Sulkta-OSS/cardano-api
3
0
Fork 0
Code Issues 1 Pull requests 4 Projects Releases Packages Wiki Activity Actions

fix: Security hardening pass 2 - body limit, CIP-8 bypass, pagination, cbor2 bump

Browse source 
- Fix #11: Request body size limit (64KB) on /v1/tx/submit via middleware
- Fix #12: CIP-8 empty payload bypass - reject empty payloads explicitly
- Fix #13: Pagination on /v1/address/{addr}/tokens and /v1/asset/{policy_id}/info
- Fix #14: Bump cbor2 to >=5.6.5 (CVE-2024-26134 tag decoding DoS)
- Fix #15: Fixed holder count query (was using GROUP BY + COUNT DISTINCT incorrectly)
- Fix #16: Async lock for protocol params cache to prevent stampede
This commit is contained in:
Sulkta 2026-03-21 10:09:15 -07:00
parent abaa19b79e
commit 8a4e59894b
2 changed files with 152 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

2
requirements.txt
View file

@ -5,5 +5,5 @@ redis==5.0.0
pydantic==2.9.0
python-dotenv==1.0.0
pycardano==0.11.0
cbor2==5.6.0
cbor2>=5.6.5
PyNaCl==1.5.0