fix(platform)!: decode external input with untrusted bincode decoders

.github/workflows/tests-rs-workspace.yml

@@ -265,15 +265,35 @@ jobs:
             '
           }
 
+          # A derive list is not part of a structure's wire layout: adding or
+          # reordering a derive cannot change how the existing fields or
+          # variants serialize, while the fields, the variants and the
+          # attributes that do shape the encoding (serde, repr,
+          # platform_serialize) are still compared verbatim. Drop
+          # `#[derive(...)]` attributes, single- or multi-line, before diffing.
+          strip_derives() {
+            awk '
+              skipping {
+                if (index($0, ")]")) { skipping=0 }
+                next
+              }
+              /^[[:space:]]*#\[derive\(/ {
+                if (!index($0, ")]")) { skipping=1 }
+                next
+              }
+              { print }
+            '
+          }
+
           for file in $CHANGED_RS; do
             if [ ! -f "$file" ]; then continue; fi
             BASE_CONTENT=$(git show "$BASE_PARENT":"$file" 2>/dev/null || true)
             if [ -z "$BASE_CONTENT" ]; then continue; fi
 
-            BASE_APPEND=$(echo "$BASE_CONTENT" | extract_tagged_block "@append_only")
-            PR_APPEND=$(extract_tagged_block "@append_only" < "$file")
-            BASE_IMMUTABLE=$(echo "$BASE_CONTENT" | extract_tagged_block "@immutable")
-            PR_IMMUTABLE=$(extract_tagged_block "@immutable" < "$file")
+            BASE_APPEND=$(echo "$BASE_CONTENT" | extract_tagged_block "@append_only" | strip_derives)
+            PR_APPEND=$(extract_tagged_block "@append_only" < "$file" | strip_derives)
+            BASE_IMMUTABLE=$(echo "$BASE_CONTENT" | extract_tagged_block "@immutable" | strip_derives)
+            PR_IMMUTABLE=$(extract_tagged_block "@immutable" < "$file" | strip_derives)
 
             if [ -n "$BASE_APPEND" ]; then
               # Check for deletions, ignoring comment-only lines and the tag itself

packages/rs-dpp/src/address_funds/fee_strategy/mod.rs

@@ -2,11 +2,11 @@ pub mod deduct_fee_from_inputs_and_outputs;
 
 pub use deduct_fee_from_inputs_and_outputs::FeeDeductionResult;
 
-use bincode::{Decode, Encode};
+use bincode::{Decode, DecodeUntrusted, Encode};
 #[cfg(feature = "serde-conversion")]
 use serde::{Deserialize, Serialize};
 
-#[derive(Debug, Clone, Encode, Decode, PartialEq, Eq, Hash)]
+#[derive(Debug, Clone, Encode, Decode, PartialEq, Eq, Hash, DecodeUntrusted)]
 pub enum AddressFundsFeeStrategyStep {
     /// Deduct fee from a specific input address by index.
     /// The input must have remaining balance after its contribution to outputs.

packages/rs-dpp/src/address_funds/platform_address.rs

@@ -3,7 +3,7 @@ use crate::address_funds::AddressWitnessVerificationOperations;
 use crate::prelude::AddressNonce;
 use crate::ProtocolError;
 use bech32::{Bech32m, Hrp};
-use bincode::{Decode, Encode};
+use bincode::{Decode, DecodeUntrusted, Encode};
 use dashcore::address::Payload;
 use dashcore::blockdata::script::ScriptBuf;
 use dashcore::hashes::{sha256d, Hash};
@@ -34,6 +34,7 @@ pub const ADDRESS_HASH_SIZE: usize = 20;
     Decode,
     PlatformSerialize,
     PlatformDeserialize,
+    DecodeUntrusted,
 )]
 #[platform_serialize(unversioned)]
 pub enum PlatformAddress {
@@ -428,9 +429,9 @@ impl PlatformAddress {
     /// Uses bincode deserialization which expects: 0x00 for P2pkh, 0x01 for P2sh.
     pub fn from_bytes(bytes: &[u8]) -> Result<Self, ProtocolError> {
         let (address, _): (Self, usize) =
-            bincode::decode_from_slice(bytes, bincode::config::standard()).map_err(|e| {
-                ProtocolError::DecodingError(format!("cannot decode PlatformAddress: {}", e))
-            })?;
+            bincode::decode_from_slice_untrusted(bytes, bincode::config::standard()).map_err(
+                |e| ProtocolError::DecodingError(format!("cannot decode PlatformAddress: {}", e)),
+            )?;
         Ok(address)
     }
 

packages/rs-dpp/src/address_funds/witness.rs

@@ -1,9 +1,9 @@
 #[cfg(feature = "json-conversion")]
 use crate::serialization::json_safe_fields;
-use bincode::de::{BorrowDecoder, Decoder};
+use bincode::de::BorrowDecoder;
 use bincode::enc::Encoder;
 use bincode::error::{DecodeError, EncodeError};
-use bincode::{Decode, Encode};
+use bincode::Encode;
 use platform_value::BinaryData;
 #[cfg(feature = "serde-conversion")]
 use serde::{Deserialize, Serialize};
@@ -77,36 +77,46 @@ impl Encode for AddressWitness {
     }
 }
 
-impl<C> Decode<C> for AddressWitness {
-    fn decode<D: Decoder<Context = C>>(decoder: &mut D) -> Result<Self, DecodeError> {
-        let discriminant = u8::decode(decoder)?;
-        match discriminant {
-            0 => {
-                let signature = BinaryData::decode(decoder)?;
-                Ok(AddressWitness::P2pkh { signature })
-            }
-            1 => {
-                let signatures = Vec::<BinaryData>::decode(decoder)?;
-                if signatures.len() > MAX_P2SH_SIGNATURES {
-                    return Err(DecodeError::OtherString(format!(
-                        "P2SH signatures count {} exceeds maximum {}",
-                        signatures.len(),
-                        MAX_P2SH_SIGNATURES,
-                    )));
+// Share the wire schema and domain checks across both decoding APIs.
+macro_rules! impl_address_witness_decode {
+    ($decode:ident, $decoder:ident, $method:ident, $untrusted:expr) => {
+        impl<C> bincode::$decode<C> for AddressWitness {
+            fn $method<D: bincode::de::$decoder<Context = C>>(
+                decoder: &mut D,
+            ) -> Result<Self, DecodeError> {
+                let discriminant = u8::$method(decoder)?;
+                match discriminant {
+                    0 => {
+                        let signature = BinaryData::$method(decoder)?;
+                        Ok(AddressWitness::P2pkh { signature })
+                    }
+                    1 => {
+                        let signatures = Vec::<BinaryData>::$method(decoder)?;
+                        if signatures.len() > MAX_P2SH_SIGNATURES {
+                            return Err(DecodeError::OtherString(format!(
+                                "P2SH signatures count {} exceeds maximum {}",
+                                signatures.len(),
+                                MAX_P2SH_SIGNATURES,
+                            )));
+                        }
+                        let redeem_script = BinaryData::$method(decoder)?;
+                        Ok(AddressWitness::P2sh {
+                            signatures,
+                            redeem_script,
+                        })
+                    }
+                    _ => Err(DecodeError::OtherString(format!(
+                        "Invalid AddressWitness discriminant: {}",
+                        discriminant
+                    ))),
                 }
-                let redeem_script = BinaryData::decode(decoder)?;
-                Ok(AddressWitness::P2sh {
-                    signatures,
-                    redeem_script,
-                })
             }
-            _ => Err(DecodeError::OtherString(format!(
-                "Invalid AddressWitness discriminant: {}",
-                discriminant
-            ))),
         }
-    }
+    };
 }
+impl_address_witness_decode!(Decode, Decoder, decode, false);
+impl_address_witness_decode!(DecodeUntrusted, UntrustedDecoder, decode_untrusted, true);
+bincode::impl_borrow_decode_untrusted!(AddressWitness);
 
 impl<'de, C> bincode::BorrowDecode<'de, C> for AddressWitness {
     fn borrow_decode<D: BorrowDecoder<'de, Context = C>>(

packages/rs-dpp/src/asset_lock/reduced_asset_lock_value/mod.rs

@@ -1,7 +1,7 @@
 use crate::asset_lock::reduced_asset_lock_value::v0::AssetLockValueV0;
 use crate::fee::Credits;
 use crate::ProtocolError;
-use bincode::{Decode, Encode};
+use bincode::{Decode, DecodeUntrusted, Encode};
 use derive_more::From;
 use platform_serialization_derive::{PlatformDeserialize, PlatformSerialize};
 use platform_value::Bytes32;
@@ -22,6 +22,7 @@ pub use v0::{AssetLockValueGettersV0, AssetLockValueSettersV0};
     PartialEq,
     serde::Serialize,
     serde::Deserialize,
+    DecodeUntrusted,
 )]
 // Stored asset-lock values are decoded from GroveDB proof elements on the
 // client before the quorum signature is checked, so the byte budget must be

packages/rs-dpp/src/asset_lock/reduced_asset_lock_value/v0/mod.rs

@@ -1,14 +1,16 @@
 use crate::fee::Credits;
 #[cfg(feature = "json-conversion")]
 use crate::serialization::json_safe_fields;
-use bincode::{Decode, Encode};
+use bincode::{Decode, DecodeUntrusted, Encode};
 use platform_value::Bytes32;
 
 // `initial_credit_value` / `remaining_credit_value` are `Credits` (u64) and can
 // exceed JS's `MAX_SAFE_INTEGER`; `#[json_safe_fields]` serializes them as
 // strings in human-readable JSON to avoid precision loss when crossing to JS.
 #[cfg_attr(feature = "json-conversion", json_safe_fields)]
-#[derive(Debug, Clone, Encode, Decode, PartialEq, serde::Serialize, serde::Deserialize)]
+#[derive(
+    Debug, Clone, Encode, Decode, PartialEq, serde::Serialize, serde::Deserialize, DecodeUntrusted,
+)]
 pub struct AssetLockValueV0 {
     pub(super) initial_credit_value: Credits,
     pub(super) tx_out_script: Vec<u8>,

packages/rs-dpp/src/balances/credits.rs

@@ -10,6 +10,7 @@
 
 use crate::prelude::BlockHeight;
 use crate::ProtocolError;
+use bincode::{Decode, DecodeUntrusted, Encode};
 use integer_encoding::VarInt;
 use std::collections::BTreeMap;
 use std::convert::TryFrom;
@@ -42,7 +43,7 @@ pub const MAX_CREDITS: Credits = 9223372036854775807 as Credits; //i64 Max
 pub const CREDITS_PER_DUFF: Credits = 1000;
 
 /// An enum for credit operations
-#[derive(Debug, Clone, Copy, PartialEq, Eq, bincode::Encode, bincode::Decode)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Encode, Decode, DecodeUntrusted)]
 pub enum CreditOperation {
     /// We are setting credit amounts
     SetCredits(Credits),
@@ -51,7 +52,7 @@ pub enum CreditOperation {
 }
 
 /// An enum for credit operations in compacted address blobs
-#[derive(Debug, Clone, PartialEq, Eq, bincode::Encode, bincode::Decode)]
+#[derive(Debug, Clone, PartialEq, Eq, Encode, Decode, DecodeUntrusted)]
 pub enum BlockAwareCreditOperation {
     /// We are setting credit amounts - the final value after all operations
     SetCredits(Credits),

packages/rs-dpp/src/balances/total_single_token_balance/mod.rs

@@ -1,14 +1,17 @@
 use crate::balances::credits::SignedTokenAmount;
 use crate::ProtocolError;
 #[cfg(feature = "fixtures-and-mocks")]
-use bincode::Encode;
+use bincode::{DecodeUntrusted, Encode};
 #[cfg(feature = "fixtures-and-mocks")]
 use platform_serialization::de::Decode;
 use std::fmt;
 
 /// A structure where the token supply and the aggregated token account balances should always be equal
 #[derive(Copy, Clone, Debug)]
-#[cfg_attr(feature = "fixtures-and-mocks", derive(Encode, Decode))]
+#[cfg_attr(
+    feature = "fixtures-and-mocks",
+    derive(Encode, Decode, DecodeUntrusted)
+)]
 pub struct TotalSingleTokenBalance {
     /// the token supply
     pub token_supply: SignedTokenAmount,

packages/rs-dpp/src/block/block_info/mod.rs

@@ -6,7 +6,7 @@ use crate::serialization::json_safe_fields;
 use crate::serialization::JsonConvertible;
 #[cfg(feature = "value-conversion")]
 use crate::serialization::ValueConvertible;
-use bincode::{Decode, Encode};
+use bincode::{Decode, DecodeUntrusted, Encode};
 use serde::{Deserialize, Serialize};
 use std::fmt;
 
@@ -23,7 +23,19 @@ pub const DEFAULT_BLOCK_INFO: BlockInfo = BlockInfo {
 /// Block information
 #[cfg_attr(feature = "json-conversion", json_safe_fields)]
 #[cfg_attr(feature = "json-conversion", derive(JsonConvertible))]
-#[derive(Clone, Copy, Default, Debug, PartialEq, Eq, Encode, Decode, Serialize, Deserialize)]
+#[derive(
+    Clone,
+    Copy,
+    Default,
+    Debug,
+    PartialEq,
+    Eq,
+    Encode,
+    Decode,
+    Serialize,
+    Deserialize,
+    DecodeUntrusted,
+)]
 #[cfg_attr(feature = "value-conversion", derive(ValueConvertible))]
 #[serde(rename_all = "camelCase")]
 pub struct BlockInfo {

packages/rs-dpp/src/block/epoch/mod.rs

@@ -1,5 +1,5 @@
 use crate::{InvalidVectorSizeError, ProtocolError};
-use bincode::{BorrowDecode, Decode, Encode};
+use bincode::{BorrowDecode, Encode};
 use serde::{Deserialize, Serialize};
 
 /// Epoch key offset
@@ -100,14 +100,23 @@ impl<'de> Deserialize<'de> for Epoch {
     }
 }
 
-impl<C> Decode<C> for Epoch {
-    fn decode<D: bincode::de::Decoder<Context = C>>(
-        decoder: &mut D,
-    ) -> Result<Self, bincode::error::DecodeError> {
-        let index = EpochIndex::decode(decoder)?;
-        Epoch::new(index).map_err(|e| bincode::error::DecodeError::OtherString(e.to_string()))
-    }
+// Share the wire schema and domain checks across both decoding APIs.
+macro_rules! impl_epoch_decode {
+    ($decode:ident, $decoder:ident, $method:ident, $untrusted:expr) => {
+        impl<C> bincode::$decode<C> for Epoch {
+            fn $method<D: bincode::de::$decoder<Context = C>>(
+                decoder: &mut D,
+            ) -> Result<Self, bincode::error::DecodeError> {
+                let index = EpochIndex::$method(decoder)?;
+                Epoch::new(index)
+                    .map_err(|e| bincode::error::DecodeError::OtherString(e.to_string()))
+            }
+        }
+    };
 }
+impl_epoch_decode!(Decode, Decoder, decode, false);
+impl_epoch_decode!(DecodeUntrusted, UntrustedDecoder, decode_untrusted, true);
+bincode::impl_borrow_decode_untrusted!(Epoch);
 
 impl<'de, C> BorrowDecode<'de, C> for Epoch {
     fn borrow_decode<D: bincode::de::BorrowDecoder<'de, Context = C>>(

packages/rs-dpp/src/block/extended_block_info/mod.rs

@@ -8,7 +8,7 @@ use crate::serialization::JsonConvertible;
 #[cfg(feature = "value-conversion")]
 use crate::serialization::ValueConvertible;
 use crate::version::FeatureVersion;
-use bincode::{Decode, Encode};
+use bincode::{Decode, DecodeUntrusted, Encode};
 use derive_more::From;
 use platform_serialization_derive::{PlatformDeserialize, PlatformSerialize};
 use serde::{Deserialize, Serialize};
@@ -30,6 +30,7 @@ pub mod v0;
     PlatformSerialize,
     PlatformDeserialize,
     From,
+    DecodeUntrusted,
 )]
 #[platform_serialize(unversioned)] //versioned directly, no need to use platform_version
 #[serde(tag = "$formatVersion")]

packages/rs-dpp/src/block/extended_block_info/v0/mod.rs

@@ -2,12 +2,12 @@ use crate::block::block_info::BlockInfo;
 #[cfg(feature = "json-conversion")]
 use crate::serialization::json_safe_fields;
 
-use bincode::{Decode, Encode};
+use bincode::{Decode, DecodeUntrusted, Encode};
 use serde::{Deserialize, Serialize};
 
 /// Extended Block information
 #[cfg_attr(feature = "json-conversion", json_safe_fields)]
-#[derive(Clone, Debug, PartialEq, Eq, Encode, Decode, Serialize, Deserialize)]
+#[derive(Clone, Debug, PartialEq, Eq, Encode, Decode, Serialize, Deserialize, DecodeUntrusted)]
 #[serde(rename_all = "camelCase")]
 pub struct ExtendedBlockInfoV0 {
     /// Basic block info

packages/rs-dpp/src/block/extended_epoch_info/mod.rs

@@ -8,7 +8,7 @@ use crate::serialization::JsonConvertible;
 #[cfg(feature = "value-conversion")]
 use crate::serialization::ValueConvertible;
 use crate::util::deserializer::ProtocolVersion;
-use bincode::{Decode, Encode};
+use bincode::{Decode, DecodeUntrusted, Encode};
 use derive_more::From;
 use platform_serialization_derive::{PlatformDeserialize, PlatformSerialize};
 use serde::{Deserialize, Serialize};
@@ -27,6 +27,7 @@ use serde::{Deserialize, Serialize};
     PlatformSerialize,
     PlatformDeserialize,
     From,
+    DecodeUntrusted,
 )]
 #[platform_serialize(unversioned)] //versioned directly, no need to use platform_version
 #[serde(tag = "$formatVersion")]

packages/rs-dpp/src/block/extended_epoch_info/v0/mod.rs

@@ -2,12 +2,12 @@ use crate::block::epoch::EpochIndex;
 #[cfg(feature = "json-conversion")]
 use crate::serialization::json_safe_fields;
 use crate::util::deserializer::ProtocolVersion;
-use bincode::{Decode, Encode};
+use bincode::{Decode, DecodeUntrusted, Encode};
 use serde::{Deserialize, Serialize};
 
 /// Extended Epoch information
 #[cfg_attr(feature = "json-conversion", json_safe_fields)]
-#[derive(Clone, Debug, PartialEq, Encode, Decode, Serialize, Deserialize)]
+#[derive(Clone, Debug, PartialEq, Encode, Decode, Serialize, Deserialize, DecodeUntrusted)]
 #[serde(rename_all = "camelCase")]
 pub struct ExtendedEpochInfoV0 {
     /// The index of the epoch

packages/rs-dpp/src/block/finalized_epoch_info/mod.rs

@@ -7,7 +7,7 @@ use crate::protocol_error::ProtocolError;
 use crate::serialization::JsonConvertible;
 #[cfg(feature = "value-conversion")]
 use crate::serialization::ValueConvertible;
-use bincode::{Decode, Encode};
+use bincode::{Decode, DecodeUntrusted, Encode};
 use derive_more::From;
 use platform_serialization_derive::{PlatformDeserialize, PlatformSerialize};
 use serde::{Deserialize, Serialize};
@@ -26,6 +26,7 @@ use serde::{Deserialize, Serialize};
     PlatformSerialize,
     PlatformDeserialize,
     From,
+    DecodeUntrusted,
 )]
 #[platform_serialize(unversioned)] //versioned directly, no need to use platform_version
 #[serde(tag = "$formatVersion")]