jkremlacek/pa193_test_parser_nem

pa193_test_parser_nem's Issues

JSON - not validating null values and negative numbers

The JSON serializer does not handle null values and negative numbers and declares blocks containing them invalid. (Numerous instances of such NEM blocks were observed in real world.)

Integer overflow

The program does not check too long number strings that might overflow an integer. However, the underlying \texttt{stod} function from standard library throws an exception which is then caught by the program (in the very generic catch-all-exceptions block) and the program ends with unspecified parsing error. This happens at: JsonAttribute.cpp:49.

JSON - not validating quotes at attribute names

JSON serializer expects quotes around attribute names, but does not check whether they are actually there. Replacing the quotes with a random character makes the parser accept an invalid JSON file as a valid block.

String underflow

Empty attribute names cause the JSON parser to attempt to erase character at negative index from a string. However, the underlying \texttt{erase} function from standard library throws an exception which is then caught by the program (in the very generic catch-all-exceptions block) and the program ends with unspecified parsing error. This happens at JsonSerializer.cpp:278.

Missing block validation

The block hashes are not validated. Any two blocks with correct structure and consecutive timestamps are declared valid regardless of the block hash.

Memory leak

Multiple blocks of memory are allocated. If some allocations succeed and then at least one fails, an exception is thrown but the former successfully allocated blocks are never released. (However, the impact is limited, since the program then exits right away.) This happens at: Transaction.cpp:298 & 305

Parsing fails on some transaction types

Some transaction types that have been observed in the wild were (namely 2049/0x801 and 4100/0x1004) are not parsed correctly -- the parser claims the block is invalid when converting it from JSON object to block structure (hence, these blocks do not even reach the checks for supported transaction types later in the code and the expected exception of unsupported transaction type is not thrown).

Missing format validation

Format of some of the data is not checked. For example, the parser accepts hash of arbitrary length as valid.

Not handling embedded quotes in string

JSON parser does not handle embedded (escaped) quotes in string correctly (e.g. string "Hello "world"!"). One such block has been observed in the wild.

Missing Transaction validation crypto

See line 320 Transaction.cpp.