fix[thin_wallet]: handle address history invalid tx version

hathor/wallet/resources/thin_wallet/address_history.py

@@ -71,7 +71,24 @@ def render_POST(self, request: Request) -> bytes:
         addresses = post_data['addresses']
         assert isinstance(addresses, list)
 
-        return self.get_address_history(addresses, post_data.get('hash'), post_data.get('tx_version'))
+        # Validate and parse tx_version parameter if provided
+        allowed_tx_versions = None
+        if 'tx_version' in post_data:
+            tx_version_raw = post_data['tx_version']
+            # Handle both list/set and single values
+            if not isinstance(tx_version_raw, (list, set)):
+                tx_version_raw = [tx_version_raw]
+
+            try:
+                allowed_tx_versions = set(int(v) for v in tx_version_raw)
+            except (ValueError, TypeError) as e:
+                request.setResponseCode(400)
+                return json_dumpb({
+                    'success': False,
+                    'message': f'Invalid tx_version parameter: must be integer(s), got {e}'
+                })
+
+        return self.get_address_history(addresses, post_data.get('hash'), allowed_tx_versions)
 
     def render_GET(self, request: Request) -> bytes:
         """ GET request for /thin_wallet/address_history/
@@ -136,11 +153,16 @@ def render_GET(self, request: Request) -> bytes:
             ref_hash = raw_args[b'hash'][0].decode('utf-8')
 
         allowed_tx_versions_arg = raw_args.get(b'tx_version[]', None)
-        allowed_tx_versions = (
-            set([int(tx_version.decode('utf-8')) for tx_version in allowed_tx_versions_arg])
-            if allowed_tx_versions_arg is not None
-            else None
-        )
+        allowed_tx_versions = None
+        if allowed_tx_versions_arg is not None:
+            try:
+                allowed_tx_versions = set([int(tx_version.decode('utf-8')) for tx_version in allowed_tx_versions_arg])
+            except ValueError as e:
+                request.setResponseCode(400)
+                return json_dumpb({
+                    'success': False,
+                    'message': f'Invalid tx_version parameter: {e}'
+                })
         return self.get_address_history(
             [address.decode('utf-8') for address in addresses],
             ref_hash,
@@ -385,6 +407,14 @@ def get_address_history(self,
                                         'message': 'The address xx is invalid',
                                     }
                                 },
+                                'error_invalid_tx_version': {
+                                    'summary': 'Invalid tx_version parameter',
+                                    'value': {
+                                        'success': False,
+                                        'message': "Invalid tx_version parameter: invalid literal for int() "
+                                                   "with base 10: 'INVALID'",
+                                    }
+                                },
                             }
                         }
                     }

hathor_tests/resources/wallet/test_thin_wallet.py

@@ -575,6 +575,19 @@ def test_address_history_invalid_params(self):
         response_data = response_history.json_value()
         self.assertFalse(response_data['success'])
 
+        # invalid tx_version parameter
+        address = self.get_address(0)
+        response_history = yield self.web_address_history.get(
+            'thin_wallet/address_history', {
+                b'addresses[]': address.encode('utf-8'),
+                b'tx_version[]': b'INVALID'
+            }
+        )
+        response_data = response_history.json_value()
+        self.assertEqual(response_history.responseCode, 400)
+        self.assertFalse(response_data['success'])
+        self.assertIn('Invalid tx_version parameter', response_data['message'])
+
     @inlineCallbacks
     def test_address_history_invalid_params_post(self):
         # missing param
@@ -591,6 +604,31 @@ def test_address_history_invalid_params_post(self):
         response_data = response_history.json_value()
         self.assertFalse(response_data['success'])
 
+        # invalid tx_version parameter - non-integer
+        address = self.get_address(0)
+        response_history = yield self.web_address_history.post(
+            'thin_wallet/address_history', {
+                'addresses': [address],
+                'tx_version': ['INVALID']
+            }
+        )
+        response_data = response_history.json_value()
+        self.assertEqual(response_history.responseCode, 400)
+        self.assertFalse(response_data['success'])
+        self.assertIn('Invalid tx_version parameter', response_data['message'])
+
+        # invalid tx_version parameter - string instead of list
+        response_history = yield self.web_address_history.post(
+            'thin_wallet/address_history', {
+                'addresses': [address],
+                'tx_version': 'NOT_A_NUMBER'
+            }
+        )
+        response_data = response_history.json_value()
+        self.assertEqual(response_history.responseCode, 400)
+        self.assertFalse(response_data['success'])
+        self.assertIn('Invalid tx_version parameter', response_data['message'])
+
     @inlineCallbacks
     def test_send_tokens_invalid_params(self):
         # missing body