fix(torii-grpc): retrieve balances #2777
Conversation
WalkthroughOhayo, sensei! The pull request introduces significant updates to the Changes
Possibly related PRs
Suggested reviewers
📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Outside diff range and nitpick comments (2)
crates/torii/grpc/src/server/mod.rs (2)
808-811: Ohayo, sensei! Efficient parameter binding inretrieve_tokens.Currently, parameters are being bound individually in a loop. While this works, consider checking if the SQL driver supports binding an array of parameters to optimize performance.
If not supported, the current implementation is acceptable.
848-850: Ohayo, sensei! Efficient parameter binding inretrieve_token_balances.Binding parameters within a loop may affect performance for large datasets. If the SQL driver supports it, consider binding all parameters at once to optimize execution.
If such optimization isn't available, the current approach remains acceptable.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
📒 Files selected for processing (1)
crates/torii/grpc/src/server/mod.rs(2 hunks)
🔇 Additional comments (1)
crates/torii/grpc/src/server/mod.rs (1)
801-804: Ohayo, sensei! Secure parameterization in retrieve_tokens.
Great job implementing parameterized queries to enhance security against SQL injection attacks.
crates/torii/grpc/src/server/mod.rs
Outdated
| let mut bind_values = Vec::new(); | ||
| let mut conditions = Vec::new(); | ||
|
|
||
| if !account_addresses.is_empty() { | ||
| conditions.push(format!( | ||
| "account_address IN ({})", | ||
| account_addresses | ||
| .iter() | ||
| .map(|address| format!("{:#x}", address)) | ||
| .collect::<Vec<_>>() | ||
| .join(", ") | ||
| )); | ||
| let placeholders = vec!["?"; account_addresses.len()].join(", "); | ||
| conditions.push(format!("account_address IN ({})", placeholders)); | ||
| bind_values.extend(account_addresses.iter().map(|addr| format!("{:#x}", addr))); | ||
| } | ||
|
|
||
| if !contract_addresses.is_empty() { | ||
| conditions.push(format!( | ||
| "contract_address IN ({})", | ||
| contract_addresses | ||
| .iter() | ||
| .map(|address| format!("{:#x}", address)) | ||
| .collect::<Vec<_>>() | ||
| .join(", ") | ||
| )); | ||
| let placeholders = vec!["?"; contract_addresses.len()].join(", "); | ||
| conditions.push(format!("contract_address IN ({})", placeholders)); | ||
| bind_values.extend(contract_addresses.iter().map(|addr| format!("{:#x}", addr))); | ||
| } | ||
|
|
||
| if !conditions.is_empty() { | ||
| query += &format!(" WHERE {}", conditions.join(" AND ")); | ||
| } | ||
|
|
||
| let balances: Vec<TokenBalance> = sqlx::query_as(&query) | ||
| let mut query = sqlx::query_as(&query); | ||
| for value in bind_values { | ||
| query = query.bind(value); | ||
| } | ||
|
|
||
| let balances: Vec<TokenBalance> = query |
There was a problem hiding this comment.
Ohayo, sensei! Potential unintended data exposure in retrieve_token_balances.
When both account_addresses and contract_addresses are empty, the query retrieves all token balances, which may not be intended and could expose sensitive data. Consider adding input validation to handle this case.
Here's a suggested fix to add input validation:
async fn retrieve_token_balances(
&self,
account_addresses: Vec<Felt>,
contract_addresses: Vec<Felt>,
) -> Result<RetrieveTokenBalancesResponse, Status> {
+ if account_addresses.is_empty() && contract_addresses.is_empty() {
+ return Err(Status::invalid_argument("At least one address must be provided."));
+ }
let mut query = "SELECT * FROM token_balances".to_string();
let mut bind_values = Vec::new();
let mut conditions = Vec::new();📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| let mut bind_values = Vec::new(); | |
| let mut conditions = Vec::new(); | |
| if !account_addresses.is_empty() { | |
| conditions.push(format!( | |
| "account_address IN ({})", | |
| account_addresses | |
| .iter() | |
| .map(|address| format!("{:#x}", address)) | |
| .collect::<Vec<_>>() | |
| .join(", ") | |
| )); | |
| let placeholders = vec!["?"; account_addresses.len()].join(", "); | |
| conditions.push(format!("account_address IN ({})", placeholders)); | |
| bind_values.extend(account_addresses.iter().map(|addr| format!("{:#x}", addr))); | |
| } | |
| if !contract_addresses.is_empty() { | |
| conditions.push(format!( | |
| "contract_address IN ({})", | |
| contract_addresses | |
| .iter() | |
| .map(|address| format!("{:#x}", address)) | |
| .collect::<Vec<_>>() | |
| .join(", ") | |
| )); | |
| let placeholders = vec!["?"; contract_addresses.len()].join(", "); | |
| conditions.push(format!("contract_address IN ({})", placeholders)); | |
| bind_values.extend(contract_addresses.iter().map(|addr| format!("{:#x}", addr))); | |
| } | |
| if !conditions.is_empty() { | |
| query += &format!(" WHERE {}", conditions.join(" AND ")); | |
| } | |
| let balances: Vec<TokenBalance> = sqlx::query_as(&query) | |
| let mut query = sqlx::query_as(&query); | |
| for value in bind_values { | |
| query = query.bind(value); | |
| } | |
| let balances: Vec<TokenBalance> = query | |
| if account_addresses.is_empty() && contract_addresses.is_empty() { | |
| return Err(Status::invalid_argument("At least one address must be provided.")); | |
| } | |
| let mut query = "SELECT * FROM token_balances".to_string(); | |
| let mut bind_values = Vec::new(); | |
| let mut conditions = Vec::new(); | |
| if !account_addresses.is_empty() { | |
| let placeholders = vec!["?"; account_addresses.len()].join(", "); | |
| conditions.push(format!("account_address IN ({})", placeholders)); | |
| bind_values.extend(account_addresses.iter().map(|addr| format!("{:#x}", addr))); | |
| } | |
| if !contract_addresses.is_empty() { | |
| let placeholders = vec!["?"; contract_addresses.len()].join(", "); | |
| conditions.push(format!("contract_address IN ({})", placeholders)); | |
| bind_values.extend(contract_addresses.iter().map(|addr| format!("{:#x}", addr))); | |
| } | |
| if !conditions.is_empty() { | |
| query += &format!(" WHERE {}", conditions.join(" AND ")); | |
| } | |
| let mut query = sqlx::query_as(&query); | |
| for value in bind_values { | |
| query = query.bind(value); | |
| } | |
| let balances: Vec<TokenBalance> = query |
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2777 +/- ##
==========================================
+ Coverage 56.01% 56.03% +0.01%
==========================================
Files 434 434
Lines 55068 55057 -11
==========================================
+ Hits 30849 30850 +1
+ Misses 24219 24207 -12 ☔ View full report in Codecov by Sentry. |
* fix: retrieve balances * fmt
addresses #2771
Summary by CodeRabbit
New Features
Bug Fixes