Skip to content

fix(console,internal/ethapi,node,rpc): restrict debug_setHead to local transports#2297

Open
gzliudan wants to merge 1 commit intoXinFinOrg:v2.6.x-betafrom
gzliudan:disable-v268-debug-set-head
Open

fix(console,internal/ethapi,node,rpc): restrict debug_setHead to local transports#2297
gzliudan wants to merge 1 commit intoXinFinOrg:v2.6.x-betafrom
gzliudan:disable-v268-debug-set-head

Conversation

@gzliudan
Copy link
Copy Markdown
Collaborator

@gzliudan gzliudan commented Apr 10, 2026

Proposed changes

Add a local-only RPC API classification and use it to keep debug_setHead available over in-process RPC and IPC while hiding it from HTTP and WebSocket transports.

This also updates the admin RPC startup path and adds regression coverage for console visibility, transport exposure, and local-only API leakage.

Types of changes

What types of changes does your code introduce to XDC network?
Put an ✅ in the boxes that apply

  • build: Changes that affect the build system or external dependencies
  • ci: Changes to CI configuration files and scripts
  • chore: Changes that don't change source code or tests
  • docs: Documentation only changes
  • feat: A new feature
  • fix: A bug fix
  • perf: A code change that improves performance
  • refactor: A code change that neither fixes a bug nor adds a feature
  • revert: Revert something
  • style: Changes that do not affect the meaning of the code
  • test: Adding missing tests or correcting existing tests

Impacted Components

Which parts of the codebase does this PR touch?
Put an ✅ in the boxes that apply

  • Consensus
  • Account
  • Network
  • Geth
  • Smart Contract
  • External components
  • Not sure (Please specify below)

Checklist

Put an ✅ in the boxes once you have confirmed below actions (or provide reasons on not doing so) that

  • This PR has sufficient test coverage (unit/integration test) OR I have provided reason in the PR description for not having test coverage
  • Tested on a private network from the genesis block and monitored the chain operating correctly for multiple epochs.
  • Provide an end-to-end test plan in the PR description on how to manually test it on the devnet/testnet.
  • Tested the backwards compatibility.
  • Tested with XDC nodes running this version co-exist with those running the previous version.
  • Relevant documentation has been updated as part of this PR
  • N/A

Copilot AI review requested due to automatic review settings April 10, 2026 01:22
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Apr 10, 2026 •
edited
Loading

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3465acd0-f249-443d-ae9d-e53b5731678e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@gzliudan gzliudan requested review from AnilChinchawale, anunay-xin, benjamin202410, liam-lai and wanwiset25 and removed request for Copilot April 10, 2026 01:23
@gzliudan gzliudan requested a review from Copilot April 10, 2026 01:23
Copilot AI reviewed Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Introduces a “local-only” RPC API classification to keep debug_setHead available over IPC and in-process RPC while preventing exposure over HTTP/WebSocket, and adds regression tests to ensure transport filtering and console visibility behave as intended.

Changes:

  • Add rpc.API.Local and split node RPC API registration into “open” (HTTP/WS) vs “local” (IPC/in-proc) sets.
  • Mark the internal/ethapi private debug API as local-only and update admin RPC startup paths to use the open set.
  • Add tests covering local-only API leakage (node/admin + ethapi) and console hiding of debug.setHead when unavailable.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
rpc/types.go Adds API.Local flag to classify APIs as local-transport only.
node/node.go Splits API exposure by transport; registers local APIs for IPC/in-proc and open APIs for HTTP/WS.
node/api.go Ensures admin_startRPC / admin_startWS only enable open APIs.
node/api_test.go Adds regression test ensuring local-only APIs remain hidden from HTTP even when started via admin APIs.
internal/ethapi/backend.go Marks private debug API as local-only to prevent debug_setHead exposure over HTTP/WS.
internal/ethapi/api_local_test.go Adds transport-exposure test for debug_setHead vs other debug methods.
console/console.go Hides debug.setHead in the JS console when the RPC method is not available.
console/console_test.go Adds coverage for console behavior when debug_setHead exists vs does not exist on the RPC backend.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@gzliudan gzliudan force-pushed the disable-v268-debug-set-head branch from 639299e to d20ff10 Compare April 10, 2026 02:06
@gzliudan gzliudan requested a review from Copilot April 10, 2026 02:07
Copilot AI reviewed Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@gzliudan gzliudan force-pushed the disable-v268-debug-set-head branch 2 times, most recently from 00207c2 to d3c8b8c Compare April 10, 2026 02:49
@gzliudan gzliudan requested a review from Copilot April 10, 2026 02:49
Copilot AI reviewed Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@gzliudan gzliudan force-pushed the disable-v268-debug-set-head branch 2 times, most recently from f446c2d to 873614d Compare April 10, 2026 03:37
@gzliudan gzliudan requested a review from Copilot April 10, 2026 03:55
Copilot AI reviewed Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@gzliudan gzliudan force-pushed the disable-v268-debug-set-head branch from 873614d to 1ff8bca Compare April 10, 2026 05:20
@gzliudan gzliudan requested a review from Copilot April 10, 2026 05:36
Copilot AI reviewed Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@gzliudan gzliudan force-pushed the disable-v268-debug-set-head branch from 1ff8bca to 93a63c0 Compare April 10, 2026 07:22
@gzliudan gzliudan requested a review from Copilot April 10, 2026 07:24
Copilot AI reviewed Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@gzliudan gzliudan force-pushed the disable-v268-debug-set-head branch from 93a63c0 to bda407f Compare April 10, 2026 08:59
@gzliudan
fix(console,internal/ethapi,node,rpc): restrict debug_setHead to loca…
1aa143d 
…l transports

Add a local-only RPC API classification and use it to keep debug_setHead
available over in-process RPC and IPC while hiding it from HTTP and WebSocket
transports.

This also updates the admin RPC startup path and adds regression coverage for
console visibility, transport exposure, and local-only API leakage.
@gzliudan gzliudan force-pushed the disable-v268-debug-set-head branch from bda407f to 1aa143d Compare April 10, 2026 09:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@liam-lai liam-lai Awaiting requested review from liam-lai

@AnilChinchawale AnilChinchawale Awaiting requested review from AnilChinchawale

@wanwiset25 wanwiset25 Awaiting requested review from wanwiset25

@benjamin202410 benjamin202410 Awaiting requested review from benjamin202410

@anunay-xin anunay-xin Awaiting requested review from anunay-xin

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@gzliudan