more hardening

paranoia.py

@@ -145,3 +145,11 @@ def assert_valid_bolt11(invoice:str):
         return
     assert_printable(invoice)
 
+
+# Check if boolean
+def assert_boolean(v:bool):
+    if not ENABLE_HARDENING:
+        return
+    if not isinstance(v, bool):
+        panic("not a boolean")
+    

tasks.py

@@ -22,7 +22,7 @@ from .execution_queue import execution_queue
 from .models import NWCKey, TrackedSpendNWC, GetNWC
 from .nwcp import NWCServiceProvider
 from .permission import nwc_permissions
-from .paranoia import assert_valid_wallet_id, assert_valid_pubkey, assert_sane_string, assert_valid_timestamp_seconds, assert_valid_expiration_seconds, assert_valid_msats, assert_valid_positive_int, assert_valid_bolt11, assert_valid_sha256
+from .paranoia import assert_valid_wallet_id, assert_valid_pubkey, assert_boolean, assert_sane_string,  assert_valid_expiration_seconds, assert_valid_msats, assert_valid_positive_int, assert_valid_bolt11, assert_valid_sha256
 
 
 async def _check(nwc: Optional[NWCKey], method: str) -> Optional[Dict]:
@@ -202,6 +202,8 @@ async def _on_multi_pay_invoice(
             # hardening #
             assert_valid_bolt11(invoice)
             assert_valid_msats(amount_msats)
+            if invoice_id:
+                assert_sane_string(invoice_id)
             # ## #
 
             res = await _process_invoice(
@@ -379,13 +381,14 @@ async def _on_list_transactions(
     limit = payload.get("limit", 10)
     offset = payload.get("offset", 0)
     unpaid = payload.get("unpaid", False)
-    tx_type = payload.get("type", None)
+    tx_type = payload.get("type", "")
 
     # hardening #
     assert_valid_positive_int(tfrom)
     assert_valid_positive_int(tto)
     assert_valid_positive_int(limit)
     assert_valid_positive_int(offset)
+    assert_boolean(unpaid)
     assert_sane_string(tx_type)
     # ## #
 

views_api.py

@@ -28,7 +28,7 @@ from .models import (
     GetBudgetsNWC
 )
 from .permission import nwc_permissions
-from .paranoia import assert_valid_wallet_id, assert_valid_pubkey, assert_sane_string
+from .paranoia import assert_valid_wallet_id, assert_valid_pubkey, assert_sane_string, assert_boolean
 
 nwcprovider_api_router = APIRouter()
 
@@ -57,6 +57,8 @@ async def api_get_nwcs(
 
     # hardening #
     assert_valid_wallet_id(wallet_id)
+    assert_boolean(include_expired)
+    assert_boolean(calculate_spent_budget)
     # ## # 
 
     wallet_nwcs = GetWalletNWC(
@@ -84,13 +86,14 @@ async def api_get_nwcs(
 )
 async def api_get_nwc(
     pubkey: str,
-    include_expired: Optional[bool] = False,
+    include_expired: bool = False,
     wallet: WalletTypeInfo = Depends(require_admin_key)
 ) -> NWCGetResponse:
     wallet_id = wallet.wallet.id
 
     # hardening #
     assert_valid_pubkey(pubkey)
+    assert_boolean(include_expired)
     assert_valid_wallet_id(wallet_id)
     # ## #