Browse Source

Sanitize command strings before logging them.

Normally bitcoin core does not display any network originated strings without
 sanitizing or hex encoding.  This wasn't done for strcommand in many places.

This could be used to play havoc with a terminal displaying the logs,
 especially with printtoconsole in use.

Thanks to Evil-Knievel for reporting this issue.
0.13
Gregory Maxwell 10 years ago
parent
commit
28d4cff0ed
  1. 14
      src/main.cpp
  2. 2
      src/net.cpp
  3. 2
      src/rpcserver.cpp

14
src/main.cpp

@ -3450,7 +3450,7 @@ void static ProcessGetData(CNode* pfrom)
bool static ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv, int64_t nTimeReceived) bool static ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv, int64_t nTimeReceived)
{ {
RandAddSeedPerfmon(); RandAddSeedPerfmon();
LogPrint("net", "received: %s (%u bytes) peer=%d\n", strCommand, vRecv.size(), pfrom->id); LogPrint("net", "received: %s (%u bytes) peer=%d\n", SanitizeString(strCommand), vRecv.size(), pfrom->id);
if (mapArgs.count("-dropmessagestest") && GetRand(atoi(mapArgs["-dropmessagestest"])) == 0) if (mapArgs.count("-dropmessagestest") && GetRand(atoi(mapArgs["-dropmessagestest"])) == 0)
{ {
LogPrintf("dropmessagestest DROPPING RECV MESSAGE\n"); LogPrintf("dropmessagestest DROPPING RECV MESSAGE\n");
@ -4285,7 +4285,7 @@ bool ProcessMessages(CNode* pfrom)
// Scan for message start // Scan for message start
if (memcmp(msg.hdr.pchMessageStart, Params().MessageStart(), MESSAGE_START_SIZE) != 0) { if (memcmp(msg.hdr.pchMessageStart, Params().MessageStart(), MESSAGE_START_SIZE) != 0) {
LogPrintf("PROCESSMESSAGE: INVALID MESSAGESTART %s peer=%d\n", msg.hdr.GetCommand(), pfrom->id); LogPrintf("PROCESSMESSAGE: INVALID MESSAGESTART %s peer=%d\n", SanitizeString(msg.hdr.GetCommand()), pfrom->id);
fOk = false; fOk = false;
break; break;
} }
@ -4294,7 +4294,7 @@ bool ProcessMessages(CNode* pfrom)
CMessageHeader& hdr = msg.hdr; CMessageHeader& hdr = msg.hdr;
if (!hdr.IsValid()) if (!hdr.IsValid())
{ {
LogPrintf("PROCESSMESSAGE: ERRORS IN HEADER %s peer=%d\n", hdr.GetCommand(), pfrom->id); LogPrintf("PROCESSMESSAGE: ERRORS IN HEADER %s peer=%d\n", SanitizeString(hdr.GetCommand()), pfrom->id);
continue; continue;
} }
string strCommand = hdr.GetCommand(); string strCommand = hdr.GetCommand();
@ -4310,7 +4310,7 @@ bool ProcessMessages(CNode* pfrom)
if (nChecksum != hdr.nChecksum) if (nChecksum != hdr.nChecksum)
{ {
LogPrintf("ProcessMessages(%s, %u bytes): CHECKSUM ERROR nChecksum=%08x hdr.nChecksum=%08x\n", LogPrintf("ProcessMessages(%s, %u bytes): CHECKSUM ERROR nChecksum=%08x hdr.nChecksum=%08x\n",
strCommand, nMessageSize, nChecksum, hdr.nChecksum); SanitizeString(strCommand), nMessageSize, nChecksum, hdr.nChecksum);
continue; continue;
} }
@ -4327,12 +4327,12 @@ bool ProcessMessages(CNode* pfrom)
if (strstr(e.what(), "end of data")) if (strstr(e.what(), "end of data"))
{ {
// Allow exceptions from under-length message on vRecv // Allow exceptions from under-length message on vRecv
LogPrintf("ProcessMessages(%s, %u bytes): Exception '%s' caught, normally caused by a message being shorter than its stated length\n", strCommand, nMessageSize, e.what()); LogPrintf("ProcessMessages(%s, %u bytes): Exception '%s' caught, normally caused by a message being shorter than its stated length\n", SanitizeString(strCommand), nMessageSize, e.what());
} }
else if (strstr(e.what(), "size too large")) else if (strstr(e.what(), "size too large"))
{ {
// Allow exceptions from over-long size // Allow exceptions from over-long size
LogPrintf("ProcessMessages(%s, %u bytes): Exception '%s' caught\n", strCommand, nMessageSize, e.what()); LogPrintf("ProcessMessages(%s, %u bytes): Exception '%s' caught\n", SanitizeString(strCommand), nMessageSize, e.what());
} }
else else
{ {
@ -4349,7 +4349,7 @@ bool ProcessMessages(CNode* pfrom)
} }
if (!fRet) if (!fRet)
LogPrintf("ProcessMessage(%s, %u bytes) FAILED peer=%d\n", strCommand, nMessageSize, pfrom->id); LogPrintf("ProcessMessage(%s, %u bytes) FAILED peer=%d\n", SanitizeString(strCommand), nMessageSize, pfrom->id);
break; break;
} }

2
src/net.cpp

@ -1971,7 +1971,7 @@ void CNode::BeginMessage(const char* pszCommand) EXCLUSIVE_LOCK_FUNCTION(cs_vSen
ENTER_CRITICAL_SECTION(cs_vSend); ENTER_CRITICAL_SECTION(cs_vSend);
assert(ssSend.size() == 0); assert(ssSend.size() == 0);
ssSend << CMessageHeader(pszCommand, 0); ssSend << CMessageHeader(pszCommand, 0);
LogPrint("net", "sending: %s ", pszCommand); LogPrint("net", "sending: %s ", SanitizeString(pszCommand));
} }
void CNode::AbortMessage() UNLOCK_FUNCTION(cs_vSend) void CNode::AbortMessage() UNLOCK_FUNCTION(cs_vSend)

2
src/rpcserver.cpp

@ -849,7 +849,7 @@ void JSONRequest::parse(const Value& valRequest)
throw JSONRPCError(RPC_INVALID_REQUEST, "Method must be a string"); throw JSONRPCError(RPC_INVALID_REQUEST, "Method must be a string");
strMethod = valMethod.get_str(); strMethod = valMethod.get_str();
if (strMethod != "getblocktemplate") if (strMethod != "getblocktemplate")
LogPrint("rpc", "ThreadRPCServer method=%s\n", strMethod); LogPrint("rpc", "ThreadRPCServer method=%s\n", SanitizeString(strMethod));
// Parse params // Parse params
Value valParams = find_value(request, "params"); Value valParams = find_value(request, "params");

Loading…
Cancel
Save