safe-global / safe-eth-py / 35743833947

94%

Build Type

push

github

Committed by web-flow

Commit Message

fix: Disable CCIP-Read by default in the Ethereum clients (#2751)

* fix: Disable CCIP-Read by default in the Ethereum clients

web3.py enables CCIP-Read (ERC-3668) by default, so `eth_call` follows a url
embedded in a contract revert. Any contract queried can make the client issue
outbound HTTP requests to a host it picks, and the failure surfaces as an
uncaught `requests` error.

Turn it off in `EthereumClient` and `AsyncEthereumClient`. Opt in with the
`ccip_read_enabled` argument or `ETHEREUM_RPC_CCIP_READ_ENABLED`.

Warn when it is enabled on a web3 older than 7.15, which does not validate
offchain lookup urls and follows any url given.

* chore: Require web3>=7.15 for CCIP-Read url validation

web3 validates CCIP-Read urls, rejecting private address ranges and enforcing
HTTPS, from 7.15.0. Requiring that version drops the runtime warning and the
feature probe that covered older ones.

* refactor: Move get_bool_env to safe_eth/util/environment.py

Keeps environment parsing in its own module instead of the generic util one,
matching how util/http.py is split by concern.

* refactor: Tidy up CCIP-Read tests and docs

Encode the test revert payload with web3's own OffchainLookup selector and
field types instead of hardcoded copies, so the mock tracks what web3 decodes.

Merge the two constructor flag tests, drop the env test case that only
re-asserted the default, and record next to the web3 pin why 7.15 is the floor.

Move the security caveat onto the public `ccip_read_enabled` docstring, where
callers enabling it will read it, instead of the private hook.

* fix: Address CCIP-Read review findings

Treat an empty env var as unset. `FOO=${FOO}` in docker-compose declares a
variable with no value, which is normal config, not a typo, so it no longer
logs a warning on every client construction.

Spell out the OffchainLookup selector and field types again instead of
importing them from `web3._utils`. They are fixed by EIP-3668, and a private
web3 module... (continued)

Coverage Stats

98 of 98 new or added lines in 6 files covered. (100.0%)

1 existing line in 1 file now uncovered.

11407 of 12202 relevant lines covered (93.48%)

3.74 hits per line