Lcos-000 opened a new pull request, #3680:
URL: https://github.com/apache/dubbo-go/pull/3680
### Description
Fixes #3679
`genericServiceFilter.Invoke` (`filter/generic/service_filter.go:79,82`)
performed unguarded type assertions on the generic-call arguments:
```go
mtdName := inv.Arguments()[0].(string)
// ...
args := inv.Arguments()[2].([]hessian.Object)
```
`IsGenericInvocation()` (`protocol/invocation/rpcinvocation.go:94-99`) only
checks that `MethodName` is `$invoke`/`$invokeAsync` and that `len(Arguments)
== 3`; it does **not** validate the element types. A malformed or malicious
`$invoke` request with wrong-typed arguments reached these lines and panicked
with `interface conversion: interface {} is X, not Y`.
`genericServiceFilter` is in `DefaultServiceFilters`
(`common/constant/default.go:67-69`), so this was reachable by any inbound
dubbo request with no opt-in required.
This PR replaces the two bare assertions with comma-ok form and returns a
`perrors`-wrapped error via `result.RPCResult{Err}` (matching the existing
error-return style used at `service_filter.go:92,99`), so a malformed `$invoke`
now returns an error instead of panicking.
### Checklist
- [x] I confirm the target branch is `develop`
- [x] I have run `make fmt` to format my code
- [x] I have run `make test` to run local tests
- [x] I have added tests that prove my fix is effective or that my feature
works
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
