fix(dot/subscription): unsafe type casting from untrusted input

dot/rpc/subscription/websocket.go

@@ -26,8 +26,11 @@ type httpclient interface {
 	Do(*http.Request) (*http.Response, error)
 }
 
-var errCannotReadFromWebsocket = errors.New("cannot read message from websocket")
-var errCannotUnmarshalMessage = errors.New("cannot unmarshal webasocket message data")
+var (
+	errCannotReadFromWebsocket = errors.New("cannot read message from websocket")
+	errCannotUnmarshalMessage  = errors.New("cannot unmarshal webasocket message data")
+)
+
 var logger = log.NewFromGlobal(log.AddContext("pkg", "rpc/subscription"))
 
 // WSConn struct to hold WebSocket Connection references
@@ -159,25 +162,24 @@ func (c *WSConn) initStorageChangeListener(reqID float64, params interface{}) (L
 		wsconn: c,
 	}
 
-	pA, ok := params.([]interface{})
-	if !ok {
-		return nil, fmt.Errorf("unknown parameter type")
-	}
-	for _, param := range pA {
-		switch p := param.(type) {
-		case []interface{}:
-			for _, pp := range param.([]interface{}) {
-				data, ok := pp.(string)
-				if !ok {
-					return nil, fmt.Errorf("unknown parameter type")
-				}
-				stgobs.filter[data] = []byte{}
+	switch filter := params.(type) {
+	case []string:
+		for _, key := range filter {
+			stgobs.filter[key] = []byte{}
+		}
+	case []interface{}:
+		for _, interfaceKey := range params.([]interface{}) {
+			key, ok := interfaceKey.(string)
+			if !ok {
+				return nil, fmt.Errorf("expected type equals string. got %T", interfaceKey)
 			}
-		case string:
-			stgobs.filter[p] = []byte{}
-		default:
-			return nil, fmt.Errorf("unknown parameter type")
+
+			stgobs.filter[key] = []byte{}
 		}
+	case string:
+		stgobs.filter[filter] = []byte{}
+	default:
+		return nil, fmt.Errorf("expected type equals string or []string. got %T", params)
 	}
 
 	c.mu.Lock()
@@ -265,14 +267,30 @@ func (c *WSConn) initAllBlocksListerner(reqID float64, _ interface{}) (Listener,
 }
 
 func (c *WSConn) initExtrinsicWatch(reqID float64, params interface{}) (Listener, error) {
-	pA := params.([]interface{})
+	var encodedExtrinsic string
 
-	if len(pA) != 1 {
-		return nil, errors.New("expecting only one parameter")
+	switch encodedHex := params.(type) {
+	case []string:
+		if len(encodedHex) != 1 {
+			return nil, fmt.Errorf("expected only 1 param item. got %d", len(encodedHex))
+		}
+		encodedExtrinsic = encodedHex[0]
+	case []interface{}:
+		if len(encodedHex) != 1 {
+			return nil, fmt.Errorf("expected only 1 param item. got %d", len(encodedHex))
+		}
+
+		var ok bool
+		encodedExtrinsic, ok = encodedHex[0].(string)
+		if !ok {
+			return nil, fmt.Errorf("expected type equals string. got %T", encodedHex[0])
+		}
+	default:
+		return nil, fmt.Errorf("expected type equals []string. got %T", params)
 	}
 
 	// The passed parameter should be a HEX of a SCALE encoded extrinsic
-	extBytes, err := common.HexToBytes(pA[0].(string))
+	extBytes, err := common.HexToBytes(encodedExtrinsic)
 	if err != nil {
 		return nil, err
 	}

dot/rpc/subscription/websocket_test.go

@@ -45,7 +45,7 @@ func TestWSConn_HandleComm(t *testing.T) {
 	res, err = wsconn.initStorageChangeListener(1, nil)
 	require.Nil(t, res)
 	require.Len(t, wsconn.Subscriptions, 0)
-	require.EqualError(t, err, "unknown parameter type")
+	require.EqualError(t, err, "expected type equals string or []string. got <nil>")
 
 	res, err = wsconn.initStorageChangeListener(2, []interface{}{})
 	require.NotNil(t, res)
@@ -63,25 +63,24 @@ func TestWSConn_HandleComm(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, []byte(`{"jsonrpc":"2.0","result":2,"id":3}`+"\n"), msg)
 
-	var testFilters = []interface{}{}
-	var testFilter1 = []interface{}{"0x26aa", "0x26a1"}
-	res, err = wsconn.initStorageChangeListener(4, append(testFilters, testFilter1))
-	require.NotNil(t, res)
+	var testFilter1 = []string{"0x26aa", "0x26a1"}
+	res, err = wsconn.initStorageChangeListener(4, testFilter1)
 	require.NoError(t, err)
+	require.NotNil(t, res)
 	require.Len(t, wsconn.Subscriptions, 3)
 	_, msg, err = c.ReadMessage()
 	require.NoError(t, err)
 	require.Equal(t, []byte(`{"jsonrpc":"2.0","result":3,"id":4}`+"\n"), msg)
 
 	var testFilterWrongType = []interface{}{"0x26aa", 1}
-	res, err = wsconn.initStorageChangeListener(5, append(testFilters, testFilterWrongType))
-	require.EqualError(t, err, "unknown parameter type")
+	res, err = wsconn.initStorageChangeListener(5, testFilterWrongType)
+	require.EqualError(t, err, "expected type equals string. got int")
 	require.Nil(t, res)
 	// keep subscriptions len == 3, no additions was made
 	require.Len(t, wsconn.Subscriptions, 3)
 
 	res, err = wsconn.initStorageChangeListener(6, []interface{}{1})
-	require.EqualError(t, err, "unknown parameter type")
+	require.EqualError(t, err, "expected type equals string. got int")
 	require.Nil(t, res)
 	require.Len(t, wsconn.Subscriptions, 3)