AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 29 Bitcoin

rpcclient: compute httpURL once at construction time

Public commit record

What the developer wrote

Authored by Jacob Schuler

88/100 · Strong
rpcclient: compute httpURL once at construction time

httpURL was being recomputed on every JSON-RPC POST. It went through
ParseAddressString to discriminate Unix sockets from TCP, which
called net.ResolveTCPAddr and triggered a DNS lookup whose result
was thrown away.

Both inputs (config.Host and config.DisableTLS) are immutable after
New, so the URL is constant for the life of the Client. Compute it
once and store it on the Client, mirroring the parsedDialAddr cache
already in newHTTPClient.

The httpURL method now uses HasPrefix and runs exactly once per
Client. Drop its (string, error) signature — with the resolve gone
nothing can fail. Add table coverage for the URL strings, plus a
wiring test that catches refactors of New silently dropping the
assignment to Client.httpURL.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
The short version

What changed, and why it matters

This change is a performance and reliability fix, not a typical security patch. The Bitcoin RPC client was rebuilding the server URL on every request, and that rebuild triggered an unnecessary DNS lookup whose result was discarded. The patch computes the URL once when the client is created and reuses it. That removes a source of DNS failures, request delays, and potential information leakage to DNS resolvers, but it does not by itself fix an exploitable vulnerability.

Recommended action

Treat as a hardening/maintenance improvement rather than an urgent security fix. Users running RPC clients behind restrictive DNS or concerned about DNS leakage benefit from upgrading, but no immediate exploit is indicated. Reviewers should verify that the new prefix-based Unix-socket detection matches all previously supported address shapes and that newHTTPClient's validation still runs before httpURL is assigned.

Security signals we found

01

Eliminates per-request DNS resolution of RPC host, reducing DNS-based side channels and dependency on resolver availability

02

Removes error-returning address parsing from the request path, reducing opportunities for unexpected failures during RPC calls

03

Adds regression tests for URL construction and construction-time wiring

04

No input validation was removed: newHTTPClient still validates config.Host via ParseAddressString before httpURL is computed

Risk score

Why this scored 29/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 6/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.