Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rpc: NewAPI constructs faulty HTTP client when using Unix Domain sockets #10018

Open
3 tasks done
djdv opened this issue Jul 14, 2023 · 0 comments · May be fixed by #10019
Open
3 tasks done

rpc: NewAPI constructs faulty HTTP client when using Unix Domain sockets #10018

djdv opened this issue Jul 14, 2023 · 0 comments · May be fixed by #10019
Labels
kind/bug A bug in existing code (including security flaws) need/triage Needs initial labeling and prioritization

Comments

@djdv
Copy link
Contributor

djdv commented Jul 14, 2023

Checklist

Installation method

built from source

Version

No response

Config

This is the only relevant part

  "Addresses": {
    "API": [
      "/unix/C:/tmp/sock",
      "/ip4/127.0.0.1/tcp/5001",
      "/ip4/192.168.1.40/tcp/5002"
    ],

Description

Consider an IPFS daemon running on Windows, exposing its API on a UDS located at C:\tmp\sock.

The following program will fail when calling core.Pin().Ls (or anything that makes a request)

package main

import (
	"context"
	"fmt"

	"github.com/ipfs/boxo/coreiface/options"
	"github.com/ipfs/kubo/client/rpc"
	"github.com/multiformats/go-multiaddr"
)

func main() {
	const nodeMaddr = `/unix/C:/tmp/sock`
	maddr := multiaddr.StringCast(nodeMaddr)
	core, err := rpc.NewApi(maddr)
	if err != nil {
		fmt.Println(err)
		return
	}
	pins, err := core.Pin().Ls(context.Background(), options.Pin.Ls.Recursive())
	if err != nil {
		fmt.Println(err)
		return
	}
	for pin := range pins {
		fmt.Println(pin.Path())
	}
}

with this output:
parse "http://C:\\tmp\\sock/api/v0/pin/ls?stream=true&type=recursive": invalid port ":\\tmp\\sock" after host

The client constructor is using the multiaddr's Unix component's value, for the HTTP address.
This is problematic since the file system path may contain any number of invalid HTTP URL characters or sequences, which can confuse the client when it goes to make requests.
In this specific case, a : in the path is being misinterpreted as the port separator.

PR #10019

@djdv djdv added kind/bug A bug in existing code (including security flaws) need/triage Needs initial labeling and prioritization labels Jul 14, 2023
@djdv djdv linked a pull request Jul 14, 2023 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/bug A bug in existing code (including security flaws) need/triage Needs initial labeling and prioritization
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant