Release v4.2.1 (#1808)

* Merge pull request from GHSA-853p-5678-hv8f

* Handle `LangError` from `DelegateCall`

* Add basic delegate E2E test

* Get test working with integration flipper

* Use `incrementer` for test instead

* Add tests to make sure that `LangError`s can be handled

* Get rid of references to the interation Flipper

* Bump version numbers to `4.2.1`

* Add `CHANGELOG` entry

Add more info to the `CHANGELOG`

* Fix doc test related to delegate call (#1809)

* Mention extra `Result` return type

* Try using old CI image

* Bump codec version in UI tests

* Add German's CHANGELOG suggestion

Author: HCastano

.gitlab-ci.yml

@@ -28,7 +28,7 @@ variables:
   CARGO_TARGET_DIR:                "/ci-cache/${CI_PROJECT_NAME}/targets/${CI_COMMIT_REF_NAME}/${CI_JOB_NAME}"
   # CI_IMAGE is changed to "-:staging" when the CI image gets rebuilt
   # read more https://github.com/paritytech/scripts/pull/244
-  CI_IMAGE:                        "paritytech/ink-ci-linux:production"
+  CI_IMAGE:                        "paritytech/ink-ci-linux:a1f03f4b-20230420"
   PURELY_STD_CRATES:               "ink/codegen metadata engine e2e e2e/macro ink/ir"
   ALSO_WASM_CRATES:                "env storage storage/traits allocator prelude primitives ink ink/macro"
   ALL_CRATES:                      "${PURELY_STD_CRATES} ${ALSO_WASM_CRATES}"

CHANGELOG.md

@@ -6,6 +6,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## Version 4.2.1
+
+This release contains a low-severity security related fix. Users of the `4.x` series of
+releases are advised to update.
+
+Note that this release contains a breaking change since the API of
+`ink_env::invoke_contract_delegate` and `CallBuilder::try_invoke` now return an extra
+`ink_primitives::MessageResult` which must be handled.
+
+We decided to release this breaking change as a `PATCH` release to ensure that affected
+users are upgrading to the fixed API.
+
+See the [published advisory](https://github.com/paritytech/ink/security/advisories/GHSA-853p-5678-hv8f)
+for more info.
+
+### Fixed
+- Handle `LangError` from `DelegateCall`
+
 ## Version 4.2.0
 
 ### Added

crates/allocator/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ink_allocator"
-version = "4.2.0"
+version = "4.2.1"
 authors = ["Parity Technologies <[email protected]>", "Robin Freyler <[email protected]>"]
 edition = "2021"
 

crates/e2e/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ink_e2e"
-version = "4.2.0"
+version = "4.2.1"
 authors = ["Parity Technologies <[email protected]>"]
 edition = "2021"
 
@@ -15,10 +15,10 @@ categories = ["no-std", "embedded"]
 include = ["/Cargo.toml", "src/**/*.rs", "/README.md", "/LICENSE"]
 
 [dependencies]
-ink_e2e_macro = { version = "4.2.0", path = "./macro" }
-ink = { version = "4.2.0", path = "../ink" }
-ink_env = { version = "4.2.0", path = "../env" }
-ink_primitives = { version = "4.2.0", path = "../primitives" }
+ink_e2e_macro = { version = "4.2.1", path = "./macro" }
+ink = { version = "4.2.1", path = "../ink" }
+ink_env = { version = "4.2.1", path = "../env" }
+ink_primitives = { version = "4.2.1", path = "../primitives" }
 
 funty = "2.0.0"
 impl-serde = { version = "0.3.1", default-features = false }

crates/e2e/macro/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ink_e2e_macro"
-version = "4.2.0"
+version = "4.2.1"
 authors = ["Parity Technologies <[email protected]>"]
 edition = "2021"
 
@@ -19,7 +19,7 @@ name = "ink_e2e_macro"
 proc-macro = true
 
 [dependencies]
-ink_ir = { version = "4.2.0", path = "../../ink/ir" }
+ink_ir = { version = "4.2.1", path = "../../ink/ir" }
 cargo_metadata = "0.15.3"
 contract-build = "2.0.2"
 derive_more = "0.99.17"

crates/engine/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ink_engine"
-version = "4.2.0"
+version = "4.2.1"
 authors = ["Parity Technologies <[email protected]>", "Michael Müller <[email protected]>"]
 edition = "2021"
 
@@ -15,7 +15,7 @@ categories = ["no-std", "embedded"]
 include = ["Cargo.toml", "src/**/*.rs", "README.md", "LICENSE"]
 
 [dependencies]
-ink_primitives = { version = "4.2.0", path = "../../crates/primitives", default-features = false }
+ink_primitives = { version = "4.2.1", path = "../../crates/primitives", default-features = false }
 scale = { package = "parity-scale-codec", version = "3.4", default-features = false, features = ["derive"] }
 derive_more = { version = "0.99", default-features = false, features = ["from", "display"] }
 

crates/env/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ink_env"
-version = "4.2.0"
+version = "4.2.1"
 authors = ["Parity Technologies <[email protected]>", "Robin Freyler <[email protected]>"]
 edition = "2021"
 rust-version = "1.68"
@@ -16,10 +16,10 @@ categories = ["no-std", "embedded"]
 include = ["Cargo.toml", "src/**/*.rs", "README.md", "LICENSE"]
 
 [dependencies]
-ink_allocator = { version = "4.2.0", path = "../allocator", default-features = false }
-ink_storage_traits = { version = "4.2.0", path = "../storage/traits", default-features = false }
-ink_prelude = { version = "4.2.0", path = "../prelude", default-features = false }
-ink_primitives = { version = "4.2.0", path = "../primitives", default-features = false }
+ink_allocator = { version = "4.2.1", path = "../allocator", default-features = false }
+ink_storage_traits = { version = "4.2.1", path = "../storage/traits", default-features = false }
+ink_prelude = { version = "4.2.1", path = "../prelude", default-features = false }
+ink_primitives = { version = "4.2.1", path = "../primitives", default-features = false }
 
 scale = { package = "parity-scale-codec", version = "3.4", default-features = false, features = ["derive"] }
 derive_more = { version = "0.99", default-features = false, features = ["from", "display"] }
@@ -33,7 +33,7 @@ static_assertions = "1.1"
 rlibc = "1"
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
-ink_engine = { version = "4.2.0", path = "../engine/", optional = true }
+ink_engine = { version = "4.2.1", path = "../engine/", optional = true }
 
 # Hashes for the off-chain environment.
 sha2 = { version = "0.10", optional = true }

crates/env/src/api.rs

@@ -300,7 +300,7 @@ where
 /// - If the called code execution has trapped.
 pub fn invoke_contract_delegate<E, Args, R>(
     params: &CallParams<E, DelegateCall<E>, Args, R>,
-) -> Result<R>
+) -> Result<ink_primitives::MessageResult<R>>
 where
     E: Environment,
     Args: scale::Encode,

crates/env/src/backend.rs

@@ -433,7 +433,7 @@ pub trait TypedEnvBackend: EnvBackend {
     fn invoke_contract_delegate<E, Args, R>(
         &mut self,
         call_data: &CallParams<E, DelegateCall<E>, Args, R>,
-    ) -> Result<R>
+    ) -> Result<ink_primitives::MessageResult<R>>
     where
         E: Environment,
         Args: scale::Encode,

crates/env/src/call/call_builder.rs

@@ -151,13 +151,17 @@ where
     ///
     /// # Panics
     ///
-    /// This method panics if it encounters an [`ink::env::Error`][`crate::Error`]. If you
-    /// want to handle those use the [`try_invoke`][`CallParams::try_invoke`] method
-    /// instead.
+    /// This method panics if it encounters an [`ink::env::Error`][`crate::Error`] or an
+    /// [`ink::primitives::LangError`][`ink_primitives::LangError`]. If you want to handle
+    /// those use the [`try_invoke`][`CallParams::try_invoke`] method instead.
     pub fn invoke(&self) -> R {
-        crate::invoke_contract_delegate(self).unwrap_or_else(|env_error| {
-            panic!("Cross-contract call failed with {env_error:?}")
-        })
+        crate::invoke_contract_delegate(self)
+            .unwrap_or_else(|env_error| {
+                panic!("Cross-contract call failed with {env_error:?}")
+            })
+            .unwrap_or_else(|lang_error| {
+                panic!("Cross-contract call failed with {lang_error:?}")
+            })
     }
 
     /// Invoke the contract using Delegate Call semantics with the given built-up call
@@ -167,9 +171,10 @@ where
     ///
     /// # Note
     ///
-    /// On failure this returns an [`ink::env::Error`][`crate::Error`] which can be
+    /// On failure this returns an outer [`ink::env::Error`][`crate::Error`] or inner
+    /// [`ink::primitives::LangError`][`ink_primitives::LangError`], both of which can be
     /// handled by the caller.
-    pub fn try_invoke(&self) -> Result<R, crate::Error> {
+    pub fn try_invoke(&self) -> Result<ink_primitives::MessageResult<R>, crate::Error> {
         crate::invoke_contract_delegate(self)
     }
 }
@@ -712,7 +717,7 @@ where
     ///
     /// On failure this an [`ink::env::Error`][`crate::Error`] which can be handled by the
     /// caller.
-    pub fn try_invoke(self) -> Result<(), Error> {
+    pub fn try_invoke(self) -> Result<ink_primitives::MessageResult<()>, Error> {
         self.params().try_invoke()
     }
 }
@@ -759,9 +764,9 @@ where
     ///
     /// # Panics
     ///
-    /// This method panics if it encounters an [`ink::env::Error`][`crate::Error`]
-    /// If you want to handle those use the [`try_invoke`][`CallBuilder::try_invoke`]
-    /// method instead.
+    /// This method panics if it encounters an [`ink::env::Error`][`crate::Error`] or an
+    /// [`ink::primitives::LangError`][`ink_primitives::LangError`]. If you want to handle
+    /// those use the [`try_invoke`][`CallBuilder::try_invoke`] method instead.
     pub fn invoke(self) -> R {
         self.params().invoke()
     }
@@ -771,9 +776,10 @@ where
     ///
     /// # Note
     ///
-    /// On failure this an [`ink::env::Error`][`crate::Error`] which can be handled by the
-    /// caller.
-    pub fn try_invoke(self) -> Result<R, Error> {
+    /// On failure this returns an outer [`ink::env::Error`][`crate::Error`] or inner
+    /// [`ink::primitives::LangError`][`ink_primitives::LangError`], both of which can be
+    /// handled by the caller.
+    pub fn try_invoke(self) -> Result<ink_primitives::MessageResult<R>, Error> {
         self.params().try_invoke()
     }
 }