments.
@@ -92,6 +95,16 @@ func NewValidator[P driver.PublicParameters, T driver.Input, TA driver.TransferA
9295
TransferValidators: transferValidators,
9396
IssueValidators: issueValidators,
9497
AuditingValidators: auditingValidators,
98+
ValidationConfig: driver.ValidationConfig{
99+
MaxTokenPayloadSize: 2 * 1024 * 1024,
100+
MaxTokenOutputsPerTx: 1000,
101+
MaxBulkDeleteSize: 10000,
102+
MaxWalletIDSize: 1024,
103+
MaxOwnerRawSize: 16 * 1024,
104+
MaxIssuerRawSize: 16 * 1024,
105+
MaxTokenRequestSize: 2 * 1024 * 1024,
106+
MaxActionCount: 1000,
107+
},
95108
}
96109
}
97110

@@ -102,18 +115,30 @@ func (v *Validator[P, T, TA, IA, DS]) SetMinProtocolVersion(version uint32) {
102115
v.MinProtocolVersion = version
103116
}
104117

118+
// SetValidationConfig configures the validation limits for the validator.
119+
func (v *Validator[P, T, TA, IA, DS]) SetValidationConfig(config driver.ValidationConfig) {
120+
v.ValidationConfig = config
121+
}
122+
105123
// VerifyTokenRequestFromRaw verifies a token request from its raw representation.
106124
func (v *Validator[P, T, TA, IA, DS]) VerifyTokenRequestFromRaw(ctx context.Context, getState driver.GetStateFnc, anchor driver.TokenRequestAnchor, raw []byte) ([]interface{}, driver.ValidationAttributes, error) {
107125
logger.DebugfContext(ctx, "Verify token request from raw")
108126
if len(raw) == 0 {
109127
return nil, nil, errors.New("empty token request")
110128
}
129+
if v.ValidationConfig.MaxTokenRequestSize > 0 && len(raw) > v.ValidationConfig.MaxTokenRequestSize {
130+
return nil, nil, errors.Errorf("token request too large: %d > %d", len(raw), v.ValidationConfig.MaxTokenRequestSize)
131+
}
111132
tr := &driver.TokenRequest{}
112133
err := tr.FromBytes(raw)
113134
if err != nil {
114135
return nil, nil, errors.Wrap(err, "failed to unmarshal token request")
115136
}
116137

138+
if v.ValidationConfig.MaxActionCount > 0 && len(tr.Issues)+len(tr.Transfers) > v.ValidationConfig.MaxActionCount {
139+
return nil, nil, errors.Errorf("too many actions: %d > %d", len(tr.Issues)+len(tr.Transfers), v.ValidationConfig.MaxActionCount)
140+
}
141+
117142
// Validate protocol version
118143
if tr.Version == 0 {
119144
return nil, nil, driver.ErrInvalidVersion
@@ -172,6 +197,18 @@ func (v *Validator[P, T, TA, IA, DS]) VerifyTokenRequest(
172197
if err != nil {
173198
return nil, nil, errors.Wrapf(err, "failed to verify issue actions [%s]", anchor)
174199
}
200+
201+
totalOutputs := 0
202+
for _, action := range ia {
203+
totalOutputs += action.NumOutputs()
204+
}
205+
for _, action := range ta {
206+
totalOutputs += action.NumOutputs()
207+
}
208+
if v.ValidationConfig.MaxTokenOutputsPerTx > 0 && totalOutputs > v.ValidationConfig.MaxTokenOutputsPerTx {
209+
return nil, nil, errors.Errorf("too many token outputs: %d > %d", totalOutputs, v.ValidationConfig.MaxTokenOutputsPerTx)
210+
}
211+
175212
err = v.verifyTransfers(ctx, anchor, tr, ledger, ta, signatureProvider, attributes)
176213
if err != nil {
177214
return nil, nil, errors.Wrapf(err, "failed to verify transfer actions [%s]", anchor)
@@ -251,6 +288,27 @@ func (v *Validator[P, T, TA, IA, DS]) VerifyIssue(
251288
MetadataCounter: map[string]int{},
252289
Attributes: attributes,
253290
}
291+
292+
// Check outputs
293+
if v.ValidationConfig.MaxTokenPayloadSize > 0 || v.ValidationConfig.MaxOwnerRawSize > 0 {
294+
outputs := action.GetOutputs()
295+
for i, output := range outputs {
296+
raw, err := output.Serialize()
297+
if err != nil {
298+
return errors.Wrapf(err, "failed to serialize output at index %d", i)
299+
}
300+
if v.ValidationConfig.MaxTokenPayloadSize > 0 && len(raw) > v.ValidationConfig.MaxTokenPayloadSize {
301+
return errors.Errorf("output payload too large at index %d: %d > %d", i, len(raw), v.ValidationConfig.MaxTokenPayloadSize)
302+
}
303+
if v.ValidationConfig.MaxOwnerRawSize > 0 && len(output.GetOwner()) > v.ValidationConfig.MaxOwnerRawSize {
304+
return errors.Errorf("owner raw too large at index %d: %d > %d", i, len(output.GetOwner()), v.ValidationConfig.MaxOwnerRawSize)
305+
}
306+
}
307+
}
308+
if v.ValidationConfig.MaxIssuerRawSize > 0 && len(action.GetIssuer()) > v.ValidationConfig.MaxIssuerRawSize {
309+
return errors.Errorf("issuer raw too large: %d > %d", len(action.GetIssuer()), v.ValidationConfig.MaxIssuerRawSize)
310+
}
311+
254312
for _, v := range v.IssueValidators {
255313
if err := v(ctx, context); err != nil {
256314
return err
@@ -314,6 +372,27 @@ func (v *Validator[P, T, TA, IA, DS]) VerifyTransfer(
314372
MetadataCounter: map[MetadataCounterID]int{},
315373
Attributes: attributes,
316374
}
375+
376+
// Check outputs
377+
if v.ValidationConfig.MaxTokenPayloadSize > 0 || v.ValidationConfig.MaxOwnerRawSize > 0 {
378+
outputs := action.GetOutputs()
379+
for i, output := range outputs {
380+
raw, err := output.Serialize()
381+
if err != nil {
382+
return errors.Wrapf(err, "failed to serialize output at index %d", i)
383+
}
384+
if v.ValidationConfig.MaxTokenPayloadSize > 0 && len(raw) > v.ValidationConfig.MaxTokenPayloadSize {
385+
return errors.Errorf("output payload too large at index %d: %d > %d", i, len(raw), v.ValidationConfig.MaxTokenPayloadSize)
386+
}
387+
if v.ValidationConfig.MaxOwnerRawSize > 0 && len(output.GetOwner()) > v.ValidationConfig.MaxOwnerRawSize {
388+
return errors.Errorf("owner raw too large at index %d: %d > %d", i, len(output.GetOwner()), v.ValidationConfig.MaxOwnerRawSize)
389+
}
390+
}
391+
}
392+
if v.ValidationConfig.MaxIssuerRawSize > 0 && len(action.GetIssuer()) > v.ValidationConfig.MaxIssuerRawSize {
393+
return errors.Errorf("issuer raw too large: %d > %d", len(action.GetIssuer()), v.ValidationConfig.MaxIssuerRawSize)
394+
}
395+
317396
for _, v := range v.TransferValidators {
318397
if err := v(ctx, context); err != nil {
319398
return err

‎token/core/common/validator_test.go‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,32 @@ func TestValidatorWithCounterfeiter(t *testing.T) {
242242

243243
_, _, err = v.VerifyTokenRequestFromRaw(ctx, nil, anchor, []byte("invalid"))
244244
require.Error(t, err)
245+
246+
t.Run("MaxTokenRequestSize", func(t *testing.T) {
247+
vLimit := NewValidator[driver.PublicParameters, driver.Input, driver.TransferAction, driver.IssueAction, driver.Deserializer](
248+
logger, pp, des, ad, nil, nil, nil,
249+
)
250+
vLimit.ValidationConfig.MaxTokenRequestSize = 10
251+
_, _, err = vLimit.VerifyTokenRequestFromRaw(ctx, nil, anchor, make([]byte, 11))
252+
require.Error(t, err)
253+
assert.Contains(t, err.Error(), "token request too large")
254+
})
255+
256+
t.Run("MaxActionCount", func(t *testing.T) {
257+
vLimit := NewValidator[driver.PublicParameters, driver.Input, driver.TransferAction, driver.IssueAction, driver.Deserializer](
258+
logger, pp, des, ad, nil, nil, nil,
259+
)
260+
vLimit.ValidationConfig.MaxActionCount = 1
261+
trLarge := &driver.TokenRequest{
262+
Issues: [][]byte{[]byte("issue1")},
263+
Transfers: [][]byte{[]byte("transfer1")},
264+
Version: 1,
265+
}
266+
raw, _ := trLarge.Bytes()
267+
_, _, err = vLimit.VerifyTokenRequestFromRaw(ctx, nil, anchor, raw)
268+
require.Error(t, err)
269+
assert.Contains(t, err.Error(), "too many actions")
270+
})
245271
})
246272
}
247273

‎token/driver/mock/validator.go‎

Lines changed: 37 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎token/driver/request.go‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,16 @@ func (r *TokenRequest) FromProtos(tr *request.TokenRequest) error {
149149
// Store the version from the protobuf
150150
r.Version = tr.Version
151151

152+
if len(tr.Actions) > MaxActionCount {
153+
return errors.Errorf("too many actions: %d > %d", len(tr.Actions), MaxActionCount)
154+
}
155+
if len(tr.Signatures) > MaxActionCount {
156+
return errors.Errorf("too many signatures: %d > %d", len(tr.Signatures), MaxActionCount)
157+
}
158+
if tr.Auditing != nil && len(tr.Auditing.Signatures) > MaxActionCount {
159+
return errors.Errorf("too many auditor signatures: %d > %d", len(tr.Auditing.Signatures), MaxActionCount)
160+
}
161+
152162
for _, action := range tr.Actions {
153163
if action == nil {
154164
return errors.New("nil action found")
@@ -308,8 +318,17 @@ func (a *AuditableIdentity) ToProtos() (*request.AuditableIdentity, error) {
308318
}
309319

310320
func (a *AuditableIdentity) FromProtos(auditableIdentity *request.AuditableIdentity) error {
321+
if auditableIdentity == nil {
322+
return errors.New("auditable identity is nil")
323+
}
311324
a.Identity = ToIdentity(auditableIdentity.Identity)
325+
if len(a.Identity) > MaxOwnerRawSize {
326+
return errors.Errorf("identity too large: %d > %d", len(a.Identity), MaxOwnerRawSize)
327+
}
312328
a.AuditInfo = auditableIdentity.AuditInfo
329+
if len(a.AuditInfo) > MaxOwnerRawSize {
330+
return errors.Errorf("audit info too large: %d > %d", len(a.AuditInfo), MaxOwnerRawSize)
331+
}
313332

314333
return nil
315334
}
@@ -359,6 +378,9 @@ func (i *IssueOutputMetadata) FromProtos(outputsMetadata *request.OutputMetadata
359378
return nil
360379
}
361380
i.OutputMetadata = outputsMetadata.Metadata
381+
if len(i.OutputMetadata) > MaxTokenPayloadSize {
382+
return errors.Errorf("output metadata too large: %d > %d", len(i.OutputMetadata), MaxTokenPayloadSize)
383+
}
362384
i.Receivers = slices.GenericSliceOfPointers[AuditableIdentity](len(outputsMetadata.Receivers))
363385
if err := protos.FromProtosSlice(outputsMetadata.Receivers, i.Receivers); err != nil {
364386
return errors.Wrap(err, "failed unmarshalling receivers metadata")
@@ -411,6 +433,15 @@ func (i *IssueMetadata) ToProtos() (*request.IssueMetadata, error) {
411433
}
412434

413435
func (i *IssueMetadata) FromProtos(issueMetadata *request.IssueMetadata) error {
436+
if issueMetadata == nil {
437+
return errors.New("issue metadata is nil")
438+
}
439+
if len(issueMetadata.Inputs) > MaxActionCount {
440+
return errors.Errorf("too many issue inputs: %d > %d", len(issueMetadata.Inputs), MaxActionCount)
441+
}
442+
if len(issueMetadata.Outputs) > MaxActionCount {
443+
return errors.Errorf("too many issue outputs: %d > %d", len(issueMetadata.Outputs), MaxActionCount)
444+
}
414445
issuer := &AuditableIdentity{}
415446
if err := issuer.FromProtos(issueMetadata.Issuer); err != nil {
416447
return errors.Wrapf(err, "failed unmarshalling issuer [%v]", issueMetadata.Issuer)
@@ -507,7 +538,13 @@ func (t *TransferOutputMetadata) FromProtos(transferOutputMetadata *request.Outp
507538
return nil
508539
}
509540
t.OutputMetadata = transferOutputMetadata.Metadata
541+
if len(t.OutputMetadata) > MaxTokenPayloadSize {
542+
return errors.Errorf("output metadata too large: %d > %d", len(t.OutputMetadata), MaxTokenPayloadSize)
543+
}
510544
t.OutputAuditInfo = transferOutputMetadata.AuditInfo
545+
if len(t.OutputAuditInfo) > MaxOwnerRawSize {
546+
return errors.Errorf("output audit info too large: %d > %d", len(t.OutputAuditInfo), MaxOwnerRawSize)
547+
}
511548
t.Receivers = slices.GenericSliceOfPointers[AuditableIdentity](len(transferOutputMetadata.Receivers))
512549
if err := protos.FromProtosSlice(transferOutputMetadata.Receivers, t.Receivers); err != nil {
513550
return errors.Wrap(err, "failed unmarshalling receivers metadata")
@@ -577,6 +614,15 @@ func (t *TransferMetadata) ToProtos() (*request.TransferMetadata, error) {
577614
}
578615

579616
func (t *TransferMetadata) FromProtos(transferMetadata *request.TransferMetadata) error {
617+
if transferMetadata == nil {
618+
return errors.New("transfer metadata is nil")
619+
}
620+
if len(transferMetadata.Inputs) > MaxActionCount {
621+
return errors.Errorf("too many transfer inputs: %d > %d", len(transferMetadata.Inputs), MaxActionCount)
622+
}
623+
if len(transferMetadata.Outputs) > MaxActionCount {
624+
return errors.Errorf("too many transfer outputs: %d > %d", len(transferMetadata.Outputs), MaxActionCount)
625+
}
580626
t.Inputs = slices.GenericSliceOfPointers[TransferInputMetadata](len(transferMetadata.Inputs))
581627
if err := protos.FromProtosSlice(transferMetadata.Inputs, t.Inputs); err != nil {
582628
return errors.Wrap(err, "failed unmarshalling inputs")
@@ -712,6 +758,10 @@ func (m *TokenRequestMetadata) FromProtos(trm *request.TokenRequestMetadata) err
712758
return errors.Errorf("invalid token request metadata version, expected [%d], got [%d]", ProtocolV1, trm.Version)
713759
}
714760

761+
if len(trm.Metadata) > MaxActionCount {
762+
return errors.Errorf("too many action metadata: %d > %d", len(trm.Metadata), MaxActionCount)
763+
}
764+
715765
m.Application = trm.Application
716766
for _, meta := range trm.Metadata {
717767
im := meta.GetIssueMetadata()

‎token/driver/validator.go‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,25 @@ import (
1212
"github.com/hyperledger-labs/fabric-token-sdk/token/token"
1313
)
1414

15+
const (
16+
// MaxTokenPayloadSize is the maximum size of a token payload in bytes.
17+
MaxTokenPayloadSize = 2 * 1024 * 1024 // 2MB
18+
// MaxTokenOutputsPerTx is the maximum number of outputs per transaction.
19+
MaxTokenOutputsPerTx = 1000
20+
// MaxBulkDeleteSize is the maximum number of token IDs that can be deleted in a single bulk operation.
21+
MaxBulkDeleteSize = 10000
22+
// MaxWalletIDSize is the maximum size of a wallet ID in bytes.
23+
MaxWalletIDSize = 1024
24+
// MaxOwnerRawSize is the maximum size of a raw owner identity in bytes.
25+
MaxOwnerRawSize = 16 * 1024 // 16KB for Idemix
26+
// MaxIssuerRawSize is the maximum size of a raw issuer identity in bytes.
27+
MaxIssuerRawSize = 16 * 1024
28+
// MaxTokenRequestSize is the maximum size of a token request in bytes.
29+
MaxTokenRequestSize = 2 * 1024 * 1024 // 2MB
30+
// MaxActionCount is the maximum number of actions/signatures in a token request.
31+
MaxActionCount = 1000
32+
)
33+
1534
// ValidationAttributeID is the type of validation attribute identifier
1635
type ValidationAttributeID = string
1736

@@ -45,6 +64,18 @@ type ValidatorLedger interface {
4564
GetState(id token.ID) ([]byte, error)
4665
}
4766

67+
// ValidationConfig defines the limits for token validation operations to prevent resource exhaustion.
68+
type ValidationConfig struct {
69+
MaxTokenPayloadSize int
70+
MaxTokenOutputsPerTx int
71+
MaxBulkDeleteSize int
72+
MaxWalletIDSize int
73+
MaxOwnerRawSize int
74+
MaxIssuerRawSize int
75+
MaxTokenRequestSize int
76+
MaxActionCount int
77+
}
78+
4879
// Validator provides methods for validating token transaction requests.
4980
// It ensures that requests are well-formed and consistent with the rules
5081
// defined by the token driver.
@@ -68,4 +99,7 @@ type Validator interface {
6899
// Setting this to 0 (default) accepts all protocol versions.
69100
// This is useful for enforcing protocol upgrades across a network.
70101
SetMinProtocolVersion(version uint32)
102+
103+
// SetValidationConfig configures the validation limits for the validator.
104+
SetValidationConfig(config ValidationConfig)
71105
}

0 commit comments

Comments
 (0)