fix(api): harden external input validation

chainbase/src/main/java/org/tron/common/utils/WalletUtil.java

@@ -8,7 +8,9 @@
 import java.util.List;
 import java.util.stream.Collectors;
 import org.tron.common.crypto.Hash;
+import org.tron.common.math.StrictMathWrapper;
 import org.tron.common.parameter.CommonParameter;
+import org.tron.core.Constant;
 import org.tron.core.capsule.ContractCapsule;
 import org.tron.core.capsule.TransactionCapsule;
 import org.tron.core.exception.ContractValidateException;
@@ -24,6 +26,8 @@
 
 public class WalletUtil {
 
+  private static final String INVALID_ADDRESS = "invalid-address";
+
   public static boolean checkPermissionOperations(Permission permission, Contract contract)
       throws PermissionException {
     ByteString operations = permission.getOperations();
@@ -115,9 +119,22 @@ public static boolean isConstant(SmartContract.ABI abi, byte[] selector) {
     return false;
   }
 
+  public static String getAddressString(byte[] address) {
+    if (address == null) {
+      return INVALID_ADDRESS + "(null)";
+    }
+    if (address.length == Constant.STANDARD_ADDRESS_SIZE
+        || address.length == Constant.TRON_ADDRESS_SIZE) {
+      return encode58Check(address);
+    }
+    int shown = StrictMathWrapper.min(address.length, Constant.TRON_ADDRESS_SIZE);
+    return INVALID_ADDRESS + "(" + ByteArray.toHexString(Arrays.copyOf(address, shown))
+        + (shown < address.length ? "..." : "") + ",len=" + address.length + ")";
+  }
+
   public static List<String> getAddressStringList(Collection<ByteString> collection) {
     return collection.stream()
-        .map(bytes -> encode58Check(bytes.toByteArray()))
+        .map(address -> getAddressString(address.toByteArray()))
         .collect(Collectors.toList());
   }
 

chainbase/src/main/java/org/tron/core/db/TransactionTrace.java

@@ -18,7 +18,6 @@
 import org.tron.common.utils.DecodeUtil;
 import org.tron.common.utils.ForkController;
 import org.tron.common.utils.Sha256Hash;
-import org.tron.common.utils.StringUtil;
 import org.tron.common.utils.WalletUtil;
 import org.tron.core.Constant;
 import org.tron.core.capsule.AccountCapsule;
@@ -141,7 +140,7 @@ public void checkIsConstant() throws ContractValidateException, VMIllegalExcepti
           .get(triggerContractFromTransaction.getContractAddress().toByteArray());
       if (contract == null) {
         throw new ContractValidateException(String.format("contract: %s is not in contract store",
-            StringUtil.encode58Check(triggerContractFromTransaction
+            WalletUtil.getAddressString(triggerContractFromTransaction
                 .getContractAddress().toByteArray())));
 
       }

common/src/main/java/org/tron/core/exception/InvalidHttpParameterException.java

@@ -0,0 +1,15 @@
+package org.tron.core.exception;
+
+import java.security.InvalidParameterException;
+
+public class InvalidHttpParameterException extends InvalidParameterException {
+
+  public InvalidHttpParameterException(String message) {
+    super(message);
+  }
+
+  public InvalidHttpParameterException(String message, Throwable cause) {
+    super(message);
+    initCause(cause);
+  }
+}

consensus/src/main/java/org/tron/consensus/pbft/message/PbftBaseMessage.java

@@ -3,13 +3,12 @@
 import com.google.protobuf.InvalidProtocolBufferException;
 import java.io.IOException;
 import java.security.SignatureException;
-import java.util.stream.Collectors;
 import org.bouncycastle.util.encoders.Hex;
 import org.tron.common.crypto.ECKey;
 import org.tron.common.overlay.message.Message;
 import org.tron.common.utils.ByteUtil;
 import org.tron.common.utils.Sha256Hash;
-import org.tron.common.utils.StringUtil;
+import org.tron.common.utils.WalletUtil;
 import org.tron.core.capsule.TransactionCapsule;
 import org.tron.core.exception.P2pException;
 import org.tron.protos.Protocol.PBFTMessage;
@@ -119,8 +118,7 @@ public String getDataString() {
   private String decode() {
     try {
       SRL srList = SRL.parseFrom(pbftMessage.getRawData().getData().toByteArray());
-      return "sr list = " + srList.getSrAddressList().stream().map(
-          bytes -> StringUtil.encode58Check(bytes.toByteArray())).collect(Collectors.toList());
+      return "sr list = " + WalletUtil.getAddressStringList(srList.getSrAddressList());
     } catch (InvalidProtocolBufferException e) {
     }
     return "decode error";

framework/src/main/java/org/tron/core/Wallet.java

@@ -118,7 +118,6 @@
 import org.tron.common.utils.ByteUtil;
 import org.tron.common.utils.DecodeUtil;
 import org.tron.common.utils.Sha256Hash;
-import org.tron.common.utils.StringUtil;
 import org.tron.common.utils.Utils;
 import org.tron.common.utils.WalletUtil;
 import org.tron.common.zksnark.IncrementalMerkleTreeContainer;
@@ -261,6 +260,9 @@ public class Wallet {
       "Shielded transaction API is disabled; "
           + "set node.allowShieldedTransactionApi=true to enable.";
   private static final String PAYMENT_ADDRESS_FORMAT_WRONG = "paymentAddress format is wrong";
+  // the authoritative bound is checkBigIntegerRange: uint256 max is 78 decimal digits,
+  // this only keeps the string short enough to convert cheaply
+  private static final int MAX_SHIELDED_AMOUNT_LENGTH = 80;
   private static final String SHIELDED_TRANSACTION_SCAN_RANGE =
       "request requires start_block_index >= 0 && end_block_index > "
           + "start_block_index && end_block_index - start_block_index <= 1000";
@@ -3221,7 +3223,7 @@ public SmartContract getContract(GrpcAPI.BytesMessage bytesMessage) {
     if (accountCapsule == null) {
       logger.warn(
           "Get contract failed, the account {} does not exist or the account "
-              + "does not have a code hash!", StringUtil.encode58Check(address));
+              + "does not have a code hash!", WalletUtil.getAddressString(address));
       return null;
     }
 
@@ -3250,7 +3252,7 @@ public SmartContractDataWrapper getContractInfo(GrpcAPI.BytesMessage bytesMessag
     if (accountCapsule == null) {
       logger.warn(
           "Get contract failed, the account {} does not exist or the account does not have a code "
-              + "hash!", StringUtil.encode58Check(address));
+              + "hash!", WalletUtil.getAddressString(address));
       return null;
     }
 
@@ -4226,6 +4228,9 @@ private BigInteger getBigIntegerFromString(String in) {
     if (trimmedIn.length() == 0) {
       return BigInteger.ZERO;
     }
+    if (trimmedIn.length() > MAX_SHIELDED_AMOUNT_LENGTH) {
+      throw new IllegalArgumentException("invalid shielded amount");
+    }
     return new BigInteger(trimmedIn, 10);
   }
 
@@ -4337,7 +4342,12 @@ public BytesMessage getTriggerInputForShieldedTRC20Contract(
 
     ShieldedTRC20Parameters shieldedTRC20Parameters = request.getShieldedTRC20Parameters();
     List<BytesMessage> spendAuthoritySignature = request.getSpendAuthoritySignatureList();
-    BigInteger value = getBigIntegerFromString(request.getAmount());
+    BigInteger value;
+    try {
+      value = getBigIntegerFromString(request.getAmount());
+    } catch (IllegalArgumentException e) {
+      throw new ContractValidateException("invalid amount", e);
+    }
     checkBigIntegerRange(value);
     byte[] transparentToAddress = request.getTransparentToAddress().toByteArray();
     byte[] transparentToAddressTvm = new byte[20];
@@ -4402,9 +4412,16 @@ public BytesMessage getTriggerInputForShieldedTRC20Contract(
       }
       parametersBuilder.setBurnCiphertext(burnCiper);
     }
-    String input = parametersBuilder
-        .getTriggerContractInput(shieldedTRC20Parameters, spendAuthoritySignature, value, false,
-            transparentToAddressTvm);
+    String input;
+    try {
+      input = parametersBuilder
+          .getTriggerContractInput(shieldedTRC20Parameters, spendAuthoritySignature, value, false,
+              transparentToAddressTvm);
+    } catch (IllegalArgumentException e) {
+      // the builder names the offending argument in fixed strings; none of them echoes an input
+      throw new ContractValidateException(
+          "invalid shielded TRC-20 trigger input: " + e.getMessage(), e);
+    }
     if (Objects.isNull(input)) {
       throw new ZksnarkException("generate the trigger contract parameters error");
     }

framework/src/main/java/org/tron/core/net/message/handshake/HelloMessage.java

@@ -5,7 +5,7 @@
 import org.apache.commons.lang3.StringUtils;
 import org.tron.common.utils.ByteArray;
 import org.tron.common.utils.Sha256Hash;
-import org.tron.common.utils.StringUtil;
+import org.tron.common.utils.WalletUtil;
 import org.tron.core.ChainBaseManager;
 import org.tron.core.capsule.BlockCapsule;
 import org.tron.core.config.args.Args;
@@ -132,7 +132,7 @@ public String toString() {
     ByteString address = helloMessage.getAddress();
     if (!address.isEmpty()) {
       builder.append("address:")
-              .append(StringUtil.encode58Check(address.toByteArray())).append("\n");
+              .append(WalletUtil.getAddressString(address.toByteArray())).append("\n");
     }
 
     ByteString signature = helloMessage.getSignature();

framework/src/main/java/org/tron/core/services/http/servlets/GetBrokerageServlet.java

@@ -3,7 +3,6 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import lombok.extern.slf4j.Slf4j;
-import org.bouncycastle.util.encoders.DecoderException;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 import org.tron.core.db.Manager;
@@ -21,18 +20,19 @@ public class GetBrokerageServlet extends RateLimiterServlet {
   private Manager manager;
 
   protected void doGet(HttpServletRequest request, HttpServletResponse response) {
+    byte[] address;
+    try {
+      address = Util.getAddress(request);
+    } catch (Exception e) {
+      Util.processError(e, response);
+      return;
+    }
     try {
-      int value = 0;
-      byte[] address = Util.getAddress(request);
       long cycle = manager.getDynamicPropertiesStore().getCurrentCycleNumber();
-      if (address != null) {
-        value = manager.getDelegationStore().getBrokerage(cycle, address);
-      }
+      int value = manager.getDelegationStore().getBrokerage(cycle, address);
       response.getWriter().println("{\"brokerage\": " + value + "}");
-    } catch (DecoderException | IllegalArgumentException e) {
-      Util.writeAuditedError(Util.INVALID_ADDRESS_MSG, response);
     } catch (Exception e) {
-      Util.processError(e, response);
+      Util.processServerError(e, response);
     }
   }
 

framework/src/main/java/org/tron/core/services/http/servlets/GetRewardServlet.java

@@ -3,7 +3,6 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import lombok.extern.slf4j.Slf4j;
-import org.bouncycastle.util.encoders.DecoderException;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 import org.tron.core.db.Manager;
@@ -21,18 +20,19 @@ public class GetRewardServlet extends RateLimiterServlet {
   private Manager manager;
 
   protected void doGet(HttpServletRequest request, HttpServletResponse response) {
+    byte[] address;
     try {
-      long value = 0;
-      byte[] address = Util.getAddress(request);
-      if (address != null) {
-        value = manager.getMortgageService().queryReward(address);
-      }
+      address = Util.getAddress(request);
+    } catch (Exception e) {
+      Util.processError(e, response);
+      return;
+    }
+    try {
+      long value = manager.getMortgageService().queryReward(address);
       String out = JsonFormat.isInt64AsString()
           ? "{\"reward\": \"" + value + "\"}"
           : "{\"reward\": " + value + "}";
       response.getWriter().println(out);
-    } catch (DecoderException | IllegalArgumentException e) {
-      Util.writeAuditedError(Util.INVALID_ADDRESS_MSG, response);
     } catch (Exception e) {
       Util.processServerError(e, response);
     }

framework/src/main/java/org/tron/core/services/http/servlets/JsonFormat.java

@@ -84,6 +84,8 @@ public class JsonFormat {
       = "Writing to a StringBuilder threw an IOException (should never happen).";
   private static final String EXPECTED_STRING = "Expected string.";
   private static final String MISSING_END_QUOTE = "String missing ending quote.";
+  // Keeps the genesis block addresses compatible with their Base58Check rendering.
+  private static final int MAX_BASE58_ADDRESS_SIZE = 128;
 
   // Bounds all work and error messages performed by parseInteger after tokenization.
   static final int MAX_INTEGER_TOKEN_LENGTH = 256;
@@ -889,6 +891,9 @@ static String escapeBytes(ByteString input, final String fieldName, boolean self
   static String escapeBytesSelfType(ByteString input, final String fieldName) {
     //Address
     if (HttpSelfFormatFieldName.isAddressFormat(fieldName)) {
+      if (input.size() > MAX_BASE58_ADDRESS_SIZE) {
+        return ByteArray.toHexString(input.toByteArray());
+      }
       return StringUtil.encode58Check(input.toByteArray());
     }
     //Normal String