feat(api): improve request handling and validation

actuator/src/main/java/org/tron/core/actuator/ActuatorConstant.java

@@ -8,6 +8,8 @@ public class ActuatorConstant {
   public static final String NOT_EXIST_STR = "] not exists";
   public static final String TX_RESULT_NULL = "TransactionResultCapsule is null";
   public static final String CONTRACT_NOT_EXIST = "No contract!";
+  public static final String CONTRACT_SIZE_NOT_EQUAL_TO_ONE =
+      "contract size should be exactly 1, this is extend feature ,actual :%d";
   public static final String STORE_NOT_EXIST = "No account store or dynamic store!";
   public static final int ONE_HUNDRED = 100;
   public static final int PRECISION_DECIMAL = 6;

actuator/src/main/java/org/tron/core/utils/TransactionUtil.java

@@ -40,6 +40,7 @@
 import org.tron.api.GrpcAPI.TransactionSignWeight.Result;
 import org.tron.common.utils.Sha256Hash;
 import org.tron.core.ChainBaseManager;
+import org.tron.core.actuator.ActuatorConstant;
 import org.tron.core.capsule.AccountCapsule;
 import org.tron.core.capsule.TransactionCapsule;
 import org.tron.core.exception.PermissionException;
@@ -197,6 +198,14 @@ public static Transaction truncateSignatures(Transaction trx) {
   public TransactionSignWeight getTransactionSignWeight(Transaction trx) {
     TransactionSignWeight.Builder tswBuilder = TransactionSignWeight.newBuilder();
     Result.Builder resultBuilder = Result.newBuilder();
+    int contractCount = trx.getRawData().getContractCount();
+    if (contractCount > 1) {
+      resultBuilder.setCode(Result.response_code.OTHER_ERROR);
+      resultBuilder.setMessage("Invalid transaction: "
+          + String.format(ActuatorConstant.CONTRACT_SIZE_NOT_EQUAL_TO_ONE, contractCount));
+      tswBuilder.setResult(resultBuilder);
+      return tswBuilder.build();
+    }
     if (trx.getSignatureCount() > chainBaseManager.getDynamicPropertiesStore()
         .getTotalSignNum()) {
       resultBuilder.setCode(Result.response_code.OTHER_ERROR);

common/src/main/java/org/tron/common/utils/DecodeUtil.java

@@ -14,19 +14,16 @@ public class DecodeUtil {
 
   public static boolean addressValid(byte[] address) {
     if (ArrayUtils.isEmpty(address)) {
-      logger.warn("Warning: Address is empty !!");
+      logger.debug("Address is empty !!");
       return false;
     }
     if (address.length != ADDRESS_SIZE / 2) {
-      logger.warn(
-          "Warning: Address length need " + ADDRESS_SIZE + " but " + address.length
-              + " !!");
+      logger.debug("Address length need {} but {} !!", ADDRESS_SIZE, address.length);
       return false;
     }
 
     if (address[0] != addressPreFixByte) {
-      logger.warn("Warning: Address need prefix with " + addressPreFixByte + " but "
-          + address[0] + " !!");
+      logger.debug("Address need prefix with {} but {} !!", addressPreFixByte, address[0]);
       return false;
     }
     return true;

framework/src/main/java/org/tron/core/Wallet.java

@@ -171,6 +171,7 @@
 import org.tron.core.exception.AccountResourceInsufficientException;
 import org.tron.core.exception.BadItemException;
 import org.tron.core.exception.ContractExeException;
+import org.tron.core.exception.ContractSizeNotEqualToOneException;
 import org.tron.core.exception.ContractValidateException;
 import org.tron.core.exception.DupTransactionException;
 import org.tron.core.exception.HeaderNotFound;
@@ -567,9 +568,14 @@ public GrpcAPI.Return broadcastTransaction(Transaction signedTransaction) {
       if (chainBaseManager.getDynamicPropertiesStore().supportVM()) {
         trx.resetResult();
       }
-      if (trx.getInstance().getRawData().getContractCount() == 0) {
+      int contractCount = trx.getInstance().getRawData().getContractCount();
+      if (contractCount == 0) {
         throw new ContractValidateException(ActuatorConstant.CONTRACT_NOT_EXIST);
       }
+      if (contractCount > 1) {
+        throw new ContractSizeNotEqualToOneException(String.format(
+            "tx %s " + ActuatorConstant.CONTRACT_SIZE_NOT_EQUAL_TO_ONE, txID, contractCount));
+      }
       trx.checkExpiration(chainBaseManager.getNextBlockSlotTime());
       dbManager.pushTransaction(trx);
       TransactionMessage message = new TransactionMessage(trx.getInstance().toByteArray());
@@ -632,6 +638,14 @@ public TransactionApprovedList getTransactionApprovedList(Transaction trx) {
     TransactionApprovedList.Builder tswBuilder = TransactionApprovedList.newBuilder();
     TransactionApprovedList.Result.Builder resultBuilder = TransactionApprovedList.Result
         .newBuilder();
+    int contractCount = trx.getRawData().getContractCount();
+    if (contractCount > 1) {
+      resultBuilder.setCode(TransactionApprovedList.Result.response_code.OTHER_ERROR);
+      resultBuilder.setMessage("Invalid transaction: "
+          + String.format(ActuatorConstant.CONTRACT_SIZE_NOT_EQUAL_TO_ONE, contractCount));
+      tswBuilder.setResult(resultBuilder);
+      return tswBuilder.build();
+    }
     if (trx.getSignatureCount() > chainBaseManager.getDynamicPropertiesStore()
         .getTotalSignNum()) {
       resultBuilder.setCode(TransactionApprovedList.Result.response_code.OTHER_ERROR);
@@ -2759,6 +2773,10 @@ public BytesMessage getShieldTransactionHash(Transaction transaction)
     if (contract == null || contract.isEmpty()) {
       throw new ContractValidateException("Contract is null");
     }
+    if (contract.size() > 1) {
+      throw new ContractValidateException(
+          String.format(ActuatorConstant.CONTRACT_SIZE_NOT_EQUAL_TO_ONE, contract.size()));
+    }
     ContractType contractType = contract.get(0).getType();
     if (contractType != ContractType.ShieldedTransferContract) {
       throw new ContractValidateException("Not a shielded transaction");

framework/src/main/java/org/tron/core/db/Manager.java

@@ -88,6 +88,7 @@
 import org.tron.core.ChainBaseManager;
 import org.tron.core.Constant;
 import org.tron.core.Wallet;
+import org.tron.core.actuator.ActuatorConstant;
 import org.tron.core.actuator.ActuatorCreator;
 import org.tron.core.capsule.AccountCapsule;
 import org.tron.core.capsule.BlockBalanceTraceCapsule;
@@ -1477,8 +1478,7 @@ public TransactionInfo processTransaction(final TransactionCapsule trxCap, Block
     Sha256Hash txId = trxCap.getTransactionId();
     if (trxCap.getInstance().getRawData().getContractList().size() != 1) {
       throw new ContractSizeNotEqualToOneException(
-          String.format(
-              "tx %s contract size should be exactly 1, this is extend feature ,actual :%d",
+          String.format("tx %s " + ActuatorConstant.CONTRACT_SIZE_NOT_EQUAL_TO_ONE,
               txId, trxCap.getInstance().getRawData().getContractList().size()));
     }
     Contract contract = trxCap.getInstance().getRawData().getContract(0);

framework/src/main/java/org/tron/core/services/RpcApiService.java

@@ -76,6 +76,7 @@
 import org.tron.common.utils.StringUtil;
 import org.tron.core.ChainBaseManager;
 import org.tron.core.Wallet;
+import org.tron.core.actuator.ActuatorConstant;
 import org.tron.core.capsule.AccountCapsule;
 import org.tron.core.capsule.BlockCapsule;
 import org.tron.core.capsule.TransactionCapsule;
@@ -2503,6 +2504,18 @@ public void updateBrokerage(UpdateBrokerageContract request,
     @Override
     public void createCommonTransaction(Transaction request,
         StreamObserver<TransactionExtention> responseObserver) {
+      int contractCount = request.getRawData().getContractCount();
+      if (contractCount != 1) {
+        String message = contractCount == 0 ? ActuatorConstant.CONTRACT_NOT_EXIST
+            : String.format(ActuatorConstant.CONTRACT_SIZE_NOT_EQUAL_TO_ONE, contractCount);
+        Return result = Return.newBuilder().setResult(false)
+            .setCode(response_code.CONTRACT_VALIDATE_ERROR)
+            .setMessage(ByteString.copyFromUtf8(Wallet.CONTRACT_VALIDATE_ERROR + message))
+            .build();
+        responseObserver.onNext(TransactionExtention.newBuilder().setResult(result).build());
+        responseObserver.onCompleted();
+        return;
+      }
       Transaction.Contract contract = request.getRawData().getContract(0);
       createTransactionExtention(contract.getParameter(), contract.getType(),
           responseObserver);

framework/src/main/java/org/tron/core/services/http/BroadcastServlet.java

@@ -1,5 +1,6 @@
 package org.tron.core.services.http;
 
+import com.google.protobuf.ByteString;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import lombok.extern.slf4j.Slf4j;
@@ -9,6 +10,7 @@
 import org.tron.common.utils.ByteArray;
 import org.tron.core.Wallet;
 import org.tron.core.capsule.TransactionCapsule;
+import org.tron.core.exception.ContractSizeNotEqualToOneException;
 import org.tron.json.JSONObject;
 import org.tron.protos.Protocol.Transaction;
 
@@ -23,11 +25,21 @@ public class BroadcastServlet extends RateLimiterServlet {
   protected void doPost(HttpServletRequest request, HttpServletResponse response) {
     try {
       PostParams params = PostParams.getPostParams(request);
-      Transaction transaction = Util.packTransaction(params.getParams(), params.isVisible());
-      TransactionCapsule transactionCapsule = new TransactionCapsule(transaction);
-      String transactionID = ByteArray
-          .toHexString(transactionCapsule.getTransactionId().getBytes());
-      GrpcAPI.Return result = wallet.broadcastTransaction(transaction);
+      GrpcAPI.Return result;
+      String transactionID = "";
+      try {
+        Transaction transaction = Util.packTransaction(params.getParams(), params.isVisible());
+        TransactionCapsule transactionCapsule = new TransactionCapsule(transaction);
+        transactionID = ByteArray
+            .toHexString(transactionCapsule.getTransactionId().getBytes());
+        result = wallet.broadcastTransaction(transaction);
+      } catch (ContractSizeNotEqualToOneException e) {
+        result = GrpcAPI.Return.newBuilder()
+            .setResult(false)
+            .setCode(GrpcAPI.Return.response_code.CONTRACT_VALIDATE_ERROR)
+            .setMessage(ByteString.copyFromUtf8(Wallet.CONTRACT_VALIDATE_ERROR + e.getMessage()))
+            .build();
+      }
       JSONObject res = JSONObject.outboundParseObject(
           JsonFormat.printToString(result, params.isVisible()));
       res.put("txid", transactionID);

framework/src/main/java/org/tron/core/services/http/GetShieldTransactionHashServlet.java

@@ -8,6 +8,8 @@
 import org.springframework.stereotype.Component;
 import org.tron.api.GrpcAPI.BytesMessage;
 import org.tron.core.Wallet;
+import org.tron.core.exception.ContractSizeNotEqualToOneException;
+import org.tron.core.exception.ContractValidateException;
 import org.tron.protos.Protocol.Transaction;
 
 
@@ -28,7 +30,12 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response)
           .collect(Collectors.joining(System.lineSeparator()));
       Util.checkBodySize(input);
       boolean visible = Util.getVisiblePost(input);
-      Transaction transaction = Util.packTransaction(input, visible);
+      Transaction transaction;
+      try {
+        transaction = Util.packTransaction(input, visible);
+      } catch (ContractSizeNotEqualToOneException e) {
+        throw new ContractValidateException(e.getMessage());
+      }
 
       BytesMessage result = wallet.getShieldTransactionHash(transaction);
       response.getWriter().println(JsonFormat.printToString(result, visible));

framework/src/main/java/org/tron/core/services/http/GetTransactionApprovedListServlet.java

@@ -7,6 +7,7 @@
 import org.springframework.stereotype.Component;
 import org.tron.api.GrpcAPI.TransactionApprovedList;
 import org.tron.core.Wallet;
+import org.tron.core.exception.ContractSizeNotEqualToOneException;
 import org.tron.protos.Protocol.Transaction;
 
 
@@ -24,8 +25,17 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
   protected void doPost(HttpServletRequest request, HttpServletResponse response) {
     try {
       PostParams params = PostParams.getPostParams(request);
-      Transaction transaction = Util.packTransaction(params.getParams(), params.isVisible());
-      TransactionApprovedList reply = wallet.getTransactionApprovedList(transaction);
+      TransactionApprovedList reply;
+      try {
+        Transaction transaction = Util.packTransaction(params.getParams(), params.isVisible());
+        reply = wallet.getTransactionApprovedList(transaction);
+      } catch (ContractSizeNotEqualToOneException e) {
+        TransactionApprovedList.Result result = TransactionApprovedList.Result.newBuilder()
+            .setCode(TransactionApprovedList.Result.response_code.OTHER_ERROR)
+            .setMessage("Invalid transaction: " + e.getMessage())
+            .build();
+        reply = TransactionApprovedList.newBuilder().setResult(result).build();
+      }
       if (reply != null) {
         response.getWriter().println(Util.printTransactionApprovedList(reply, params.isVisible()));
       } else {

framework/src/main/java/org/tron/core/services/http/GetTransactionSignWeightServlet.java

@@ -6,6 +6,7 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 import org.tron.api.GrpcAPI.TransactionSignWeight;
+import org.tron.core.exception.ContractSizeNotEqualToOneException;
 import org.tron.core.utils.TransactionUtil;
 import org.tron.protos.Protocol.Transaction;
 
@@ -24,8 +25,17 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) {
   protected void doPost(HttpServletRequest request, HttpServletResponse response) {
     try {
       PostParams params = PostParams.getPostParams(request);
-      Transaction transaction = Util.packTransaction(params.getParams(), params.isVisible());
-      TransactionSignWeight reply = transactionUtil.getTransactionSignWeight(transaction);
+      TransactionSignWeight reply;
+      try {
+        Transaction transaction = Util.packTransaction(params.getParams(), params.isVisible());
+        reply = transactionUtil.getTransactionSignWeight(transaction);
+      } catch (ContractSizeNotEqualToOneException e) {
+        TransactionSignWeight.Result result = TransactionSignWeight.Result.newBuilder()
+            .setCode(TransactionSignWeight.Result.response_code.OTHER_ERROR)
+            .setMessage("Invalid transaction: " + e.getMessage())
+            .build();
+        reply = TransactionSignWeight.newBuilder().setResult(result).build();
+      }
       if (reply != null) {
         response.getWriter().println(Util.printTransactionSignWeight(reply, params.isVisible()));
       } else {

framework/src/main/java/org/tron/core/services/http/JsonFormat.java

@@ -1344,6 +1344,7 @@ protected static class Tokenizer {
     private int previousLine = 0;
     private int previousColumn = 0;
     private int currentDepth = 0;
+    private int tokenCount = 0;
 
     public void enterRecursion() throws ParseException {
       if (currentDepth >= Constant.MAX_NESTING_DEPTH) {
@@ -1359,7 +1360,7 @@ public void exitRecursion() {
     /**
      * Construct a tokenizer that parses tokens from the given text.
      */
-    public Tokenizer(CharSequence text) {
+    public Tokenizer(CharSequence text) throws ParseException {
       this.text = text;
       matcher = WHITESPACE.matcher(text);
       skipWhitespace();
@@ -1410,7 +1411,7 @@ public boolean atEnd() {
     /**
      * Advance to the next token.
      */
-    public void nextToken() {
+    public void nextToken() throws ParseException {
       previousLine = line;
       previousColumn = column;
 
@@ -1440,6 +1441,14 @@ public void nextToken() {
           matcher.region(pos + 1, matcher.regionEnd());
         }
 
+        // Match Jackson's token count for JSON: separators are not tokens, but field names,
+        // values and container boundaries are. Each parsed document has its own budget.
+        if (!",".equals(currentToken) && !":".equals(currentToken)
+            && ++tokenCount > Constant.MAX_TOKEN_COUNT) {
+          throw new ParseException("Token count exceeds the maximum allowed ("
+              + Constant.MAX_TOKEN_COUNT + ").");
+        }
+
         skipWhitespace();
       }
     }
@@ -1458,7 +1467,7 @@ private void skipWhitespace() {
      * If the next token exactly matches {@code token}, consume it and return {@code true}.
      * Otherwise, return {@code false} without doing anything.
      */
-    public boolean tryConsume(String token) {
+    public boolean tryConsume(String token) throws ParseException {
       if (currentToken.equals(token)) {
         nextToken();
         return true;