Skip to content

Validate account/ident type in gateway_balances#7655

Open
luisfernandomendozav wants to merge 1 commit into
XRPLF:developfrom
luisfernandomendozav:fix/gateway-balances-account-type-check
Open

Validate account/ident type in gateway_balances#7655
luisfernandomendozav wants to merge 1 commit into
XRPLF:developfrom
luisfernandomendozav:fix/gateway-balances-account-type-check

Conversation

@luisfernandomendozav

Copy link
Copy Markdown

High Level Overview of Change

The gateway_balances handler read the account / ident parameters with
asString() without first checking that they are strings. Passing a
non-string value (number, object, array) caused JsonCpp to throw a
Json::LogicError, which the RPC framework caught and reported to the client
as a generic rpcINTERNAL ("Internal error"). This change validates the field
type up front and returns a clean rpcINVALID_PARAMS instead.

Fixes #6758.

Context of Change

This is a defense-in-depth input-validation gap (severity: low). The bug has
existed since the handler used unchecked asString() on these fields. Before
this change, {"account": 123} or {"account": []} returned rpcINTERNAL,
which is confusing and hides the real problem (a malformed request).

The fix mirrors the existing hotwallet handling in the same file, which
already checks isString() before calling asString(), and follows the same
pattern used for other RPC handlers in the input-validation cleanup (e.g. the
peer parameter in account_lines). Non-string account/ident now return
rpcINVALID_PARAMS via RPC::invalidFieldError.

API Impact

  • Public API: New feature (new methods and/or new fields)
  • Public API: Breaking change (in general, breaking changes should only impact the next api_version)
  • libxrpl change (any change that may affect libxrpl or dependents of libxrpl)
  • Peer protocol change (must be backward compatible or bump the peer protocol version)

No public methods or fields change. Only the error code for malformed
(non-string) account/ident input changes, from rpcINTERNAL to the more
accurate rpcINVALID_PARAMS.

Test Plan

Added a testGWBInvalidAccount case to GatewayBalances_test.cpp (modeled on
the existing testGWBApiVersions) that submits a non-string account and a
non-string ident and asserts the response is an invalidParams error across
all API versions. Run with:

rippled --unittest=ripple.rpc.GatewayBalances

@github-actions

Copy link
Copy Markdown

⚠️ This PR contains unsigned commits. To get your PR merged, please sign them. ⚠️

If only the most recent commit is unsigned, you can run:

  1. Amend the commit: git commit --amend --no-edit -n -S
  2. Overwrite the commit: git push --force-with-lease

If multiple commits are unsigned, you can run:

  1. Go into interactive rebase mode: git rebase --interactive HEAD~<NUM_OF_COMMITS>, where NUM_OF_COMMITS is the number of most recent commits that will be available to edit.
  2. Change "pick" to "edit" for the commits you need to sign, and then save and exit.
  3. For each commit, run: git commit --amend --no-edit -n -S
  4. Continue the rebase: git rebase --continue
  5. Overwrite the commit(s): git push --force-with-lease

If you're new to commit signing, there are different ways to set it up:

Sign commits with gpg

Follow the steps below to set up commit signing with gpg:

  1. Generate a GPG key
  2. Add the GPG key to your GitHub account
  3. Configure git to use your GPG key for commit signing
Sign commits with ssh-agent

Follow the steps below to set up commit signing with ssh-agent:

  1. Generate an SSH key and add it to ssh-agent
  2. Add the SSH key to your GitHub account
  3. Configure git to use your SSH key for commit signing
Sign commits with 1Password

You can also sign commits using 1Password, which lets you sign commits with biometrics without the signing key leaving the local 1Password process.
See use 1Password to sign your commits.

The gateway_balances handler called asString() on the account and
ident parameters without first checking they are strings. A non-string
value (number, object, array) made JsonCpp throw a Json::LogicError,
which surfaced to the client as a confusing rpcINTERNAL error.

Reject non-string account/ident up front with rpcINVALID_PARAMS, matching
the existing hotwallet handling, and add a unit test covering both fields.

Fixes XRPLF#6758
@luisfernandomendozav luisfernandomendozav force-pushed the fix/gateway-balances-account-type-check branch from 2594507 to 57cafe2 Compare June 27, 2026 00:10
@luisfernandomendozav luisfernandomendozav marked this pull request as ready for review June 27, 2026 00:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

GatewayBalances account/ident parameters not type-checked before asString()

1 participant