diff options
| -rw-r--r-- | doc/release-notes-26628.md | 4 | ||||
| -rw-r--r-- | src/rpc/server.cpp | 5 | ||||
| -rw-r--r-- | src/test/rpc_tests.cpp | 5 |
3 files changed, 11 insertions, 3 deletions
diff --git a/doc/release-notes-26628.md b/doc/release-notes-26628.md new file mode 100644 index 0000000000..48a07c1e81 --- /dev/null +++ b/doc/release-notes-26628.md @@ -0,0 +1,4 @@ +JSON-RPC +--- + +The JSON-RPC server now rejects requests where a parameter is specified multiple times with the same name, instead of silently overwriting earlier parameter values with later ones. (#26628) diff --git a/src/rpc/server.cpp b/src/rpc/server.cpp index f57133f75b..232e2119f1 100644 --- a/src/rpc/server.cpp +++ b/src/rpc/server.cpp @@ -399,7 +399,10 @@ static inline JSONRPCRequest transformNamedArguments(const JSONRPCRequest& in, c const std::vector<UniValue>& values = in.params.getValues(); std::unordered_map<std::string, const UniValue*> argsIn; for (size_t i=0; i<keys.size(); ++i) { - argsIn[keys[i]] = &values[i]; + auto [_, inserted] = argsIn.emplace(keys[i], &values[i]); + if (!inserted) { + throw JSONRPCError(RPC_INVALID_PARAMETER, "Parameter " + keys[i] + " specified multiple times"); + } } // Process expected parameters. If any parameters were left unspecified in // the request before a parameter that was specified, null values need to be diff --git a/src/test/rpc_tests.cpp b/src/test/rpc_tests.cpp index 23e666bc45..a4d5a4b12c 100644 --- a/src/test/rpc_tests.cpp +++ b/src/test/rpc_tests.cpp @@ -89,8 +89,9 @@ BOOST_AUTO_TEST_CASE(rpc_namedparams) // Make sure named arguments are transformed into positional arguments in correct places separated by nulls BOOST_CHECK_EQUAL(TransformParams(JSON(R"({"arg2": 2, "arg4": 4})"), arg_names).write(), "[null,2,null,4]"); - // Make sure later named argument value silently overwrites earlier values - BOOST_CHECK_EQUAL(TransformParams(JSON(R"({"arg2": 2, "arg2": 4})"), arg_names).write(), "[null,4]"); + // Make sure named argument specified multiple times raises an exception + BOOST_CHECK_EXCEPTION(TransformParams(JSON(R"({"arg2": 2, "arg2": 4})"), arg_names), UniValue, + HasJSON(R"({"code":-8,"message":"Parameter arg2 specified multiple times"})")); // Make sure named and positional arguments can be combined. BOOST_CHECK_EQUAL(TransformParams(JSON(R"({"arg5": 5, "args": [1, 2], "arg4": 4})"), arg_names).write(), "[1,2,null,4,5]"); |