pyteal icon indicating copy to clipboard operation
pyteal copied to clipboard

Improve input validation for compound ABI types

Open jasonpaulos opened this issue 3 years ago • 1 comments

The ABI router does not currently provide input validation for compound types. This issue is to improve the situation with the following additions:

  • For static compound types, verifying the length of input values would be a low-cost but welcome validation step. (For static compound types of dynamic values, we could only verify that the minimum length if met.)

  • For all compound types, provide a verify() method which will verify the validity of the value at runtime, or panic if the value is invalid. Depending on the depth and dynamic-ness of a type, this may be an expensive operation, which is why it's better for users to explicitly call it if they need it, as supposed to always including this code.

jasonpaulos avatar Jul 20 '22 22:07 jasonpaulos

I worry that providing a verify() method will quickly be described as something you are "supposed" to call. But as you say, they can be quite expensive. And yet, for the stuff I can think of, it might be nicer to just proceed blindly - your contract will fail when you hit something wrong. (At least, the kind of wrong that is testable would also lead to failures, I think.)

jannotti avatar Jul 26 '22 19:07 jannotti