Commit Graph

7 Commits

Author SHA1 Message Date
drlongle
78076a6903 fix!: Prevent API from accepting seed or public key for account (#4404)
The API would allow seeds (and public keys) to be used in place of
accounts at several locations in the API. For example, when calling
account_info, you could pass `"account": "foo"`. The string "foo" is
treated like a seed, so the method returns `actNotFound` (instead of
`actMalformed`, as most developers would expect). In the early days,
this was a convenience to make testing easier. However, it allows for
poor security practices, so it is no longer a good idea. Allowing a
secret or passphrase is now considered a bug. Previously, it was
controlled by the `strict` option on some methods. With this commit,
since the API does not interpret `account` as `seed`, the option
`strict` is no longer needed and is removed.

Removing this behavior from the API is a [breaking
change](https://xrpl.org/request-formatting.html#breaking-changes). One
could argue that it shouldn't be done without bumping the API version;
however, in this instance, there is no evidence that anyone is using the
API in the "legacy" way. Furthermore, it is a potential security hole,
as it allows users to send secrets to places where they are not needed,
where they could end up in logs, error messages, etc. There's no reason
to take such a risk with a seed/secret, since only the public address is
needed.

Resolves: #3329, #3330, #4337

BREAKING CHANGE: Remove non-strict account parsing (#3330)
2023-05-16 17:22:10 -07:00
Pretty Printer
50760c6935 Format first-party source according to .clang-format 2020-04-23 10:02:04 -07:00
Mo Morsi
f8365f5009 Add JsonOptions enum class to contain options passed to getJSON methods 2019-06-13 20:40:33 -07:00
Scott Schurr
64b55c0f88 Rename JsonFields.h to jss.h:
At this point all of the jss::* names are defined in the same
file.  That file has been named JsonFields.h.  That file name
has little to do with either JsonStaticStrings (which is what
jss is short for) or with jss.  The file is renamed to jss.h
so the file name better reflects what the file contains.

All includes of that file are fixed.  A few include order
issues are tidied up along the way.
2019-04-26 11:21:52 -07:00
Joe Loser
7c785d0d7c Add missing override keyword:
* Enable the `suggest-override` warning for gcc
* Fix all functions that were flagged by that warning
2018-06-01 13:29:52 -04:00
Nik Bougalis
463b154e3d Improve directory insertion & deletion (RIPD-1353, RIPD-1488):
This commit introduces the "SortedDirectories" amendment, which
addresses two distinct issues:

First, it corrects a technical flaw that could, in some edge cases,
prevent an empty intermediate page from being deleted.

Second, it sorts directory entries within a page (other than order
book page entries, which remain strictly FIFO). This makes insert
operations deterministic, instead of pseudo-random and reliant on
temporal ordering.

Lastly, it removes the ability to perform a "soft delete" where
the page number of the item to delete need not be known if the
item is in the first 20 pages, and enforces a maximum limit to
the number of pages that a directory can span.
2017-07-31 18:39:59 -04:00
Mike Ellery
1daefeb594 Add unit test for owner_info (RIPD-1416)
This RPC method is deprecated, but i've added a basic test to cover it
until we actually remove it.
2017-07-11 12:54:28 -04:00