mirror of
https://github.com/corda/corda.git
synced 2024-12-20 13:33:12 +00:00
289 lines
12 KiB
HTML
289 lines
12 KiB
HTML
|
|
|
|
<!DOCTYPE html>
|
|
<!--[if IE 8]><html class="no-js lt-ie9" lang="en" > <![endif]-->
|
|
<!--[if gt IE 8]><!--> <html class="no-js" lang="en" > <!--<![endif]-->
|
|
<head>
|
|
<meta charset="utf-8">
|
|
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
|
|
<title>Secure coding guidelines — R3 Corda latest documentation</title>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<link rel="stylesheet" href="_static/css/custom.css" type="text/css" />
|
|
|
|
|
|
|
|
|
|
|
|
<link rel="top" title="R3 Corda latest documentation" href="index.html"/>
|
|
<link rel="next" title="Contract catalogue" href="contract-catalogue.html"/>
|
|
<link rel="prev" title="Event scheduling" href="event-scheduling.html"/>
|
|
|
|
|
|
<script src="_static/js/modernizr.min.js"></script>
|
|
|
|
</head>
|
|
|
|
<body class="wy-body-for-nav" role="document">
|
|
|
|
<div class="wy-grid-for-nav">
|
|
|
|
|
|
<nav data-toggle="wy-nav-shift" class="wy-nav-side">
|
|
<div class="wy-side-scroll">
|
|
<div class="wy-side-nav-search">
|
|
|
|
|
|
|
|
|
|
<a href="index.html" class="icon icon-home"> R3 Corda
|
|
|
|
|
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
<div class="version">
|
|
latest
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<div role="search">
|
|
<form id="rtd-search-form" class="wy-form" action="search.html" method="get">
|
|
<input type="text" name="q" placeholder="Search docs" />
|
|
<input type="hidden" name="check_keywords" value="yes" />
|
|
<input type="hidden" name="area" value="default" />
|
|
</form>
|
|
</div>
|
|
|
|
|
|
<br>
|
|
<a href="api/index.html">API reference</a>
|
|
|
|
</div>
|
|
|
|
<div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
|
|
|
|
|
|
|
|
<p class="caption"><span class="caption-text">Overview</span></p>
|
|
<ul>
|
|
<li class="toctree-l1"><a class="reference internal" href="inthebox.html">What’s included?</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="getting-set-up.html">Getting set up</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="data-model.html">Data model</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="transaction-data-types.html">Data types</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="consensus.html">Consensus model</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="messaging.html">Networking and messaging</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="creating-a-cordapp.html">Creating a Cordapp</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="running-the-demos.html">Running the demos</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="node-administration.html">Node administration</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="corda-configuration-files.html">The Corda Configuration File</a></li>
|
|
</ul>
|
|
<p class="caption"><span class="caption-text">Tutorials</span></p>
|
|
<ul class="current">
|
|
<li class="toctree-l1"><a class="reference internal" href="where-to-start.html">Where to start</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="tutorial-contract.html">Writing a contract</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="tutorial-contract-clauses.html">Writing a contract using clauses</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="tutorial-test-dsl.html">Writing a contract test</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="protocol-state-machines.html">Protocol state machines</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="oracles.html">Writing oracle services</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="event-scheduling.html">Event scheduling</a></li>
|
|
<li class="toctree-l1 current"><a class="current reference internal" href="#">Secure coding guidelines</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="#protocols">Protocols</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="#contracts">Contracts</a></li>
|
|
</ul>
|
|
<p class="caption"><span class="caption-text">Contracts</span></p>
|
|
<ul>
|
|
<li class="toctree-l1"><a class="reference internal" href="contract-catalogue.html">Contract catalogue</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="contract-irs.html">Interest Rate Swaps</a></li>
|
|
</ul>
|
|
<p class="caption"><span class="caption-text">Node API</span></p>
|
|
<ul>
|
|
<li class="toctree-l1"><a class="reference internal" href="clientrpc.html">Client RPC</a></li>
|
|
</ul>
|
|
<p class="caption"><span class="caption-text">Appendix</span></p>
|
|
<ul>
|
|
<li class="toctree-l1"><a class="reference internal" href="release-process.html">Release process</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="release-process.html#steps-to-cut-a-release">Steps to cut a release</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="release-notes.html">Release notes</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="network-simulator.html">Network Simulator</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="codestyle.html">Code style guide</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="building-the-docs.html">Building the documentation</a></li>
|
|
</ul>
|
|
|
|
|
|
|
|
</div>
|
|
</div>
|
|
</nav>
|
|
|
|
<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">
|
|
|
|
|
|
<nav class="wy-nav-top" role="navigation" aria-label="top navigation">
|
|
<i data-toggle="wy-nav-top" class="fa fa-bars"></i>
|
|
<a href="index.html">R3 Corda</a>
|
|
</nav>
|
|
|
|
|
|
|
|
<div class="wy-nav-content">
|
|
<div class="rst-content">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<div role="navigation" aria-label="breadcrumbs navigation">
|
|
<ul class="wy-breadcrumbs">
|
|
<li><a href="index.html">Docs</a> »</li>
|
|
|
|
<li>Secure coding guidelines</li>
|
|
<li class="wy-breadcrumbs-aside">
|
|
|
|
|
|
<a href="_sources/secure-coding-guidelines.txt" rel="nofollow"> View page source</a>
|
|
|
|
|
|
</li>
|
|
</ul>
|
|
<hr/>
|
|
</div>
|
|
<div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
|
|
<div itemprop="articleBody">
|
|
|
|
<div class="section" id="secure-coding-guidelines">
|
|
<h1>Secure coding guidelines<a class="headerlink" href="#secure-coding-guidelines" title="Permalink to this headline">¶</a></h1>
|
|
<p>The platform does what it can to be secure by default and safe by design. Unfortunately the platform cannot
|
|
prevent every kind of security mistake. This document describes what to think about when writing applications
|
|
to block various kinds of attack. Whilst it may be tempting to just assume no reasonable counterparty would
|
|
attempt to subvert your trades using protocol level attacks, relying on trust for software security makes it
|
|
harder to scale up your operations later when you might want to add counterparties quickly and without
|
|
extensive vetting.</p>
|
|
</div>
|
|
<div class="section" id="protocols">
|
|
<h1>Protocols<a class="headerlink" href="#protocols" title="Permalink to this headline">¶</a></h1>
|
|
<p><a class="reference internal" href="protocol-state-machines.html"><span class="doc">Protocol state machines</span></a> are how your app communicates with other parties on the network. Therefore they
|
|
are the typical entry point for malicious data into your app and must be treated with care.</p>
|
|
<p>The <code class="docutils literal"><span class="pre">receive</span></code> methods return data wrapped in the <code class="docutils literal"><span class="pre">UntrustworthyData<T></span></code> marker type. This type doesn’t add
|
|
any functionality, it’s only there to remind you to properly validate everything that you get from the network.
|
|
Remember that the other side may <em>not</em> be running the code you provide to take part in the protocol: they are
|
|
allowed to do anything! Things to watch out for:</p>
|
|
<ul class="simple">
|
|
<li>A transaction that doesn’t match a partial transaction built or proposed earlier in the protocol, for instance,
|
|
if you propose to trade a cash state worth $100 for an asset, and the transaction to sign comes back from the
|
|
other side, you must check that it points to the state you actually requested. Otherwise the attacker could
|
|
get you to sign a transaction that spends a much larger state to you, if they know the ID of one!</li>
|
|
<li>A transaction that isn’t of the right type. There are two transaction types: general and notary change. If you
|
|
are expecting one type but get the other you may find yourself signing a transaction that transfers your assets
|
|
to the control of a hostile notary.</li>
|
|
<li>Unexpected changes in any part of the states in a transaction. If you have access to all the needed data, you
|
|
could re-run the builder logic and do a comparison of the resulting states to ensure that it’s what you expected.
|
|
For instance if the data needed to construct the next state is available to both parties, the function to
|
|
calculate the transaction you want to mutually agree could be shared between both classes implementing both
|
|
sides of the protocol.</li>
|
|
</ul>
|
|
<p>The theme should be clear: signing is a very sensitive operation, so you need to be sure you know what it is you
|
|
are about to sign, and that nothing has changed in the small print!</p>
|
|
</div>
|
|
<div class="section" id="contracts">
|
|
<h1>Contracts<a class="headerlink" href="#contracts" title="Permalink to this headline">¶</a></h1>
|
|
<p>Contracts are arbitrary functions inside a JVM sandbox and therefore they have a lot of leeway to shoot themselves
|
|
in the foot. Things to watch out for:</p>
|
|
<ul class="simple">
|
|
<li>Changes in states that should not be allowed by the current state transition. You will want to check that no
|
|
fields are changing except the intended fields!</li>
|
|
<li>Accidentally catching and discarding exceptions that might be thrown by validation logic.</li>
|
|
<li>Calling into other contracts via virtual methods if you don’t know what those other contracts are or might do.</li>
|
|
</ul>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
<footer>
|
|
|
|
<div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
|
|
|
|
<a href="contract-catalogue.html" class="btn btn-neutral float-right" title="Contract catalogue" accesskey="n">Next <span class="fa fa-arrow-circle-right"></span></a>
|
|
|
|
|
|
<a href="event-scheduling.html" class="btn btn-neutral" title="Event scheduling" accesskey="p"><span class="fa fa-arrow-circle-left"></span> Previous</a>
|
|
|
|
</div>
|
|
|
|
|
|
<hr/>
|
|
|
|
<div role="contentinfo">
|
|
<p>
|
|
© Copyright 2016, Distributed Ledger Group, LLC.
|
|
|
|
</p>
|
|
</div>
|
|
Built with <a href="http://sphinx-doc.org/">Sphinx</a> using a <a href="https://github.com/snide/sphinx_rtd_theme">theme</a> provided by <a href="https://readthedocs.org">Read the Docs</a>.
|
|
|
|
</footer>
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</section>
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<script type="text/javascript">
|
|
var DOCUMENTATION_OPTIONS = {
|
|
URL_ROOT:'./',
|
|
VERSION:'latest',
|
|
COLLAPSE_INDEX:false,
|
|
FILE_SUFFIX:'.html',
|
|
HAS_SOURCE: true
|
|
};
|
|
</script>
|
|
<script type="text/javascript" src="_static/jquery.js"></script>
|
|
<script type="text/javascript" src="_static/underscore.js"></script>
|
|
<script type="text/javascript" src="_static/doctools.js"></script>
|
|
|
|
|
|
|
|
|
|
|
|
<script type="text/javascript" src="_static/js/theme.js"></script>
|
|
|
|
|
|
|
|
|
|
<script type="text/javascript">
|
|
jQuery(function () {
|
|
SphinxRtdTheme.StickyNav.enable();
|
|
});
|
|
</script>
|
|
|
|
|
|
</body>
|
|
</html> |