Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(torii-grpc): erc tokens and balances #2698
feat(torii-grpc): erc tokens and balances #2698
Changes from 8 commits
025d5a7
a19f1f2
a28545d
78a341d
4aece4a
e72bc05
cd0528b
a4b8a2a
52277da
97b1165
9aa02f2
File filter
Filter by extension
Conversations
Jump to
There are no files selected for viewing
Check warning on line 125 in crates/torii/core/src/types.rs
Codecov / codecov/patch
crates/torii/core/src/types.rs#L125
Check warning on line 136 in crates/torii/core/src/types.rs
Codecov / codecov/patch
crates/torii/core/src/types.rs#L136
Check warning on line 799 in crates/torii/grpc/src/server/mod.rs
Codecov / codecov/patch
crates/torii/grpc/src/server/mod.rs#L794-L799
Check warning on line 808 in crates/torii/grpc/src/server/mod.rs
Codecov / codecov/patch
crates/torii/grpc/src/server/mod.rs#L801-L808
Check warning on line 814 in crates/torii/grpc/src/server/mod.rs
Codecov / codecov/patch
crates/torii/grpc/src/server/mod.rs#L811-L814
Check warning on line 818 in crates/torii/grpc/src/server/mod.rs
Codecov / codecov/patch
crates/torii/grpc/src/server/mod.rs#L816-L818
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ohayo sensei! Address SQL injection and input validation in
retrieve_tokens
.The current implementation constructs SQL queries using
format!
, which can lead to SQL injection vulnerabilities. Additionally, there's no input validation or limit on the number of contract addresses.Apply this diff to fix the issues:
Would you like assistance implementing these changes?
📝 Committable suggestion
Check warning on line 847 in crates/torii/grpc/src/server/mod.rs
Codecov / codecov/patch
crates/torii/grpc/src/server/mod.rs#L820-L847
Check warning on line 851 in crates/torii/grpc/src/server/mod.rs
Codecov / codecov/patch
crates/torii/grpc/src/server/mod.rs#L849-L851
Check warning on line 856 in crates/torii/grpc/src/server/mod.rs
Codecov / codecov/patch
crates/torii/grpc/src/server/mod.rs#L853-L856
Check warning on line 860 in crates/torii/grpc/src/server/mod.rs
Codecov / codecov/patch
crates/torii/grpc/src/server/mod.rs#L858-L860
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ohayo sensei! Secure
retrieve_token_balances
and improve error handling.Similar to
retrieve_tokens
, constructing SQL queries usingformat!
can cause SQL injection vulnerabilities. Additionally, there's insufficient input validation and no limit on the number of addresses.Apply this diff to address the issues:
Let me know if you'd like help applying these changes.
📝 Committable suggestion
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ohayo sensei! Enhance error handling for
retrieve_tokens
endpoint.The current implementation doesn't validate input contract addresses and lacks error handling for
Felt
conversions, which can cause silent failures.Apply this diff to improve error handling:
📝 Committable suggestion
Check warning on line 1253 in crates/torii/grpc/src/server/mod.rs
Codecov / codecov/patch
crates/torii/grpc/src/server/mod.rs#L1241-L1253
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ohayo sensei! Enhance error handling for the gRPC endpoint.
The implementation needs better input validation and error handling:
Consider this improved implementation:
📝 Committable suggestion
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Enhance error handling for the gRPC endpoint.
The implementation needs better input validation and error handling:
Consider this improved implementation:
📝 Committable suggestion
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ohayo sensei! Improve error handling for
retrieve_token_balances
endpoint.There's a need to validate input addresses and handle potential conversion errors to prevent silent failures.
Apply this diff to enhance error handling:
📝 Committable suggestion
Check warning on line 1275 in crates/torii/grpc/src/server/mod.rs
Codecov / codecov/patch
crates/torii/grpc/src/server/mod.rs#L1258-L1275
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ohayo sensei! Enhance error handling for address conversions.
The implementation needs better error handling for Felt conversions:
Consider this improved implementation:
📝 Committable suggestion
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ohayo sensei! Enhance error handling for address conversions.
The implementation needs better error handling for Felt conversions:
Consider this improved implementation:
📝 Committable suggestion
Check warning on line 29 in crates/torii/grpc/src/types/mod.rs
Codecov / codecov/patch
crates/torii/grpc/src/types/mod.rs#L21-L29
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Codebase verification
Handle serialization errors gracefully in Token conversion
Ohayo sensei! Looking at the codebase, I can confirm this is a critical issue. The
serde_json::to_string(&value.metadata).unwrap()
call in the Token conversion could indeed panic. While there are other unwrap usages in the codebase, this one is particularly risky since it's in a type conversion that could be called frequently in production code.Here's a suggested improvement:
The change ensures that even if metadata serialization fails, we'll get a valid JSON object rather than a panic. This is a safer approach for production code.
🔗 Analysis chain
Handle potential serialization errors gracefully
Ohayo sensei! While the implementation is generally good, the
unwrap()
call on line 27 could panic if the metadata serialization fails. Consider handling this error case gracefully.Here's a suggested improvement:
Let's verify if there are similar unwrap patterns in other type conversions:
Let me search for similar patterns in the codebase to verify if this is a common issue or an isolated case.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
Length of output: 192327
Script:
Length of output: 13698
Check warning on line 40 in crates/torii/grpc/src/types/mod.rs
Codecov / codecov/patch
crates/torii/grpc/src/types/mod.rs#L33-L40