mirror of
https://github.com/Ride-The-Lightning/RTL.git
synced 2026-08-13 12:33:07 +02:00
request has been deprecated since 2020 with an unfixed SSRF advisory and pins vulnerable copies of form-data (critical), qs, tough-cookie and uuid - 8 of the 13 remaining production audit findings, none fixable by version bumps (issue #1634, item 1). All 36 backend files that imported request-promise now use a small compatibility wrapper (server/utils/request.ts) backed by axios, which is already a production dependency. The wrapper accepts the existing options shape (qs, form - object or pre-encoded string, body, baseUrl/uri, rejectUnauthorized, json), resolves with the response body directly, and rejects with a plain object mirroring request-promise's StatusCodeError/RequestError shape, so CommonService.handleError works unchanged (ECONNREFUSED -> 503, Eclair StatusCodeError -> 500, nested error body extraction). Auth headers are excluded from rejected errors so they cannot leak into logs. Callers without json: true (block explorer, currency rates) still get raw text bodies, and LND's line-delimited /v2/router/send stream still surfaces as a string for the existing parser. Only behavioral code change: CLN verifyMessage used request-promise's callback style and was ported to the same promise style as signMessage; four Eclair handlers gained explicit returns to satisfy noImplicitReturns once the import became typed. Production npm audit drops from 13 findings (2 critical) to 6 low, all in the crypto-browserify/elliptic chain tracked in #1634. Verified against the docker regtest fixture with 43 API checks across LND, Core Lightning and Eclair: reads, invoice creation, a routed LND payment over the streaming endpoint, cross-implementation payments from CLN and Eclair, message sign/verify, channel backup to disk, and bad-invoice/node-unreachable error mapping. Lint and both production builds are clean.
146 lines
8.3 KiB
TypeScript
146 lines
8.3 KiB
TypeScript
import request from '../../utils/request.js';
|
|
import { Logger, LoggerService } from '../../utils/logger.js';
|
|
import { Common, CommonService } from '../../utils/common.js';
|
|
import { SelectedNode } from '../../models/config.model.js';
|
|
let options = null;
|
|
const logger: LoggerService = Logger;
|
|
const common: CommonService = Common;
|
|
|
|
export const getSentInfoFromPaymentRequest = (selNode: SelectedNode, payment) => {
|
|
options.url = selNode.settings.lnServerUrl + '/getsentinfo';
|
|
options.form = { paymentHash: payment };
|
|
return request.post(options).then((body) => {
|
|
logger.log({ selectedNode: selNode, level: 'DEBUG', fileName: 'Payments', msg: 'Payment Sent Information Received', data: body });
|
|
body.forEach((sentPayment) => {
|
|
if (sentPayment.amount) { sentPayment.amount = Math.round(sentPayment.amount / 1000); }
|
|
if (sentPayment.recipientAmount) { sentPayment.recipientAmount = Math.round(sentPayment.recipientAmount / 1000); }
|
|
});
|
|
return body;
|
|
}).catch((err) => err);
|
|
};
|
|
|
|
export const getQueryNodes = (selNode: SelectedNode, nodeIds) => {
|
|
options.url = selNode.settings.lnServerUrl + '/nodes';
|
|
options.form = { nodeIds: nodeIds?.reduce((acc, curr) => acc + ',' + curr) };
|
|
return request.post(options).then((nodes) => {
|
|
logger.log({ selectedNode: selNode, level: 'DEBUG', fileName: 'Payments', msg: 'Query Nodes Received', data: nodes });
|
|
return nodes;
|
|
}).catch((err) => []);
|
|
};
|
|
|
|
export const decodePayment = (req, res, next) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Decoding Payment..' });
|
|
options = common.getOptions(req);
|
|
if (options.error) { return res.status(options.statusCode).json({ message: options.message, error: options.error }); }
|
|
options.url = req.session.selectedNode.settings.lnServerUrl + '/parseinvoice';
|
|
options.form = { invoice: req.params.invoice };
|
|
request.post(options).then((body) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Payment Decoded', data: body });
|
|
if (body.amount) { body.amount = Math.round(body.amount / 1000); }
|
|
res.status(200).json(body);
|
|
}).catch((errRes) => {
|
|
const err = common.handleError(errRes, 'Payments', 'Decode Payment Error', req.session.selectedNode);
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
});
|
|
};
|
|
|
|
export const postPayment = (req, res, next) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Paying Invoice..' });
|
|
options = common.getOptions(req);
|
|
if (options.error) { return res.status(options.statusCode).json({ message: options.message, error: options.error }); }
|
|
options.url = req.session.selectedNode.settings.lnServerUrl + '/payinvoice';
|
|
options.form = req.body;
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Payments', msg: 'Send Payment Options', data: options.form });
|
|
request.post(options).then((body) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Invoice Paid', data: body });
|
|
res.status(201).json(body);
|
|
}).catch((errRes) => {
|
|
const err = common.handleError(errRes, 'Payments', 'Send Payment Error', req.session.selectedNode);
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
});
|
|
};
|
|
|
|
export const queryPaymentRoute = (req, res, next) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Querying Payment Route..' });
|
|
options = common.getOptions(req);
|
|
if (options.error) { return res.status(options.statusCode).json({ message: options.message, error: options.error }); }
|
|
options.url = req.session.selectedNode.settings.lnServerUrl + '/findroutetonode';
|
|
options.form = {
|
|
nodeId: req.query.nodeId,
|
|
amountMsat: req.query.amountMsat
|
|
};
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Payments', msg: 'Query Payment Route Options', data: options.form });
|
|
request.post(options).then((body) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Payments', msg: 'Query Payment Route Received', data: body });
|
|
if (body && body.routes && body.routes.length) {
|
|
let allRoutesNodeIds = [];
|
|
allRoutesNodeIds = body.routes?.reduce((accRoutes, currRoute) => [...new Set([...accRoutes, ...currRoute.nodeIds])], []);
|
|
return getQueryNodes(req.session.selectedNode, allRoutesNodeIds).then((nodesWithAlias) => {
|
|
let foundPeer = null;
|
|
body.routes.forEach((route, i) => {
|
|
route.nodeIds?.map((node, j) => {
|
|
foundPeer = nodesWithAlias.find((nodeWithAlias) => node === nodeWithAlias.nodeId);
|
|
body.routes[i].nodeIds[j] = { nodeId: node, alias: foundPeer ? foundPeer.alias : '' };
|
|
return node;
|
|
});
|
|
});
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Query Routes with Alias Received', data: body });
|
|
res.status(200).json(body);
|
|
});
|
|
} else {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Empty Payment Route Information Received' });
|
|
return res.status(200).json({ routes: [] });
|
|
}
|
|
}).catch((errRes) => {
|
|
const err = common.handleError(errRes, 'Payments', 'Query Route Error', req.session.selectedNode);
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
});
|
|
};
|
|
|
|
export const getSentPaymentsInformation = (req, res, next) => {
|
|
const { payments } = req.body;
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Getting Sent Payment Information..' });
|
|
options = common.getOptions(req);
|
|
if (options.error) { return res.status(options.statusCode).json({ message: options.message, error: options.error }); }
|
|
if (payments) {
|
|
const paymentsArr = payments.split(',');
|
|
return Promise.all(paymentsArr?.map((payment) => getSentInfoFromPaymentRequest(req.session.selectedNode, payment))).
|
|
then((values) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Payment Sent Information Received', data: values });
|
|
return res.status(200).json(values);
|
|
}).
|
|
catch((errRes) => {
|
|
const err = common.handleError(errRes, 'Payments', 'Sent Payment Error', req.session.selectedNode);
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
});
|
|
} else {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Empty Sent Payment Information Received' });
|
|
return res.status(200).json([]);
|
|
}
|
|
};
|
|
|
|
export const sendPaymentToRouteRequestCall = (selectedNode: SelectedNode, shortChannelIds: string, invoice: string, amountMsat: number) => {
|
|
logger.log({ selectedNode: selectedNode, level: 'INFO', fileName: 'Invoices', msg: 'Creating Invoice..' });
|
|
options = selectedNode.authentication.options;
|
|
options.url = selectedNode.settings.lnServerUrl + '/sendtoroute';
|
|
options.form = { shortChannelIds: shortChannelIds, amountMsat: amountMsat, invoice: invoice };
|
|
return new Promise((resolve, reject) => {
|
|
logger.log({ selectedNode: selectedNode, level: 'DEBUG', fileName: 'Payments', msg: 'Send Payment To Route Options', data: options.form });
|
|
request.post(options).then((body) => {
|
|
logger.log({ selectedNode: selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Payment Sent To Route', data: body });
|
|
resolve(body);
|
|
}).catch((errRes) => {
|
|
reject(common.handleError(errRes, 'Payments', 'Send Payment To Route Error', selectedNode));
|
|
});
|
|
});
|
|
};
|
|
|
|
export const sendPaymentToRoute = (req, res, next) => {
|
|
const { shortChannelIds, invoice, amountMsat } = req.body;
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Send Payment To Route..' });
|
|
options = common.getOptions(req);
|
|
if (options.error) { return res.status(options.statusCode).json({ message: options.message, error: options.error }); }
|
|
sendPaymentToRouteRequestCall(req.session.selectedNode, shortChannelIds, invoice, amountMsat).then((callRes) => {
|
|
res.status(200).json(callRes);
|
|
}).catch((err) => res.status(err.statusCode).json({ message: err.message, error: err.error }));
|
|
};
|