Skip to content

feat(pdp): enforce extraData size limits #807

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rvagg merged 5 commits into from
Dec 9, 2025
+32 −0
Merged

feat(pdp): enforce extraData size limits #807

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2df5243
feat(pdp): enforce extraData size limit at the service level (fixes #…
siddharthbaleja7 Nov 18, 2025
e61fbe4
Linting
siddharthbaleja7 Nov 18, 2025
b3f52e3
fix(pdp): enforce 256-byte extraData limit in delete piece and clarif…
siddharthbaleja7 Dec 4, 2025
80c75ec
refactor(pdp): consolidate extraData limits in handlers.go and add de…
siddharthbaleja7 Dec 5, 2025
317d533
Changes
siddharthbaleja7 Dec 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions pdp/handlers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -865,6 +865,10 @@ func (p *PDPService) handleDeleteDataSetPiece(w http.ResponseWriter, r *http.Req
http.Error(w, "Invalid extraData format (must be hex encoded)", http.StatusBadRequest)
return
}
if len(extraDataBytes) > 256 {
Copy link
Member

@rvagg rvagg Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

needs a constant like the other two please

but now they are spread across two files, how about you move the constants into this file, handlers.go, since it's the parent file of the set.

http.Error(w, "extraData too long (max 256 bytes)", http.StatusBadRequest)
Copy link
Member

@rvagg rvagg Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you've not followed the same pattern here and hard-coded 256 into the msg, use fmt.Sprintf and get the constant to do the work like your other messages

return
}
}

// Check if we have this piece or not
Expand Down
5 changes: 5 additions & 0 deletions pdp/handlers_add.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -329,6 +329,11 @@ func (p *PDPService) handleAddPieceToDataSet(w http.ResponseWriter, r *http.Requ
http.Error(w, "Invalid extraData format (must be hex encoded): "+err.Error(), http.StatusBadRequest)
return
}
if len(extraDataBytes) > MaxAddPiecesExtraDataSize {
errMsg := fmt.Sprintf("extraData size (%d bytes) exceeds the maximum allowed limit for AddPieces (%d bytes)", len(extraDataBytes), MaxAddPiecesExtraDataSize)
http.Error(w, errMsg, http.StatusBadRequest)
return
}

// Step 4: Prepare piece information
pieceDataArray, subPieceInfoMap, subPieceCidList, err := p.transformAddPiecesRequest(ctx, serviceLabel, payload.Pieces)
Expand Down
19 changes: 19 additions & 0 deletions pdp/handlers_create.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package pdp
import (
"encoding/hex"
"encoding/json"
"fmt"
"io"
"math/big"
"net/http"
Expand All @@ -17,6 +18,14 @@ import (
"github.com/filecoin-project/curio/pdp/contract"
)

const (
// MaxCreateDataSetExtraDataSize defines the limit for extraData size in CreateDataSet calls (4KB).
MaxCreateDataSetExtraDataSize = 4096

// MaxAddPiecesExtraDataSize defines the limit for extraData size in AddPieces calls (8KB).
MaxAddPiecesExtraDataSize = 8192
)

var logCreate = logger.Logger("pdp/create")

// handleCreateDataSetAndAddPieces handles the creation of a new data set and adding pieces at the same time
Expand Down Expand Up @@ -64,6 +73,11 @@ func (p *PDPService) handleCreateDataSetAndAddPieces(w http.ResponseWriter, r *h
http.Error(w, "Invalid extraData format (must be hex encoded)", http.StatusBadRequest)
return
}
if len(extraDataBytes) > MaxAddPiecesExtraDataSize {
errMsg := fmt.Sprintf("extraData size (%d bytes) exceeds the maximum allowed limit for CreateDataSetAndAddPieces (%d bytes)", len(extraDataBytes), MaxAddPiecesExtraDataSize)
http.Error(w, errMsg, http.StatusBadRequest)
return
}

// Check if indexing is needed by decoding the extraData
mustIndex, err := CheckIfIndexingNeededFromExtraData(extraDataBytes)
Expand Down Expand Up @@ -224,6 +238,11 @@ func (p *PDPService) handleCreateDataSet(w http.ResponseWriter, r *http.Request)
http.Error(w, "Invalid extraData format (must be hex encoded): "+err.Error(), http.StatusBadRequest)
return
}
if len(extraDataBytes) > MaxCreateDataSetExtraDataSize {
errMsg := fmt.Sprintf("extraData size (%d bytes) exceeds the maximum allowed limit for CreateDataSet (%d bytes)", len(extraDataBytes), MaxCreateDataSetExtraDataSize)
http.Error(w, errMsg, http.StatusBadRequest)
return
}

// Step 3: Get the sender address from 'eth_keys' table where role = 'pdp' limit 1
fromAddress, err := p.getSenderAddress(ctx)
Expand Down