mirror of
https://github.com/Ride-The-Lightning/RTL.git
synced 2026-08-13 12:33:07 +02:00
request has been deprecated since 2020 with an unfixed SSRF advisory and pins vulnerable copies of form-data (critical), qs, tough-cookie and uuid - 8 of the 13 remaining production audit findings, none fixable by version bumps (issue #1634, item 1). All 36 backend files that imported request-promise now use a small compatibility wrapper (server/utils/request.ts) backed by axios, which is already a production dependency. The wrapper accepts the existing options shape (qs, form - object or pre-encoded string, body, baseUrl/uri, rejectUnauthorized, json), resolves with the response body directly, and rejects with a plain object mirroring request-promise's StatusCodeError/RequestError shape, so CommonService.handleError works unchanged (ECONNREFUSED -> 503, Eclair StatusCodeError -> 500, nested error body extraction). Auth headers are excluded from rejected errors so they cannot leak into logs. Callers without json: true (block explorer, currency rates) still get raw text bodies, and LND's line-delimited /v2/router/send stream still surfaces as a string for the existing parser. Only behavioral code change: CLN verifyMessage used request-promise's callback style and was ported to the same promise style as signMessage; four Eclair handlers gained explicit returns to satisfy noImplicitReturns once the import became typed. Production npm audit drops from 13 findings (2 critical) to 6 low, all in the crypto-browserify/elliptic chain tracked in #1634. Verified against the docker regtest fixture with 43 API checks across LND, Core Lightning and Eclair: reads, invoice creation, a routed LND payment over the streaming endpoint, cross-implementation payments from CLN and Eclair, message sign/verify, channel backup to disk, and bad-invoice/node-unreachable error mapping. Lint and both production builds are clean.
94 lines
5.6 KiB
JavaScript
94 lines
5.6 KiB
JavaScript
import request from '../../utils/request.js';
|
|
import { Logger } from '../../utils/logger.js';
|
|
import { Common } from '../../utils/common.js';
|
|
import { getAlias } from './network.js';
|
|
let options = null;
|
|
const logger = Logger;
|
|
const common = Common;
|
|
export const getPeers = (req, res, next) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Peers', msg: 'List Peers..' });
|
|
options = common.getOptions(req);
|
|
if (options.error) {
|
|
return res.status(options.statusCode).json({ message: options.message, error: options.error });
|
|
}
|
|
options.url = req.session.selectedNode.settings.lnServerUrl + '/v1/listpeers';
|
|
request.post(options).then((body) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Peers', msg: 'Peers List Received', data: body });
|
|
const peers = !body.peers ? [] : body.peers;
|
|
// Resolve peer aliases with a bounded number of concurrent listnodes calls. An unbounded
|
|
// Promise.all here fires one request per peer at once, which overwhelms clnrest on nodes
|
|
// with many peers and fails with "Resource temporarily unavailable (os error 11)" (#1501).
|
|
const getPeerAliasesTasks = peers.map((peer) => () => getAlias(req.session.selectedNode, peer, 'id'));
|
|
common.runWithConcurrencyLimit(getPeerAliasesTasks, 20, () => {
|
|
// The limiter invokes this outside the surrounding .then/.catch chain, so guard the
|
|
// response-send: a throw here would otherwise be an unhandled rejection with no response.
|
|
try {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Peers', msg: 'Sorted Peers List Received', data: body.peers });
|
|
res.status(200).json(body.peers || []);
|
|
}
|
|
catch (e) {
|
|
const err = common.handleError(e, 'Peers', 'List Peers Error', req.session.selectedNode);
|
|
if (!res.headersSent) {
|
|
res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
}
|
|
}
|
|
});
|
|
}).catch((errRes) => {
|
|
const err = common.handleError(errRes, 'Peers', 'List Peers Error', req.session.selectedNode);
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
});
|
|
};
|
|
export const postPeer = (req, res, next) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Peers', msg: 'Connecting Peer..' });
|
|
options = common.getOptions(req);
|
|
if (options.error) {
|
|
return res.status(options.statusCode).json({ message: options.message, error: options.error });
|
|
}
|
|
options.url = req.session.selectedNode.settings.lnServerUrl + '/v1/connect';
|
|
options.body = req.body;
|
|
request.post(options).then((connectRes) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Peers', msg: 'Peer Connected', data: connectRes });
|
|
const listOptions = common.getOptions(req);
|
|
listOptions.url = req.session.selectedNode.settings.lnServerUrl + '/v1/listpeers';
|
|
request.post(listOptions).then((listPeersRes) => {
|
|
const peers = listPeersRes && listPeersRes.peers ? common.newestOnTop(listPeersRes.peers, 'id', connectRes.id) : [];
|
|
// Resolve aliases (bounded) for the returned peers so a freshly connected peer shows its
|
|
// alias rather than a raw node id, matching getPeers and the LND postPeer path (#1629 F5).
|
|
const getPeerAliasesTasks = peers.map((peer) => () => getAlias(req.session.selectedNode, peer, 'id'));
|
|
common.runWithConcurrencyLimit(getPeerAliasesTasks, 20, () => {
|
|
try {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Peers', msg: 'Peers List after Connect Received', data: peers });
|
|
res.status(201).json(peers);
|
|
}
|
|
catch (e) {
|
|
const err = common.handleError(e, 'Peers', 'Connect Peer Error', req.session.selectedNode);
|
|
if (!res.headersSent) {
|
|
res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
}
|
|
}
|
|
});
|
|
}).catch((errRes) => {
|
|
const err = common.handleError(errRes, 'Peers', 'Connect Peer Error', req.session.selectedNode);
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
});
|
|
}).catch((errRes) => {
|
|
const err = common.handleError(errRes, 'Peers', 'Connect Peer Error', req.session.selectedNode);
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
});
|
|
};
|
|
export const deletePeer = (req, res, next) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Peers', msg: 'Disconnecting Peer..' });
|
|
options = common.getOptions(req);
|
|
if (options.error) {
|
|
return res.status(options.statusCode).json({ message: options.message, error: options.error });
|
|
}
|
|
options.url = req.session.selectedNode.settings.lnServerUrl + '/v1/disconnect';
|
|
options.body = req.body;
|
|
request.post(options).then((body) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Peers', msg: 'Peer Disconnected', data: body });
|
|
res.status(204).json({});
|
|
}).catch((errRes) => {
|
|
const err = common.handleError(errRes, 'Peers', 'Detach Peer Error', req.session.selectedNode);
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
});
|
|
};
|