mirror of
https://github.com/Ride-The-Lightning/RTL.git
synced 2026-08-13 12:33:07 +02:00
request has been deprecated since 2020 with an unfixed SSRF advisory and pins vulnerable copies of form-data (critical), qs, tough-cookie and uuid - 8 of the 13 remaining production audit findings, none fixable by version bumps (issue #1634, item 1). All 36 backend files that imported request-promise now use a small compatibility wrapper (server/utils/request.ts) backed by axios, which is already a production dependency. The wrapper accepts the existing options shape (qs, form - object or pre-encoded string, body, baseUrl/uri, rejectUnauthorized, json), resolves with the response body directly, and rejects with a plain object mirroring request-promise's StatusCodeError/RequestError shape, so CommonService.handleError works unchanged (ECONNREFUSED -> 503, Eclair StatusCodeError -> 500, nested error body extraction). Auth headers are excluded from rejected errors so they cannot leak into logs. Callers without json: true (block explorer, currency rates) still get raw text bodies, and LND's line-delimited /v2/router/send stream still surfaces as a string for the existing parser. Only behavioral code change: CLN verifyMessage used request-promise's callback style and was ported to the same promise style as signMessage; four Eclair handlers gained explicit returns to satisfy noImplicitReturns once the import became typed. Production npm audit drops from 13 findings (2 critical) to 6 low, all in the crypto-browserify/elliptic chain tracked in #1634. Verified against the docker regtest fixture with 43 API checks across LND, Core Lightning and Eclair: reads, invoice creation, a routed LND payment over the streaming endpoint, cross-implementation payments from CLN and Eclair, message sign/verify, channel backup to disk, and bad-invoice/node-unreachable error mapping. Lint and both production builds are clean.
99 lines
5.5 KiB
TypeScript
99 lines
5.5 KiB
TypeScript
import request from '../../utils/request.js';
|
|
import { Logger, LoggerService } from '../../utils/logger.js';
|
|
import { Common, CommonService } from '../../utils/common.js';
|
|
import { LNDWSClient, LNDWebSocketClient } from './webSocketClient.js';
|
|
|
|
let options = null;
|
|
const logger: LoggerService = Logger;
|
|
const common: CommonService = Common;
|
|
const lndWsClient: LNDWebSocketClient = LNDWSClient;
|
|
|
|
const KEYSEND_MESSAGE_TLV_TYPE = '34349334';
|
|
|
|
const extractKeysendMessage = (invoice) => {
|
|
if (invoice.is_keysend && (!invoice.memo || invoice.memo === '') && invoice.htlcs && invoice.htlcs.length > 0) {
|
|
for (const htlc of invoice.htlcs) {
|
|
if (htlc.custom_records && htlc.custom_records[KEYSEND_MESSAGE_TLV_TYPE]) {
|
|
try {
|
|
return Buffer.from(htlc.custom_records[KEYSEND_MESSAGE_TLV_TYPE], 'base64').toString('utf8');
|
|
} catch (err) {
|
|
return '';
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return invoice.memo || '';
|
|
};
|
|
|
|
export const invoiceLookup = (req, res, next) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Invoice', msg: 'Getting Invoice Information..' });
|
|
options = common.getOptions(req);
|
|
if (options.error) { return res.status(options.statusCode).json({ message: options.message, error: options.error }); }
|
|
options.url = req.session.selectedNode.settings.lnServerUrl + '/v2/invoices/lookup';
|
|
if (req.query.payment_addr) {
|
|
options.url = options.url + '?payment_addr=' + req.query.payment_addr;
|
|
} else {
|
|
options.url = options.url + '?payment_hash=' + req.query.payment_hash;
|
|
}
|
|
request(options).then((body) => {
|
|
body.r_preimage = body.r_preimage ? Buffer.from(body.r_preimage, 'base64').toString('hex') : '';
|
|
body.r_hash = body.r_hash ? Buffer.from(body.r_hash, 'base64').toString('hex') : '';
|
|
body.description_hash = body.description_hash ? Buffer.from(body.description_hash, 'base64').toString('hex') : null;
|
|
body.memo = extractKeysendMessage(body);
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Invoice', msg: 'Invoice Information Received', data: body });
|
|
res.status(200).json(body);
|
|
}).catch((errRes) => {
|
|
const err = common.handleError(errRes, 'Invoices', 'Invoice Lookup Error', req.session.selectedNode);
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
});
|
|
};
|
|
|
|
export const listInvoices = (req, res, next) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Invoice', msg: 'Getting List Invoices..' });
|
|
options = common.getOptions(req);
|
|
if (options.error) { return res.status(options.statusCode).json({ message: options.message, error: options.error }); }
|
|
options.url = req.session.selectedNode.settings.lnServerUrl + '/v1/invoices?num_max_invoices=' + req.query.num_max_invoices + '&index_offset=' + req.query.index_offset +
|
|
'&reversed=' + req.query.reversed;
|
|
request(options).then((body) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Invoice', msg: 'Invoices List Received', data: body });
|
|
if (body.invoices && body.invoices.length > 0) {
|
|
body.invoices.forEach((invoice) => {
|
|
invoice.r_preimage = invoice.r_preimage ? Buffer.from(invoice.r_preimage, 'base64').toString('hex') : '';
|
|
invoice.r_hash = invoice.r_hash ? Buffer.from(invoice.r_hash, 'base64').toString('hex') : '';
|
|
invoice.description_hash = invoice.description_hash ? Buffer.from(invoice.description_hash, 'base64').toString('hex') : null;
|
|
invoice.memo = extractKeysendMessage(invoice);
|
|
});
|
|
}
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Invoice', msg: 'Sorted Invoices List Received', data: body });
|
|
res.status(200).json(body);
|
|
}).catch((errRes) => {
|
|
const err = common.handleError(errRes, 'Invoices', 'List Invoices Error', req.session.selectedNode);
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
});
|
|
};
|
|
|
|
export const addInvoice = (req, res, next) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Invoice', msg: 'Adding Invoice..' });
|
|
options = common.getOptions(req);
|
|
if (options.error) { return res.status(options.statusCode).json({ message: options.message, error: options.error }); }
|
|
options.url = req.session.selectedNode.settings.lnServerUrl + '/v1/invoices';
|
|
options.form = JSON.stringify(req.body);
|
|
request.post(options).then((body) => {
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Invoice', msg: 'Invoice Added', data: body });
|
|
try {
|
|
if (body.r_hash) {
|
|
lndWsClient.subscribeToInvoice(options, req.session.selectedNode, body.r_hash);
|
|
}
|
|
} catch (errRes) {
|
|
const err = common.handleError(errRes, 'Invoices', 'Subscribe to Newly Added Invoice Error', req.session.selectedNode);
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'ERROR', fileName: 'Invoice', msg: 'Subscribe to Newly Added Invoice Error', error: err });
|
|
}
|
|
body.r_preimage = body.r_preimage ? Buffer.from(body.r_preimage, 'base64').toString('hex') : '';
|
|
body.r_hash = body.r_hash ? Buffer.from(body.r_hash, 'base64').toString('hex') : '';
|
|
body.description_hash = body.description_hash ? Buffer.from(body.description_hash, 'base64').toString('hex') : null;
|
|
res.status(201).json(body);
|
|
}).catch((errRes) => {
|
|
const err = common.handleError(errRes, 'Invoices', 'Add Invoice Error', req.session.selectedNode);
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
});
|
|
};
|