GlcoinCore/mempool
1
0
Fork 0
mirror of https://github.com/mempool/mempool.git synced 2026-08-13 12:33:11 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

add missing validation to transaction-times route

Browse source
This commit is contained in:
mononaut 2026-05-28 05:23:08 +00:00
parent 1fafd9c414
commit 8eb3fbc86e
No known key found for this signature in database
GPG key ID: BFD16BE592A9CD8D
1 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
backend/src/api/bitcoin/bitcoin.routes.ts
View file

@ -28,6 +28,7 @@ const TXID_REGEX = /^[a-f0-9]{64}$/i;
const BLOCK_HASH_REGEX = /^[a-f0-9]{64}$/i;
const ADDRESS_REGEX = /^[a-z0-9]{2,120}$/i;
const SCRIPT_HASH_REGEX = /^([a-f0-9]{2})+$/i;
const MAX_TRANSACTION_TIMES = 100;
class BitcoinRoutes {
public initRoutes(app: Application) {
@ -147,8 +148,15 @@ class BitcoinRoutes {
handleError(req, res, 500, 'invalid txId format');
return;
}
const requestedTxIds = Object.values(req.query.txId);
if (requestedTxIds.length > MAX_TRANSACTION_TIMES) {
handleError(req, res, 400, 'Too many txids requested');
return;
}
const txIds: string[] = [];
for (const txid of Object.values(req.query.txId)) {
for (const txid of requestedTxIds) {
if (typeof txid === 'string' && TXID_REGEX.test(txid)) {
txIds.push(txid);
}