fix: guard against invalid CBOR in addTransaction and transaction card#227
Merged
Conversation
Reject unparseable txCbor/txJson at the addTransaction API boundary so a malformed 4-element CBOR can never be persisted, and render a degraded card with a Reject button when an existing row's txJson cannot be parsed, so a single bad row no longer crashes the whole Transactions page and locks up its UTxOs. Closes #211 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two-part defense against the bug reported in #211, where a transaction added via
POST /api/v1/addTransactionwith a non-standard 4-element CBOR wrapper was persisted as-is, then later crashed the Transactions page for the wallet — locking up its UTxOs with no way to recover because the Delete button lived on the same page that was crashing.src/pages/api/v1/addTransaction.ts: reject unparseabletxCbor(viacsl.Transaction.from_hex) and unparseabletxJsonup front with HTTP 400, so no more malformed rows can be created.src/components/pages/wallet/transactions/transaction-card.tsx: wrapJSON.parse(transaction.txJson)intry/catch. On failure, render a degraded "Unreadable transaction" card that still exposes a Reject & Delete button wired to the existingdeleteTransactionmutation, so already-poisoned wallets can recover.src/__tests__/addTransaction.test.tscovering the four new validation branches plus the happy path.Closes #211
Test plan
npx jest src/__tests__/addTransaction.test.ts— 5/5 passnpx jest— no new failures introduced (pre-existing unrelated failures inapiSecurity,botBallotsUpsert,governanceActiveProposals,multisigSDK,signTransactionremain)npx tsc --noEmit— no new errors on touched filesPOST /api/v1/addTransactionwith junktxCbor→ 400{error: "Invalid transaction CBOR: ..."}cmmoyccbt0003le04veswn9b5,cmmuuxyg40001l204bmcb6jimfrom Bug: Added transactions via API -> Cannot load 'Transactions' page #211) and confirm the page loads, the bad row shows the degraded card, and Reject & Delete frees its UTxOs.🤖 Generated with Claude Code