security: stop disclosing RPC credentials, O(1) address flow, non-root container, pin GHActions - #1
Open
BlacKSnowDot0 wants to merge 1 commit into
Conversation
…t container, pin GHActions - client.ts/app.ts: add PUBLIC_RPC_URL; /stats/summary now returns it (or RPC_URL with userinfo redacted) instead of the raw RPC_URL, which may embed provider credentials - store.ts: maintain native flow in an address_flow ledger at ingest time (BigInt arithmetic), making flowOfAddress an O(1) read; the ledger is rebuilt lazily after reorgs/chain switches; SCHEMA_VERSION bumped to 2 - Dockerfile: run the container as an unprivileged user with ownership of logs/ and .data/ - ci.yml: pin GitHub Actions to full commit SHAs
Contributor
|
@BlacKSnowDot0 Please, fix conflict |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes three findings from an independent security audit of the NuraChain org.
/api/stats/summarydisclosed the rawRPC_URL(may embed credentials)Added
PUBLIC_RPC_URL; the summary endpoint now returns it, fallingback to
RPC_URLwith userinfo redacted..env.exampleupdated.flowOfAddressscanned every successful transaction of an address(unbounded memory/CPU per request — DoS on busy addresses).
Native flow is now maintained in an
address_flowledger during ingest(BigInt arithmetic; SQL
SUMwould overflow/precision-lose wei),making the read O(1). After reorgs/chain switches the ledger is
rebuilt lazily in bounded pages.
SCHEMA_VERSIONbumped to 2(drop-and-replay per repo policy).
Container ran as root
Dockerfile now creates a non-root user owning
logs/and.data/anddrops privileges before
CMD.Also pins
ci.ymlactions to commit SHAs.Verified:
npm run check,npm run build,npm run testall pass.