hyperledger-labs / fabric-smart-client / 29744281276

81%

Build Type

push

github

Committed by web-flow

Commit Message

fix(security): harden responder-view input validation and endorsement checks (#1594)

* fix(security): harden responder-view input validation and endorsement checks

Malformed or adversarial input from a remote peer over a P2P session could
panic a responder goroutine, leak internal error detail back to the caller,
or bypass endorsement signature/binding verification. This adds explicit
validation at the wire-deserialization boundary and enforces endorsement
verification on both the sequential and parallel collection paths.

Refs #1593

Signed-off-by: Angelo De Caro <adc@zurich.ibm.com>

* fix(security): address PR #1594 review comments

- Fix "filed getting rw set" -> "failed getting rw set" typo in the
  Namespaces() panic message and its test expectation.
- Name the receiveView receive-timeout constant instead of an inline
  magic number, matching the existing session-level default.
- Bound the previously-unbounded wait on answerChannel in
  parallelCollectEndorsementsOnProposalView.Call: session
  establishment/send inside collectEndorsement (and the wait itself)
  were not covered by WithTimeout, whose value defaults to zero at the
  only production call site. Add an aggregate deadline that applies
  even when WithTimeout is never called.

Signed-off-by: Angelo De Caro <adc@zurich.ibm.com>

---------

Signed-off-by: Angelo De Caro <adc@zurich.ibm.com>

Coverage Stats

58 of 74 new or added lines in 8 files covered. (78.38%)

5 existing lines in 3 files now uncovered.

32100 of 39520 relevant lines covered (81.22%)

2983.16 hits per line