What the developer wrote
Authored by Boris Nagaev
rpc: test mempool accept trailing byte rejection
What changed, and why it matters
This commit only adds a new unit test. It checks that the Bitcoin RPC command testmempoolaccept correctly rejects a transaction hex string that has extra trailing bytes. There is no code fix or behavior change in the main program—just a test verifying existing behavior.
No action required. This is a test-only commit. If you maintain btcd, consider reviewing whether the underlying deserialization logic is already strict enough in production, but the commit itself does not change it.
Security signals we found
Test verifies deserialization strictness for testmempoolaccept RPC input
Trailing-byte rejection is a common input-validation hardening measure
No production code change; signal strength is low
Evidence from the diff
The diff adds TestHandleTestMempoolAcceptRejectsTrailingBytes in rpcserver_test.go. It appends ‘00’ to txHex1 and asserts that handleTestMempoolAccept returns btcjson.ErrRPCDeserialization with a nil result. The test also uses recover() to ensure the handler does not panic or reach the mempool. No production code is modified.
Changed components
rpcserver_test.goInspect captured patch +19 / −0
diff --git a/rpcserver_test.go b/rpcserver_test.go
index 8ea8d18..e462564 100644
--- a/rpcserver_test.go
+++ b/rpcserver_test.go
@@ -70,6 +70,25 @@ func TestHandleTestMempoolAcceptFailDecode(t *testing.T) {
}
}
+// TestHandleTestMempoolAcceptRejectsTrailingBytes ensures testmempoolaccept
+// rejects byte strings that contain a valid transaction plus trailing data.
+func TestHandleTestMempoolAcceptRejectsTrailingBytes(t *testing.T) {
+ t.Parallel()
+
+ defer func() {
+ recovered := recover()
+ require.Nil(t, recovered, "handler reached mempool")
+ }()
+
+ cmd := btcjson.NewTestMempoolAcceptCmd([]string{txHex1 + "00"}, 0)
+ result, err := handleTestMempoolAccept(
+ &rpcServer{}, cmd, make(chan struct{}),
+ )
+
+ requireRPCErrorCode(t, err, btcjson.ErrRPCDeserialization)
+ require.Nil(t, result)
+}
+
// requireRPCErrorCode asserts that the error is an RPC error with the expected
// error code.
func requireRPCErrorCode(t *testing.T, err error, code btcjson.RPCErrorCode) {
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.