feat(pdp): enforce extraData size limits #807
Conversation
|
@rjan90 can you please review this PR? |
1 similar comment
|
@rjan90 can you please review this PR? |
|
@siddharthbaleja7 this is fine, but can you do a couple of things here please also update handleDeleteDataSetPiece as well, it should have a limit of 256 bytes. |
pdp/handlers_create.go
Outdated
| // MaxCreateDataSetExtraDataSize defines the service-level limit for extraData in CreateDataSet calls (4KB). | ||
| // Recommended in FilOzone/pdp#224. | ||
| MaxCreateDataSetExtraDataSize = 4096 | ||
|
|
||
| // MaxAddPiecesExtraDataSize defines the service-level limit for extraData in AddPieces calls (8KB). | ||
| // Recommended in FilOzone/pdp#224. |
There was a problem hiding this comment.
| // MaxCreateDataSetExtraDataSize defines the service-level limit for extraData in CreateDataSet calls (4KB). | |
| // Recommended in FilOzone/pdp#224. | |
| MaxCreateDataSetExtraDataSize = 4096 | |
| // MaxAddPiecesExtraDataSize defines the service-level limit for extraData in AddPieces calls (8KB). | |
| // Recommended in FilOzone/pdp#224. | |
| // MaxCreateDataSetExtraDataSize defines the limit for extraData size in CreateDataSet calls (4KB). | |
| MaxCreateDataSetExtraDataSize = 4096 | |
| // MaxAddPiecesExtraDataSize defines the limit for extraData size in AddPieces calls (8KB). |
rvagg
changed the title
|
Updating terminology here - this is not the "service level", that's in the contract, this is the "server". This doesn't strictly need to be done here, it's done in contract, but this is just a nice-to-have to prevent size blow-outs when dealing with alternative service contracts. |
|
FWIW the actual service-level implementation is here: FilOzone/filecoin-services#313 - that's where you can see the limits at work in contracts |
pdp/handlers.go
Outdated
| http.Error(w, "Invalid extraData format (must be hex encoded)", http.StatusBadRequest) | ||
| return | ||
| } | ||
| if len(extraDataBytes) > 256 { |
There was a problem hiding this comment.
needs a constant like the other two please
but now they are spread across two files, how about you move the constants into this file, handlers.go, since it's the parent file of the set.
pdp/handlers.go
Outdated
| return | ||
| } | ||
| if len(extraDataBytes) > MaxDeletePieceExtraDataSize { | ||
| http.Error(w, "extraData too long (max 256 bytes)", http.StatusBadRequest) |
There was a problem hiding this comment.
you've not followed the same pattern here and hard-coded 256 into the msg, use fmt.Sprintf and get the constant to do the work like your other messages
2 participants
Description
This PR implements service-level validation for the
extraDatapayload size in PDP (Proof of Data Possession) requests. Following the removal of the hard limit in the PDPVerifier contract (FilOzone/pdp#224), this logic is now enforced within Curio to prevent excessively large metadata payloads from being processed. I have verified these changes locally to ensure that the limits are enforced correctly and oversized payloads are rejected.Fixes #713
Changes Proposed
1. Defined Size Limits
MaxCreateDataSetExtraDataSize: Set to 4KB (4096 bytes) forcreateDataSet.MaxAddPiecesExtraDataSize: Set to 8KB (8192 bytes) foraddPiecesandcreateDataSetAndAddPieces.2. Validation Logic (Fail Fast)
Implemented size checks in the following handlers:
handleCreateDataSethandleCreateDataSetAndAddPieceshandleAddPieceToDataSetChecklist