fix(station): reject self-validating external canister calls - #645
Open
MRmarioruci wants to merge 2 commits into
Open
fix(station): reject self-validating external canister calls#645MRmarioruci wants to merge 2 commits into
MRmarioruci wants to merge 2 commits into
Conversation
CallExternalCanisterOperationInput::validate now rejects a validation method that resolves to the same (canister_id, method_name) as the execution method, on the generic validation path. The check previously existed only in services/external_canister.rs, so the generic path could register a policy whose validation and execution targets are identical. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR closes a validation gap in the station request-operation model layer by ensuring an external canister call cannot “self-validate” (i.e., use the same (canister_id, method_name) for both validation and execution), which could otherwise allow a request to effectively approve itself depending on how validation is performed.
Changes:
- Add a pre-check in
CallExternalCanisterOperationInput::validaterejecting validation and execution methods that target the same canister method. - Add a unit test asserting the new guard returns
ExternalCanisterValidationError::ValidationErrorand runs before canister-existence validation.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
✅ No security or compliance issues detected. Reviewed everything up to df1338e. Security Overview
Detected Code Changes
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change
The rule that an external-canister call's validation method must differ from its execution method was enforced in
services/external_canister.rsbut not in the generic model validator, so the two paths could disagree about whether a configuration was acceptable.CallExternalCanisterOperationInput::validatenow applies the same rule. The check runs before canister-existence validation so the ordering of the two cannot change the outcome.Tests
validate_rejects_validation_method_equal_to_execution_method