What the developer wrote
Authored by selsta
rpc: restrict get_alt_blocks_hashes
What changed, and why it matters
This commit changes one line in Monero's RPC server so that the get_alt_blocks_hashes endpoint is no longer available when the node is running in restricted mode. Previously, any caller could ask a restricted node for the list of alternative (orphaned/uncles) block hashes. The change suggests the developers decided this information should be treated as privileged, but the commit message does not explain why.
Treat as a minor hardening change. If running a public/restricted Monero RPC node, ensure this patch is applied so alternative-block hashes are not exposed to unauthenticated/unprivileged callers. Review whether other RPC endpoints expose similar metadata that should also be restricted.
Security signals we found
Access-control tightening on an RPC endpoint
Endpoint made conditional on !m_restricted
No explicit security explanation in commit message
No changes to handler logic or output sanitization
Evidence from the diff
In src/rpc/core_rpc_server.h, the macro mapping /get_alt_blocks_hashes from MAP_URI_AUTO_JON2 to MAP_URI_AUTO_JON2_IF adds a guard: !m_restricted. This makes the endpoint conditional on the node not being in restricted RPC mode. The diff itself is a one-line access-control tightening. No functional code of on_get_alt_blocks_hashes is changed, and no advisory or CVE is supplied.
Changed components
src/rpc/core_rpc_server.hRPC endpoint /get_alt_blocks_hashesRestricted RPC mode configurationInspect captured patch +1 / −1
diff --git a/src/rpc/core_rpc_server.h b/src/rpc/core_rpc_server.h
index ce87730..dac9b47 100644
--- a/src/rpc/core_rpc_server.h
+++ b/src/rpc/core_rpc_server.h
@@ -110,7 +110,7 @@ namespace cryptonote
MAP_URI_AUTO_BIN2("/get_outs.bin", on_get_outs_bin, COMMAND_RPC_GET_OUTPUTS_BIN)
MAP_URI_AUTO_JON2("/get_transactions", on_get_transactions, COMMAND_RPC_GET_TRANSACTIONS)
MAP_URI_AUTO_JON2("/gettransactions", on_get_transactions, COMMAND_RPC_GET_TRANSACTIONS)
- MAP_URI_AUTO_JON2("/get_alt_blocks_hashes", on_get_alt_blocks_hashes, COMMAND_RPC_GET_ALT_BLOCKS_HASHES)
+ MAP_URI_AUTO_JON2_IF("/get_alt_blocks_hashes", on_get_alt_blocks_hashes, COMMAND_RPC_GET_ALT_BLOCKS_HASHES, !m_restricted)
MAP_URI_AUTO_JON2("/is_key_image_spent", on_is_key_image_spent, COMMAND_RPC_IS_KEY_IMAGE_SPENT)
MAP_URI_AUTO_JON2("/send_raw_transaction", on_send_raw_tx, COMMAND_RPC_SEND_RAW_TX)
MAP_URI_AUTO_JON2("/sendrawtransaction", on_send_raw_tx, COMMAND_RPC_SEND_RAW_TX)
Why this scored 45/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.