From 5a08930d65f48bfca8870de79a646ab52bb57abe Mon Sep 17 00:00:00 2001 From: Arthur Britto Date: Tue, 12 Mar 2013 15:17:45 -0700 Subject: [PATCH] Better parameter checking for RPC subscribe books. --- src/cpp/ripple/RPCHandler.cpp | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/src/cpp/ripple/RPCHandler.cpp b/src/cpp/ripple/RPCHandler.cpp index 1640285c3f..d64058002e 100644 --- a/src/cpp/ripple/RPCHandler.cpp +++ b/src/cpp/ripple/RPCHandler.cpp @@ -2757,6 +2757,14 @@ Json::Value RPCHandler::doSubscribe(Json::Value jvRequest, int& cost) for (Json::Value::iterator it = jvRequest["books"].begin(); it != jvRequest["books"].end(); it++) { Json::Value& jvSubRequest = *it; + + if (!jvSubRequest.isObject() + || !jvSubRequest.isMember("taker_pays") + || !jvSubRequest.isMember("taker_gets") + || !jvSubRequest["taker_pays"].isObject() + || !jvSubRequest["taker_gets"].isObject()) + return rpcError(rpcINVALID_PARAMS); + uint160 uTakerPaysCurrencyID; uint160 uTakerPaysIssuerID; uint160 uTakerGetsCurrencyID; @@ -2766,12 +2774,8 @@ Json::Value RPCHandler::doSubscribe(Json::Value jvRequest, int& cost) bool bSnapshot = (jvSubRequest.isMember("snapshot") && jvSubRequest["snapshot"].asBool()) || (jvSubRequest.isMember("start_now") && jvSubRequest["start_now"].asBool()); // DEPRECATED - - if (!jvSubRequest.isMember("taker_pays") || !jvSubRequest.isMember("taker_gets")) - return rpcError(rpcINVALID_PARAMS); - - Json::Value jvTakerPays = jvSubRequest["taker_pays"]; - Json::Value jvTakerGets = jvSubRequest["taker_gets"]; + Json::Value jvTakerPays = jvSubRequest["taker_pays"]; + Json::Value jvTakerGets = jvSubRequest["taker_gets"]; // Parse mandatory currency. if (!jvTakerPays.isMember("currency")