fix: remove network_url usage from simulate-tx and submit-tx routes#303
fix: remove network_url usage from simulate-tx and submit-tx routes#303aristidesstaffieri merged 2 commits intomainfrom
Conversation
…300 follow-up) Prevents SSRF by ignoring user-provided network_url in /simulate-tx and /submit-tx, resolving the RPC server from network_passphrase instead. The schema still accepts network_url for backwards compatibility but the value is no longer read. Adds tests for both routes covering the new behavior.
There was a problem hiding this comment.
Pull request overview
This PR updates the /simulate-tx and /submit-tx API routes to ignore any user-provided network_url and instead derive the target network/RPC endpoint from network_passphrase, while keeping network_url in the request schema for backward compatibility.
Changes:
/simulate-tx: stop usingnetwork_url; resolve RPC server vianetwork_passphrase→ network name → configured RPC URL./submit-tx: continue acceptingnetwork_urlbut ignore it (now explicitly documented + tested).- Add/adjust route tests to cover ignoring
network_urland handling unknownnetwork_passphrase.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
src/route/index.ts |
Stops reading network_url for /simulate-tx (and documents ignore behavior for both routes); resolves RPC server from network_passphrase. |
src/route/index.test.ts |
Updates existing simulate test to not require network_url and adds coverage ensuring network_url is ignored + unknown passphrase yields 400. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
src/route/index.ts
Outdated
| // network_url is accepted for backwards compatibility but ignored | ||
| network_url: { type: "string" }, |
There was a problem hiding this comment.
Most web frameworks ignore extra arguments by default, do we need it listed here because /submit-tx will return 400 if its included?
There was a problem hiding this comment.
its not functionally needed here, they just served as a reference. The framework will strip them out since we set removeAdditional: true.
Removed them in ac1014d
AJV's removeAdditional:true already silently strips unknown fields, so explicitly listing network_url in the schema was unnecessary.
What
Ignores user-provided network_url in /simulate-tx and /submit-tx, resolving the RPC server from network_passphrase instead. The schema still accepts network_url for backwards compatibility but the value is no longer read.
Adds tests for both routes covering the new behavior