Repository navigation
[FIX] medium severity - #27
Merged
Merged
Conversation
…ations. BitGoSDK now declares accessToken, coin and testNet, and BitGoExpress declares hostname, port and coin. They stay public, as they were when PHP created them dynamically, so existing reads keep working. The tests no longer construct clients with @.
The PSR-12 pass in cd4c88c already converted every `string $x = null` to `?string $x = null`. This test reads each method's declaration and fails if a typed parameter that defaults to null is no longer marked nullable, since PHP 8.4 deprecates the implicit form.
__execute() now passes the result of curlOptions() to curl_setopt_array(), so tests can check URLs, headers and TLS settings without making a request. No behaviour change.
login() set a flag that was never cleared, so every later call went out with no Authorization or Content-Type header. The token it returned was thrown away too. login() now stores a successful response's access_token in $accessToken, and only the login request itself leaves out the Authorization header. Every request sends Content-Type: application/json.
Express could only be reached over plain http://, so passphrases and private
keys crossed the network unencrypted whenever Express ran on another host.
Prefix the hostname with https:// to use TLS, for example
new BitGoExpress('https://express.internal', 3080). A bare hostname still
uses http://, and any other scheme throws InvalidArgumentException.
setCaFile() trusts the CAs in a PEM file. For a self-signed Express
certificate, pass the certificate itself. setVerifyTls(false) turns off
certificate and hostname checks. It is meant for local testing only.
The UTXO list included Stacks (stx, tstx), which is account-based, and left out Dogecoin and Bitcoin Gold testnet. Most other checks compared against the mainnet code only, so testnet wallets silently lost params: gasPrice, enterprise and the like on teth, feeTxConfirmTarget on tbtc, segwit on tltc, dt on txrp and memoId on txlm. Each check now uses a coin family that lists the mainnet and testnet codes. The ETH family also includes the Goerli (gteth) and Holesky (hteth) codes. generateWallet() also stops sending gasPrice: 0 for non-ETH coins. That 0 used to be filtered out, but since 0 values are sent, it reached BitGo.
Both clients set CURLOPT_IPRESOLVE to IPv4 unconditionally, which breaks IPv6-only hosts. cURL now uses IPv4 or IPv6 as the system allows. Call setForceIPv4(true) to get the old behaviour back. When BitGoSDK::setRequestIP() binds a local address, requests resolve to that address's IP version, since a bound address can't reach the other one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.