fix(certifier): harden request validation and prevent info leakage (#1498)

Signed-off-by: atharrva01 <atharvaborade568@gmail.com>

Author: atharrva01

token/services/certifier/interactive/config.go

@@ -27,4 +27,14 @@ const (
 	// DefaultResponseTimeout is the maximum time the client waits for the certifier
 	// to respond before treating the request as failed.
 	DefaultResponseTimeout = 60 * time.Second
+
+	// MaxTokensPerRequest is the maximum number of token IDs accepted in a single
+	// certification request. Requests exceeding this limit are rejected to prevent
+	// resource exhaustion on the certifier node.
+	MaxTokensPerRequest = 500
+
+	// MaxRequestBytes is the maximum byte-length of the cryptographic request payload
+	// in a CertificationRequest. Requests exceeding this limit are rejected to prevent
+	// memory exhaustion on the certifier node.
+	MaxRequestBytes = 1 << 20 // 1 MiB
 )

token/services/certifier/interactive/service.go

@@ -89,6 +89,14 @@ func (c *CertificationService) Call(context view.Context) (interface{}, error) {
 		return nil, errors.Errorf("invalid certification request: no token IDs provided [%s]", cr)
 	}
 
+	if len(cr.IDs) > MaxTokensPerRequest {
+		return nil, errors.Errorf("invalid certification request: too many token IDs (%d > %d) [%s]", len(cr.IDs), MaxTokensPerRequest, cr)
+	}
+
+	if len(cr.Request) > MaxRequestBytes {
+		return nil, errors.Errorf("invalid certification request: request payload too large (%d > %d bytes) [%s]", len(cr.Request), MaxRequestBytes, cr)
+	}
+
 	logger.Debugf("received certification request [%v]", cr)
 
 	// 3. load token outputs
@@ -97,6 +105,13 @@ func (c *CertificationService) Call(context view.Context) (interface{}, error) {
 		return nil, errors.WithMessagef(err, "failed getting tokens [%s:%s][%v]", cr.Channel, cr.Namespace, cr.IDs)
 	}
 
+	if len(tokenOutputs) != len(cr.IDs) {
+		return nil, errors.Errorf(
+			"token output count mismatch: backend returned %d outputs for %d IDs [%s]",
+			len(tokenOutputs), len(cr.IDs), cr,
+		)
+	}
+
 	// 4. certify token output
 	logger.Debugf("certify commitments for [%v]...", cr.IDs)
 	tms, err := token2.GetManagementService(
@@ -160,7 +175,7 @@ type CertificationRequest struct {
 }
 
 func (cr *CertificationRequest) String() string {
-	return fmt.Sprintf("CertificationRequest[%s,%s,%s][%v]", cr.Request, cr.Channel, cr.Namespace, cr.IDs)
+	return fmt.Sprintf("CertificationRequest[%s:%s:%s][ids=%d,req=%d bytes]", cr.Network, cr.Channel, cr.Namespace, len(cr.IDs), len(cr.Request))
 }
 
 type CertificationRequestView struct {
@@ -252,6 +267,13 @@ func (i *CertificationRequestView) Call(context view.Context) (interface{}, erro
 		return nil, errors.WithMessagef(err, "failed verifying certifications of [%v] from [%s]", i.ids, i.certifier)
 	}
 
+	if len(processedCertifications) != len(i.ids) {
+		return nil, errors.Errorf(
+			"certification manager returned %d processed certifications for %d token IDs from [%s]",
+			len(processedCertifications), len(i.ids), i.certifier,
+		)
+	}
+
 	logger.Debugf("certifications of [%v] from [%s] are valid", i.ids, i.certifier)
 
 	// 5. return token certifications in the form of a map