-
Notifications
You must be signed in to change notification settings - Fork 4.1k
feat(indexer): add to modules and implement proto fields #22544
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 8 commits
24879d0
8047466
5a52970
ce8b931
86fc09a
7e5a665
4ebf63f
38fcf4c
ee06bf2
5381823
748bac9
3cd0277
4b3b800
0a73e70
ebd7397
5196e56
6ed03b5
6c03930
f4a3aa0
5bb37a3
de642e1
668838f
f3cd58f
80d762e
91674b1
228ffb5
e320f48
d94bde6
dc20c04
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -77,7 +77,9 @@ func FallbackSchemaCodec[T any]() SchemaCodec[T] { | |
| Kind: kind, | ||
| }}, | ||
| // these can be nil because T maps directly to a schema value for this kind | ||
| ToSchemaType: nil, | ||
| ToSchemaType: func(t T) (any, error) { | ||
|
||
| return t, nil | ||
| }, | ||
| FromSchemaType: nil, | ||
| } | ||
| } else { | ||
|
|
||
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -1,18 +1,25 @@ | ||||||||||
| module cosmossdk.io/collections | ||||||||||
|
|
||||||||||
| go 1.23 | ||||||||||
| go 1.23.2 | ||||||||||
|
|
||||||||||
| toolchain go1.23.3 | ||||||||||
|
||||||||||
| go 1.23.2 | |
| toolchain go1.23.3 | |
| go 1.22 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Codebase verification
Update google.golang.org/protobuf to address security vulnerability
The codebase extensively uses protojson.Unmarshal across multiple packages, making it susceptible to the reported moderate severity vulnerability (infinite loop when unmarshaling certain forms of invalid JSON). Since this is a security concern and the function is used in critical paths including transaction processing and ORM operations, an update is recommended.
- Update
google.golang.org/protobufto at least version v1.33.0 ingo.mod - Test the changes thoroughly as this is a widely used dependency in the codebase
🔗 Analysis chain
Verify protobuf version compatibility
The PR adds protobuf-related dependencies which align with the implementation of proto fields. However, let's verify if we're using the latest stable version of google.golang.org/protobuf.
Also applies to: 14-14
Update google.golang.org/protobuf to v1.33.0 or later
The current version v1.35.2 is vulnerable to a moderate severity issue (infinite loop in protojson.Unmarshal) that was patched in v1.33.0. While v1.35.2 is actually the latest version available, it still contains this vulnerability according to the GitHub Security Advisory database. This suggests there might be a discrepancy in the version information, and it would be prudent to verify this further.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Check latest version of google.golang.org/protobuf
curl -s "https://proxy.golang.org/google.golang.org/protobuf/@v/list" | sort -V | tail -n 1
# Check if there are any known issues with the current version
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: GO, package: "google.golang.org/protobuf") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
Length of output: 974
Script:
#!/bin/bash
# Double check the version information from go.mod
rg "google.golang.org/protobuf" -A 1 -B 1 go.mod
# Check if protojson.Unmarshal is actually used in the codebase
rg "protojson\.Unmarshal"
Length of output: 1499
Uh oh!
There was an error while loading. Please reload this page.