pyblock/pybitblock/apisnd.py
GaltRanch 893aabc85d Security audit round 2: eliminate shell=True, mask secrets, fix race conditions
- Replace all shell=True subprocess calls with Python-native processing
  (nodeconnection.py, SPV/nodeconnection.py, SPV/ppi.py)
- Mask sensitive inputs (private keys, passwords, tokens) with getpass
- Add threading.Lock to block_explorer.py shared state
- Use json.loads() instead of fragile string splitting in apisnd.py
- Add path validation before file open in apisnd.py
- Replace random.randint with secrets.randbelow for mining nonces
- Fix destructive exception handlers in clone.py and feed.py
- Replace bare except clauses with specific exceptions + logging
- Remove unused imports (psutil, xmltodict, block_visualizer, base64, say)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-03 11:15:59 -03:00

234 lines
8.4 KiB
Python

#Developer: Curly60e
#PyBLOCK its a clock of the Bitcoin blockchain.
import json
import logging
import os
import subprocess
import qrcode
import requests
import time as t
import sys
from pblogo import blogo
logger = logging.getLogger(__name__)
def clear(): # clear the screen
subprocess.run(['clear'] if os.name != 'nt' else ['cls'], shell=(os.name == 'nt'))
def apisender():
qr = qrcode.QRCode(
version=1,
error_correction=qrcode.constants.ERROR_CORRECT_L,
box_size=10,
border=4,
)
message = input("\nInsert your Message: ")
a = sys.getsizeof(message)
mini = 6000
n = (a * 50)
if n <= mini:
q = str(mini)
elif n >= mini:
k = n + mini
q = str(k)
url = 'https://api.blockstream.space/order'
sentby = " - PyBLOCK."
print("\n\tATENTION: YOU NEED TO PAY \033[1;31;40m" + q + "\033[0;37;40m MilliSats")
amountmsat = input("\nInsert the amount in MSats: ")
response = requests.post(url, data={'bid': amountmsat, 'message': message + sentby}, timeout=10)
clear()
blogo()
sh0 = response.text
while True:
if 'Bid too low' in sh0:
print("\n\t\033[1;31;40mATENTION: Per byte bid cannot be below 50 millisatoshis per byte.\033[0;37;40m\n")
print("Try again...\n")
message = input("\nInsert your Message: ")
a = sys.getsizeof(message)
mini = 6000
n = (a * 50)
if n <= mini:
q = str(mini)
elif n >= mini:
k = n + mini
q = str(k)
url = 'https://api.blockstream.space/order'
sentby = " - PyBLOCK."
print("\n\tATENTION: YOU NEED TO PAY \033[1;31;40m" + q + "\033[0;37;40m MilliSats")
amountmsat = input("\nInsert the amount in MSats: ")
response = requests.post(url, data={'bid': amountmsat, 'message': message + sentby}, timeout=10)
clear()
blogo()
sh0 = response.text
elif 'lightning_invoice' in sh0:
break
data = json.loads(sh0)
token = data.get("auth_token", "")
order = data.get("uuid", "")
amount = str(data.get("bid", 0))
invoice_data = data.get("lightning_invoice", {})
cln = invoice_data.get("payreq", "")
logger.debug("Token: %s..., Order: %s", token[:8] + "***", order)
print("\033[0;37;40mYour Order Number: \033[1;31;40m" + order + "\033[0;37;40m")
print("\033[0;37;40mAmount in MSats: \033[1;33;40m" + amount + "\033[0;37;40m\n")
clear()
blogo()
node_not = input("Do you want to pay this message with your node? Y/n: ")
if node_not in ["Y", "y"]:
lndconnectload = {"ip_port":"", "tls":"", "macaroon":"", "ln":""}
with open("blndconnect.conf", "r") as f:
lndconnectData = json.load(f)
lndconnectload = lndconnectData
if lndconnectload['ip_port']:
print("\nInvoice: " + cln + "\n")
payinvoice()
elif lndconnectload['ln']:
print("\nInvoice: " + cln + "\n")
localpayinvoice()
elif node_not in ["N", "n"]:
print("\033[1;30;47m")
qr.add_data(cln)
qr.print_ascii()
print("\033[0;37;40m")
print("\nLND Invoice: " + cln + "\n")
continue1 = input("Continue? Y: ")
if continue1 == "Y" or continue1 == "y":
donate()
else:
t.sleep(2)
def apisenderFile():
qr = qrcode.QRCode(
version=1,
error_correction=qrcode.constants.ERROR_CORRECT_L,
box_size=10,
border=4,
)
url = 'https://api.blockstream.space/order'
filepath = input("\nInsert the path to the File: ")
filepath = os.path.abspath(filepath)
if not os.path.isfile(filepath):
print("File not found.")
return
print("ATENTION: Minimum amount for sending a File is 50000 MSats")
amountmsat = input("\nInsert the amount in MSats: ")
with open(filepath, 'rb') as f:
response = requests.post(url, data={'bid': amountmsat}, files={'file': f}, timeout=10)
sh0 = response.text
while True:
try:
if 'Bid too low' in sh0:
print("\n\t\033[1;31;40mATENTION: Per byte bid cannot be below 50 millisatoshis per byte.\033[0;37;40m\n")
print("Try again...\n")
url = 'https://api.blockstream.space/order'
filepath = input("\nInsert the path to the File: ")
filepath = os.path.abspath(filepath)
if not os.path.isfile(filepath):
print("File not found.")
return
print("ATENTION: Minimum amount for sending a File is 50000 MSats")
amountmsat = input("\nInsert the amount in MSats: ")
with open(filepath, 'rb') as f:
response = requests.post(url, data={'bid': amountmsat}, files={'file': f}, timeout=10)
sh0 = response.text
elif 'lightning_invoice' in sh0:
break
except (KeyError, ValueError):
break
data = json.loads(sh0)
token = data.get("auth_token", "")
order = data.get("uuid", "")
amount = str(data.get("bid", 0))
invoice_data = data.get("lightning_invoice", {})
cln = invoice_data.get("payreq", "")
logger.debug("Token: %s..., Order: %s", token[:8] + "***", order)
print("\033[0;37;40mYour Order Number: \033[1;31;40m" + order + "\033[0;37;40m")
print("\033[0;37;40mAmount in MSats: \033[1;33;40m" + amount + "\033[0;37;40m")
clear()
blogo()
try:
node_not = input("Do you want to pay this message with your node? Y/n: ")
if node_not in ["Y", "y"]:
lndconnectload = {"ip_port":"", "tls":"", "macaroon":"", "ln":""}
with open("blndconnect.conf", "r") as f:
lndconnectData = json.load(f) # Load the file 'blndconnect.conf'
lndconnectload = lndconnectData # Copy the variable pathv to 'path'
if lndconnectload['ip_port']:
print("\nInvoice: " + cln + "\n")
payinvoice()
elif lndconnectload['ln']:
print("\nInvoice: " + cln + "\n")
localpayinvoice()
elif node_not in ["N", "n"]:
print("\033[1;30;47m")
qr.add_data(cln)
qr.print_ascii()
print("\033[0;37;40m")
print("\nLND Invoice: " + cln)
continue1 = input("Continue? Y: ")
if continue1 == "Y" or continue1 == "y":
donate()
else:
t.sleep(2)
except (KeyboardInterrupt, EOFError):
pass
def devAddr():
qr = qrcode.QRCode(
version=1,
error_correction=qrcode.constants.ERROR_CORRECT_L,
box_size=10,
border=4,
)
print("\n\t\t\033[1;33;44mGive us some love and \033[1;31;44mDONATE\033[1;33;44m us! We will appreciate it. This will be a boost to continue this beautiful project! \033[0;37;40m")
url = 'https://api.tippin.me/v1/public/addinvoice/royalfield370'
response = requests.get(url, timeout=10)
responseB = str(response.text)
responseC = responseB
lnreq = responseC.split(',')
lnbc1 = lnreq[1]
lnbc1S = str(lnbc1)
lnbc1R = lnbc1S.split(':')
lnbc1W = lnbc1R[1]
ln = str(lnbc1W)
ln1 = ln.strip('"')
clear()
blogo()
try:
node_not = input("Do you want to pay this tip with your node? Y/n: ")
if node_not in ["Y", "y"]:
lndconnectload = {"ip_port":"", "tls":"", "macaroon":"", "ln":""}
with open("blndconnect.conf", "r") as f:
lndconnectData = json.load(f)
lndconnectload = lndconnectData
if lndconnectload['ip_port']:
print("\nInvoice: " + ln1 + "\n")
payinvoice()
elif lndconnectload['ln']:
print("\nInvoice: " + ln1 + "\n")
localpayinvoice()
elif node_not in ["N", "n"]:
print("\033[1;30;47m")
qr.add_data(ln1)
qr.print_ascii()
print("\033[0;37;40m")
print("LND Invoice: " + ln1)
response.close()
except (KeyboardInterrupt, EOFError):
pass
def donate():
print("""\t\t
\033[1;31;40mPyBLOCK\033[0;37;40m Menu
\033[1;32;40mA.\033[0;37;40m Donate
<<< Back Control + C
\n\n""")
menuB = (input("\033[1;32;40mSelect option: \033[0;37;40m"))
if menuB in ["A", "a"]:
devAddr()