Skip to content

fix(python-sdk): add robust input validation and timeout bounding to REST requests - #43

Open
mozluk wants to merge 1 commit into
pacifica-fi:mainfrom
mozluk:mozluk-patch-1
Open

fix(python-sdk): add robust input validation and timeout bounding to REST requests#43
mozluk wants to merge 1 commit into
pacifica-fi:mainfrom
mozluk:mozluk-patch-1

Conversation

@mozluk

@mozluk mozluk commented Aug 30, 2026

Copy link
Copy Markdown

Motivation

This PR hardens the python-sdk repository by introducing comprehensive input validation bounds and explicit network request timeouts, as identified during the Pacific-Fi security audit[cite: 29]. Previously, decimal amounts, addresses, and leverage parameters lacked strict format and range checks, and outgoing REST requests lacked execution timeouts[cite: 29].

Modifications

  • Shared Input Validation (common/validate.py, tests/test_validate.py):
    • Implemented strict decimal string parsing and exact base-unit conversion (to_base_units) to prevent floating-point precision loss and silent token rounding[cite: 29].
    • Added validation guards for leverage ranges (1–50x) and base58 Solana address lengths[cite: 29].
    • Added and executed a comprehensive unit test suite covering validation logic[cite: 29].
  • Outbound Request Bounding (rest/*):
    • Enforced explicit execution timeouts on all requests.get and requests.post calls to prevent hanging connections[cite: 29].
    • Migrated query string arguments to safe parameter passing (params=)[cite: 29].

Checklist

  • Format your code according to the Contributor Guide.
  • Add unit tests as outlined in the Contributor Guide.
  • Update documentation as needed, including docstrings or example tutorials.

…REST requests

## Motivation

This PR hardens the `python-sdk` repository by introducing comprehensive input validation bounds and explicit network request timeouts, as identified during the Pacific-Fi security audit[cite: 29]. Previously, decimal amounts, addresses, and leverage parameters lacked strict format and range checks, and outgoing REST requests lacked execution timeouts[cite: 29].

## Modifications

* **Shared Input Validation (`common/validate.py`, `tests/test_validate.py`)**:
  * Implemented strict decimal string parsing and exact base-unit conversion (`to_base_units`) to prevent floating-point precision loss and silent token rounding[cite: 29].
  * Added validation guards for leverage ranges (1–50x) and base58 Solana address lengths[cite: 29].
  * Added and executed a comprehensive unit test suite covering validation logic[cite: 29].
* **Outbound Request Bounding (`rest/*`)**:
  * Enforced explicit execution timeouts on all `requests.get` and `requests.post` calls to prevent hanging connections[cite: 29].
  * Migrated query string arguments to safe parameter passing (`params=`)[cite: 29].

## Checklist

- [x] Format your code according to the Contributor Guide.
- [x] Add unit tests as outlined in the Contributor Guide.
- [x] Update documentation as needed, including docstrings or example tutorials.
```[cite: 29]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant