ExternalVendorCode/corda
1
0
Fork 0
mirror of https://github.com/corda/corda.git synced 2025-06-23 09:25:36 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Added checks against the use of the special uploader tokens (#3724)

Browse Source 
"app", "rpc", "p2p" and "unknown" have security implications (see isUploaderTrusted method) and thus they are not allowed to be used in the uploader field when importing attachments via the public API.
This commit is contained in:
Shams Asari
2018-07-31 17:01:39 +01:00
committed by GitHub
parent 994fe0dbdc
commit dfafdbcb9f
13 changed files with 148 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
testing/test-utils/src/main/kotlin/net/corda/testing/dsl/TestDSL.kt
View File

@ -288,7 +288,7 @@ data class TestLedgerDSLInterpreter private constructor(
copy().dsl()
override fun attachment(attachment: InputStream): SecureHash {
return services.attachments.importAttachment(attachment, UNKNOWN_UPLOADER, null)
return services.attachments.importAttachment(attachment, "TestDSL", null)
}
override fun verifies(): EnforceVerifyOrFail {

5
testing/test-utils/src/main/kotlin/net/corda/testing/internal/MockCordappProvider.kt
View File

@ -3,12 +3,11 @@ package net.corda.testing.internal
import net.corda.core.contracts.ContractClassName
import net.corda.core.cordapp.Cordapp
import net.corda.core.crypto.SecureHash
import net.corda.core.internal.TEST_UPLOADER
import net.corda.core.internal.DEPLOYED_CORDAPP_UPLOADER
import net.corda.core.internal.cordapp.CordappImpl
import net.corda.core.node.services.AttachmentId
import net.corda.core.node.services.AttachmentStorage
import net.corda.node.cordapp.CordappLoader
import net.corda.node.internal.cordapp.JarScanningCordappLoader
import net.corda.node.internal.cordapp.CordappProviderImpl
import net.corda.testing.services.MockAttachmentStorage
import java.nio.file.Paths
@ -50,7 +49,7 @@ class MockCordappProvider(
return if (!existingAttachment.isEmpty()) {
existingAttachment.keys.first()
} else {
attachments.importContractAttachment(contractClassNames, TEST_UPLOADER, data.inputStream())
attachments.importContractAttachment(contractClassNames, DEPLOYED_CORDAPP_UPLOADER, data.inputStream())
}
}
}