mirror of
https://github.com/curly60e/pyblock.git
synced 2026-08-13 12:33:15 +02:00
d79977ce00
Security (Critical): - Eliminate all shell=True command injection vectors (~95 instances in ppi.py, spvblock.py) - Replace subprocess curl calls with requests library - Add input validation (fiat code allowlist, IP address validation) - Replace weak random.randint/choice with secrets module for crypto ops - Remove token/credential exposure from print statements - Add path traversal prevention in config.py - Create .conf.example templates, scrub local credentials Stability: - Replace 63 bare except clauses with specific exceptions + logging - Fix file handle leaks with context managers (lnd.py, apisnd.py) - Add threading.Lock for race conditions in clock/data.py - Cap unbounded list growth (MAX_HISTORY_LEN=50) - Add timeout=10 to ~50 requests calls missing timeouts Maintainability: - Extract _load_macaroon() helper (dedup 69 instances in PyBlock.py) - Extract _load_lnd_config() helper (dedup 33 instances in nodeconnection.py) - Normalize json import (simplejson with stdlib fallback) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
3 lines
96 B
Text
3 lines
96 B
Text
{
|
|
"lndconnecturl": "lndconnect://your_host:10009?cert=your_tls_cert&macaroon=your_macaroon"
|
|
}
|