fix(platform)!: decode remote input with untrusted bincode and disk loads with trusted decoders

.github/workflows/tests-rs-workspace.yml

@@ -278,15 +278,69 @@ jobs:
             '
           }
 
+          # A derive that only generates a decoder (`DecodeUntrusted`, the
+          # `PlatformDeserialize` family) cannot change how a structure's
+          # existing fields or variants serialize, but every other derive
+          # stays part of the comparison: swapping `Serialize_repr` for
+          # `Serialize`, or dropping `Encode`, is a wire change the guard must
+          # keep catching. Rewrite each `#[derive(...)]` attribute, single- or
+          # multi-line, as one canonical line with the decoder-only derives
+          # removed, so a rustfmt reflow of the list is not read as a change
+          # either. The fields, the variants and the attributes that do shape
+          # the encoding (serde, repr, platform_serialize) are compared
+          # verbatim.
+          normalize_derives() {
+            awk '
+              function flush_derive(   n, i, item, out) {
+                n = split(buf, parts, ",")
+                out = ""
+                for (i = 1; i <= n; i++) {
+                  item = parts[i]
+                  gsub(/^[[:space:]]+|[[:space:]]+$/, "", item)
+                  if (item == "" || item == "DecodeUntrusted") continue
+                  if (item == "PlatformDeserialize" || item == "PlatformDeserializeTrusted") continue
+                  if (item == "PlatformDeserializeUntrusted") continue
+                  out = (out == "" ? item : out ", " item)
+                }
+                print "#[derive(" out ")]"
+                buf = ""
+              }
+              collecting {
+                if (index($0, ")]")) {
+                  sub(/\)\].*$/, "")
+                  buf = buf " " $0
+                  collecting = 0
+                  flush_derive()
+                } else {
+                  buf = buf " " $0
+                }
+                next
+              }
+              /^[[:space:]]*#\[derive\(/ {
+                sub(/^[[:space:]]*#\[derive\(/, "")
+                if (index($0, ")]")) {
+                  sub(/\)\].*$/, "")
+                  buf = $0
+                  flush_derive()
+                } else {
+                  buf = $0
+                  collecting = 1
+                }
+                next
+              }
+              { print }
+            '
+          }
+
           for file in $CHANGED_RS; do
             if [ ! -f "$file" ]; then continue; fi
             BASE_CONTENT=$(git show "$BASE_PARENT":"$file" 2>/dev/null || true)
             if [ -z "$BASE_CONTENT" ]; then continue; fi
 
-            BASE_APPEND=$(echo "$BASE_CONTENT" | extract_tagged_block "@append_only")
-            PR_APPEND=$(extract_tagged_block "@append_only" < "$file")
-            BASE_IMMUTABLE=$(echo "$BASE_CONTENT" | extract_tagged_block "@immutable")
-            PR_IMMUTABLE=$(extract_tagged_block "@immutable" < "$file")
+            BASE_APPEND=$(echo "$BASE_CONTENT" | extract_tagged_block "@append_only" | normalize_derives)
+            PR_APPEND=$(extract_tagged_block "@append_only" < "$file" | normalize_derives)
+            BASE_IMMUTABLE=$(echo "$BASE_CONTENT" | extract_tagged_block "@immutable" | normalize_derives)
+            PR_IMMUTABLE=$(extract_tagged_block "@immutable" < "$file" | normalize_derives)
 
             if [ -n "$BASE_APPEND" ]; then
               # Check for deletions, ignoring comment-only lines and the tag itself

packages/rs-dapi/src/services/platform_service/error_mapping.rs

@@ -2,7 +2,7 @@ use base64::{engine, prelude::Engine as _};
 use dapi_grpc::platform::v0::{
     StateTransitionBroadcastError, WaitForStateTransitionResultResponse,
 };
-use dpp::{consensus::ConsensusError, serialization::PlatformDeserializable};
+use dpp::{consensus::ConsensusError, serialization::PlatformDeserializableUntrusted};
 use std::{fmt::Debug, str::FromStr};
 use tonic::{Code, metadata::MetadataValue};
 
@@ -23,7 +23,7 @@ impl TenderdashStatus {
     pub fn new(code: i64, message: Option<String>, consensus_error: Option<Vec<u8>>) -> Self {
         // sanity check: consensus_error must deserialize to ConsensusError if present
         if let Some(ref bytes) = consensus_error
-            && ConsensusError::deserialize_from_bytes(bytes).is_err()
+            && ConsensusError::deserialize_from_bytes_untrusted(bytes).is_err()
         {
             tracing::debug!(
                 data = hex::encode(bytes),
@@ -95,10 +95,12 @@ impl TenderdashStatus {
         }
 
         if let Some(consensus_error_bytes) = &self.consensus_error
-            && let Ok(consensus_error) =
-                ConsensusError::deserialize_from_bytes(consensus_error_bytes).inspect_err(|e| {
-                    tracing::debug!("Failed to deserialize consensus error: {}", e);
-                })
+            && let Ok(consensus_error) = ConsensusError::deserialize_from_bytes_untrusted(
+                consensus_error_bytes,
+            )
+            .inspect_err(|e| {
+                tracing::debug!("Failed to deserialize consensus error: {}", e);
+            })
         {
             return consensus_error.to_string();
         }
@@ -285,7 +287,7 @@ pub(super) fn decode_consensus_error(info_base64: String) -> Option<Vec<u8>> {
         })?;
 
     // sanity check: serialized error must deserialize to ConsensusError
-    if ConsensusError::deserialize_from_bytes(&serialized_error).is_err() {
+    if ConsensusError::deserialize_from_bytes_untrusted(&serialized_error).is_err() {
         tracing::debug!(
             data = hex::encode(&serialized_error),
             "Drive error info 'serializedError' failed to deserialize to ConsensusError"
@@ -479,7 +481,7 @@ mod tests {
         setup_tracing();
         let decoded = decode_consensus_error(info_base64.to_string())
             .expect("decode consensus error from fixture");
-        ConsensusError::deserialize_from_bytes(&decoded).expect("should deserialize");
+        ConsensusError::deserialize_from_bytes_untrusted(&decoded).expect("should deserialize");
     }
 
     // -- map_tenderdash_message tests --

packages/rs-dpp/src/address_funds/fee_strategy/mod.rs

@@ -2,11 +2,11 @@ pub mod deduct_fee_from_inputs_and_outputs;
 
 pub use deduct_fee_from_inputs_and_outputs::FeeDeductionResult;
 
-use bincode::{Decode, Encode};
+use bincode::{Decode, DecodeUntrusted, Encode};
 #[cfg(feature = "serde-conversion")]
 use serde::{Deserialize, Serialize};
 
-#[derive(Debug, Clone, Encode, Decode, PartialEq, Eq, Hash)]
+#[derive(Debug, Clone, Encode, Decode, PartialEq, Eq, Hash, DecodeUntrusted)]
 pub enum AddressFundsFeeStrategyStep {
     /// Deduct fee from a specific input address by index.
     /// The input must have remaining balance after its contribution to outputs.

packages/rs-dpp/src/address_funds/platform_address.rs

@@ -3,7 +3,7 @@ use crate::address_funds::AddressWitnessVerificationOperations;
 use crate::prelude::AddressNonce;
 use crate::ProtocolError;
 use bech32::{Bech32m, Hrp};
-use bincode::{Decode, Encode};
+use bincode::{Decode, DecodeUntrusted, Encode};
 use dashcore::address::Payload;
 use dashcore::blockdata::script::ScriptBuf;
 use dashcore::hashes::{sha256d, Hash};
@@ -12,7 +12,9 @@ use dashcore::secp256k1::ecdsa::RecoverableSignature;
 use dashcore::secp256k1::Message;
 use dashcore::signer::CompactSignature;
 use dashcore::{Address, Network, PrivateKey, PubkeyHash, PublicKey, ScriptHash};
-use platform_serialization_derive::{PlatformDeserialize, PlatformSerialize};
+use platform_serialization_derive::{
+    PlatformDeserializeTrusted, PlatformDeserializeUntrusted, PlatformSerialize,
+};
 #[cfg(feature = "serde-conversion")]
 use serde::{Deserialize, Serialize};
 use std::convert::TryFrom;
@@ -33,7 +35,9 @@ pub const ADDRESS_HASH_SIZE: usize = 20;
     Encode,
     Decode,
     PlatformSerialize,
-    PlatformDeserialize,
+    PlatformDeserializeTrusted,
+    PlatformDeserializeUntrusted,
+    DecodeUntrusted,
 )]
 #[platform_serialize(unversioned)]
 pub enum PlatformAddress {
@@ -428,9 +432,9 @@ impl PlatformAddress {
     /// Uses bincode deserialization which expects: 0x00 for P2pkh, 0x01 for P2sh.
     pub fn from_bytes(bytes: &[u8]) -> Result<Self, ProtocolError> {
         let (address, _): (Self, usize) =
-            bincode::decode_from_slice(bytes, bincode::config::standard()).map_err(|e| {
-                ProtocolError::DecodingError(format!("cannot decode PlatformAddress: {}", e))
-            })?;
+            bincode::decode_from_slice_untrusted(bytes, bincode::config::standard()).map_err(
+                |e| ProtocolError::DecodingError(format!("cannot decode PlatformAddress: {}", e)),
+            )?;
         Ok(address)
     }
 

packages/rs-dpp/src/address_funds/witness.rs

@@ -1,9 +1,9 @@
 #[cfg(feature = "json-conversion")]
 use crate::serialization::json_safe_fields;
-use bincode::de::{BorrowDecoder, Decoder};
+use bincode::de::BorrowDecoder;
 use bincode::enc::Encoder;
 use bincode::error::{DecodeError, EncodeError};
-use bincode::{Decode, Encode};
+use bincode::Encode;
 use platform_value::BinaryData;
 #[cfg(feature = "serde-conversion")]
 use serde::{Deserialize, Serialize};
@@ -77,36 +77,46 @@ impl Encode for AddressWitness {
     }
 }
 
-impl<C> Decode<C> for AddressWitness {
-    fn decode<D: Decoder<Context = C>>(decoder: &mut D) -> Result<Self, DecodeError> {
-        let discriminant = u8::decode(decoder)?;
-        match discriminant {
-            0 => {
-                let signature = BinaryData::decode(decoder)?;
-                Ok(AddressWitness::P2pkh { signature })
-            }
-            1 => {
-                let signatures = Vec::<BinaryData>::decode(decoder)?;
-                if signatures.len() > MAX_P2SH_SIGNATURES {
-                    return Err(DecodeError::OtherString(format!(
-                        "P2SH signatures count {} exceeds maximum {}",
-                        signatures.len(),
-                        MAX_P2SH_SIGNATURES,
-                    )));
+// Share the wire schema and domain checks across both decoding APIs.
+macro_rules! impl_address_witness_decode {
+    ($decode:ident, $decoder:ident, $method:ident, $untrusted:expr) => {
+        impl<C> bincode::$decode<C> for AddressWitness {
+            fn $method<D: bincode::de::$decoder<Context = C>>(
+                decoder: &mut D,
+            ) -> Result<Self, DecodeError> {
+                let discriminant = u8::$method(decoder)?;
+                match discriminant {
+                    0 => {
+                        let signature = BinaryData::$method(decoder)?;
+                        Ok(AddressWitness::P2pkh { signature })
+                    }
+                    1 => {
+                        let signatures = Vec::<BinaryData>::$method(decoder)?;
+                        if signatures.len() > MAX_P2SH_SIGNATURES {
+                            return Err(DecodeError::OtherString(format!(
+                                "P2SH signatures count {} exceeds maximum {}",
+                                signatures.len(),
+                                MAX_P2SH_SIGNATURES,
+                            )));
+                        }
+                        let redeem_script = BinaryData::$method(decoder)?;
+                        Ok(AddressWitness::P2sh {
+                            signatures,
+                            redeem_script,
+                        })
+                    }
+                    _ => Err(DecodeError::OtherString(format!(
+                        "Invalid AddressWitness discriminant: {}",
+                        discriminant
+                    ))),
                 }
-                let redeem_script = BinaryData::decode(decoder)?;
-                Ok(AddressWitness::P2sh {
-                    signatures,
-                    redeem_script,
-                })
             }
-            _ => Err(DecodeError::OtherString(format!(
-                "Invalid AddressWitness discriminant: {}",
-                discriminant
-            ))),
         }
-    }
+    };
 }
+impl_address_witness_decode!(Decode, Decoder, decode, false);
+impl_address_witness_decode!(DecodeUntrusted, UntrustedDecoder, decode_untrusted, true);
+bincode::impl_borrow_decode_untrusted!(AddressWitness);
 
 impl<'de, C> bincode::BorrowDecode<'de, C> for AddressWitness {
     fn borrow_decode<D: BorrowDecoder<'de, Context = C>>(

packages/rs-dpp/src/asset_lock/reduced_asset_lock_value/mod.rs

@@ -1,9 +1,11 @@
 use crate::asset_lock::reduced_asset_lock_value::v0::AssetLockValueV0;
 use crate::fee::Credits;
 use crate::ProtocolError;
-use bincode::{Decode, Encode};
+use bincode::{Decode, DecodeUntrusted, Encode};
 use derive_more::From;
-use platform_serialization_derive::{PlatformDeserialize, PlatformSerialize};
+use platform_serialization_derive::{
+    PlatformDeserializeTrusted, PlatformDeserializeUntrusted, PlatformSerialize,
+};
 use platform_value::Bytes32;
 use platform_version::version::PlatformVersion;
 
@@ -17,11 +19,13 @@ pub use v0::{AssetLockValueGettersV0, AssetLockValueSettersV0};
     Encode,
     Decode,
     PlatformSerialize,
-    PlatformDeserialize,
+    PlatformDeserializeTrusted,
+    PlatformDeserializeUntrusted,
     From,
     PartialEq,
     serde::Serialize,
     serde::Deserialize,
+    DecodeUntrusted,
 )]
 // Stored asset-lock values are decoded from GroveDB proof elements on the
 // client before the quorum signature is checked, so the byte budget must be
@@ -234,7 +238,7 @@ mod json_convertible_tests {
 #[cfg(test)]
 mod deserialize_limit_tests {
     use super::*;
-    use crate::serialization::{PlatformDeserializable, PlatformSerializable};
+    use crate::serialization::{PlatformDeserializableUntrusted, PlatformSerializable};
 
     /// Bincode-encode the V0 shape by hand so the `tx_out_script` length prefix
     /// can claim more bytes than exist in the payload.
@@ -258,7 +262,7 @@ mod deserialize_limit_tests {
     #[test]
     fn rejects_script_length_prefix_beyond_budget_without_allocating() {
         let payload = payload_with_script_length(8_000_000_000);
-        let err = AssetLockValue::deserialize_from_bytes(&payload)
+        let err = AssetLockValue::deserialize_from_bytes_untrusted(&payload)
             .expect_err("oversized length prefix must be rejected");
         assert!(
             matches!(err, ProtocolError::MaxEncodedBytesReachedError { .. }),
@@ -286,7 +290,8 @@ mod deserialize_limit_tests {
         )
         .expect("value");
         let bytes = original.serialize_to_bytes().expect("serialize");
-        let recovered = AssetLockValue::deserialize_from_bytes(&bytes).expect("deserialize");
+        let recovered =
+            AssetLockValue::deserialize_from_bytes_untrusted(&bytes).expect("deserialize");
         assert_eq!(original, recovered);
     }
 }

packages/rs-dpp/src/asset_lock/reduced_asset_lock_value/v0/mod.rs

@@ -1,14 +1,16 @@
 use crate::fee::Credits;
 #[cfg(feature = "json-conversion")]
 use crate::serialization::json_safe_fields;
-use bincode::{Decode, Encode};
+use bincode::{Decode, DecodeUntrusted, Encode};
 use platform_value::Bytes32;
 
 // `initial_credit_value` / `remaining_credit_value` are `Credits` (u64) and can
 // exceed JS's `MAX_SAFE_INTEGER`; `#[json_safe_fields]` serializes them as
 // strings in human-readable JSON to avoid precision loss when crossing to JS.
 #[cfg_attr(feature = "json-conversion", json_safe_fields)]
-#[derive(Debug, Clone, Encode, Decode, PartialEq, serde::Serialize, serde::Deserialize)]
+#[derive(
+    Debug, Clone, Encode, Decode, PartialEq, serde::Serialize, serde::Deserialize, DecodeUntrusted,
+)]
 pub struct AssetLockValueV0 {
     pub(super) initial_credit_value: Credits,
     pub(super) tx_out_script: Vec<u8>,

packages/rs-dpp/src/balances/credits.rs

@@ -10,6 +10,7 @@
 
 use crate::prelude::BlockHeight;
 use crate::ProtocolError;
+use bincode::{Decode, DecodeUntrusted, Encode};
 use integer_encoding::VarInt;
 use std::collections::BTreeMap;
 use std::convert::TryFrom;
@@ -42,7 +43,7 @@ pub const MAX_CREDITS: Credits = 9223372036854775807 as Credits; //i64 Max
 pub const CREDITS_PER_DUFF: Credits = 1000;
 
 /// An enum for credit operations
-#[derive(Debug, Clone, Copy, PartialEq, Eq, bincode::Encode, bincode::Decode)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Encode, Decode, DecodeUntrusted)]
 pub enum CreditOperation {
     /// We are setting credit amounts
     SetCredits(Credits),
@@ -51,7 +52,7 @@ pub enum CreditOperation {
 }
 
 /// An enum for credit operations in compacted address blobs
-#[derive(Debug, Clone, PartialEq, Eq, bincode::Encode, bincode::Decode)]
+#[derive(Debug, Clone, PartialEq, Eq, Encode, Decode, DecodeUntrusted)]
 pub enum BlockAwareCreditOperation {
     /// We are setting credit amounts - the final value after all operations
     SetCredits(Credits),

packages/rs-dpp/src/balances/total_single_token_balance/mod.rs

@@ -1,14 +1,17 @@
 use crate::balances::credits::SignedTokenAmount;
 use crate::ProtocolError;
 #[cfg(feature = "fixtures-and-mocks")]
-use bincode::Encode;
+use bincode::{DecodeUntrusted, Encode};
 #[cfg(feature = "fixtures-and-mocks")]
 use platform_serialization::de::Decode;
 use std::fmt;
 
 /// A structure where the token supply and the aggregated token account balances should always be equal
 #[derive(Copy, Clone, Debug)]
-#[cfg_attr(feature = "fixtures-and-mocks", derive(Encode, Decode))]
+#[cfg_attr(
+    feature = "fixtures-and-mocks",
+    derive(Encode, Decode, DecodeUntrusted)
+)]
 pub struct TotalSingleTokenBalance {
     /// the token supply
     pub token_supply: SignedTokenAmount,