scalardl-java-client-sdk icon indicating copy to clipboard operation
scalardl-java-client-sdk copied to clipboard

Bug regarding scalarDLT 2.0.4 ledger asset proof and utf-8 characters.

Open scalarindetail opened this issue 5 years ago • 0 comments

An error of BufferOverflowException occurs when a non-ascii utf-8 character is inserted any of the field such as the argument, cert_holder_id, contractID, like so:

java.nio.BufferOverflowException
	at java.nio.HeapByteBuffer.put(HeapByteBuffer.java:189)
	at java.nio.ByteBuffer.put(ByteBuffer.java:859)
	at com.scalar.dl.ledger.database.scalardb.AssetProofComposer.serialize(AssetProofComposer.java:64)
	at com.scalar.dl.ledger.database.scalardb.AssetProofComposer.create(AssetProofComposer.java:30)
	at com.scalar.dl.ledger.database.scalardb.ScalarTamperEvidentAssetbase.lambda$createProofs$9(ScalarTamperEvidentAssetbase.java:237)

But as we check the cassandra, the non-ascii utf-8 is able to be inserted into the cassandra database. To reproduce this: Spin up your scalarDLT server here.

There are two methods to reproduce the error. Check the logs of the scalar-ledger container to see the error above...

Method One (easier) Run the web-java-sdk sample here.

Method Two Compile and run this java code:

public class Scalar {
  Injector injector;
  ClientService service;
  Properties properties = new Properties();

  Scalar() {
    properties.put(
        ClientConfig.CERT_PEM,
        "-----BEGIN CERTIFICATE-----\n"
            + "MIICizCCAjKgAwIBAgIUMEUDTdWsQpftFkqs6bCd6U++4nEwCgYIKoZIzj0EAwIw\n"
            + "bzELMAkGA1UEBhMCSlAxDjAMBgNVBAgTBVRva3lvMQ4wDAYDVQQHEwVUb2t5bzEf\n"
            + "MB0GA1UEChMWU2FtcGxlIEludGVybWVkaWF0ZSBDQTEfMB0GA1UEAxMWU2FtcGxl\n"
            + "IEludGVybWVkaWF0ZSBDQTAeFw0xODA5MTAwODA3MDBaFw0yMTA5MDkwODA3MDBa\n"
            + "MEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJ\n"
            + "bnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC\n"
            + "AAQEa6Gq6bKHsFU2pw0oBBCKkMaihSlRG97Z07rqlAKCO1J+7uUlXbRdhZ2uCjRj\n"
            + "d5cSG8rSWxRE703Ses+JBZPgo4HVMIHSMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE\n"
            + "DDAKBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRDd2MS9Ndo68PJ\n"
            + "y9K/RNY6syZW0zAfBgNVHSMEGDAWgBR+Y+v8yByDNp39G7trYrTfZ0UjJzAxBggr\n"
            + "BgEFBQcBAQQlMCMwIQYIKwYBBQUHMAGGFWh0dHA6Ly9sb2NhbGhvc3Q6ODg4OTAq\n"
            + "BgNVHR8EIzAhMB+gHaAbhhlodHRwOi8vbG9jYWxob3N0Ojg4ODgvY3JsMAoGCCqG\n"
            + "SM49BAMCA0cAMEQCIC/Bo4oNU6yHFLJeme5ApxoNdyu3rWyiqWPxJmJAr9L0AiBl\n"
            + "Gc/v+yh4dHIDhCrimajTQAYOG9n0kajULI70Gg7TNw==\n-----END CERTIFICATE-----\n");
    properties.put(
        ClientConfig.PRIVATE_KEY_PEM,
        "-----BEGIN EC PRIVATE KEY-----\n"
            + "MHcCAQEEICcJGMEw3dyXUGFu/5a36HqY0ynZi9gLUfKgYWMYgr/IoAoGCCqGSM49\n"
            + "AwEHoUQDQgAEBGuhqumyh7BVNqcNKAQQipDGooUpURve2dO66pQCgjtSfu7lJV20\n"
            + "XYWdrgo0Y3eXEhvK0lsURO9N0nrPiQWT4A==\n-----END EC PRIVATE KEY-----\n");
    properties.put(ClientConfig.CERT_HOLDER_ID, "foo@");
    properties.put(ClientConfig.SERVER_HOST, "127.0.0.1");
    injector = Guice.createInjector(new ClientModule(new ClientConfig(properties)));
    service = injector.getInstance(ClientService.class);
  }

  public static void main(String[] args) {
    Scalar scalar = new Scalar();

    try {

      scalar.service.registerCertificate();

      String contractID = "foo@_StateUpdaters";
      scalar.service.registerContract(
          contractID,
          "com.org1.contract.StateUpdater",
          "path/to/your/StateUpdater.class",
          java.util.Optional.empty());

      JsonObject argument =
          Json.createObjectBuilder().add("asset_id", "国家标准").add("state", 123).build();
      scalar.service.executeContract(contractID, argument);

      // this would also return error, but somehow the BufferOverflow error will not show
      // on the docker logs, but would be able to see it if you debug it.
      scalar.service.listContracts("銀行");
    } catch (Exception e) {
      e.printStackTrace();
    }
  }
}

The StateUpdater contract can be obtained from the node sdk repository.

scalarindetail avatar May 12 '20 04:05 scalarindetail