You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
Under some conditions, nitro can leak internally configured endpoints in JSON-RPC responses.
When this happens it returns the full URL in the configuration to the person who made the RPC call, this can lead to leaking API keys, IPs, etc.
To Reproduce
Steps to reproduce the behavior:
Run nitro with --execution.rpc.classic-redirect configured, but point it at a fake URL then make an API call that would require the use of the redirected URL such as an eth_call to a legacy block:
{"jsonrpc":"2.0","id":1,"error":{"code":-32000,"message":"Post \"https://my_node/my_api_key/\": dial tcp: lookup my_node on 127.0.0.53:53: no such host"}}
I am pretty sure it's also possible that it's leaking URLs for either parent-chain.connection.url or parent-chain.blob-client.beacon-url or both, under some conditions, but I haven't been able to reproduce it.
Expected behavior
It should error out, but it shouldn't leak the URL you configured under --execution.rpc.classic-redirect, etc.
The text was updated successfully, but these errors were encountered:
Describe the bug
Under some conditions, nitro can leak internally configured endpoints in JSON-RPC responses.
When this happens it returns the full URL in the configuration to the person who made the RPC call, this can lead to leaking API keys, IPs, etc.
To Reproduce
Steps to reproduce the behavior:
Run nitro with
--execution.rpc.classic-redirect
configured, but point it at a fake URL then make an API call that would require the use of the redirected URL such as aneth_call
to a legacy block:You'll get a response like this:
I am pretty sure it's also possible that it's leaking URLs for either
parent-chain.connection.url
orparent-chain.blob-client.beacon-url
or both, under some conditions, but I haven't been able to reproduce it.Expected behavior
It should error out, but it shouldn't leak the URL you configured under
--execution.rpc.classic-redirect
, etc.The text was updated successfully, but these errors were encountered: