zold 0.26.19 → 0.29.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6fa341a547ba1c83699a076f78886ea6cd3f28c2dca5b46675e214f4ee155fc3
-  data.tar.gz: 4570c47941b0522ceebb915620c016c7aa239984d1510f2219631a35d76a655b
+  metadata.gz: 3a384987626036b4943acf7207bc6043b587d5de3c69468d1c17eb2f337cbae0
+  data.tar.gz: ad950bb71ec0e09858a0d10c6ba5baecc390648336cd766f12b79ae33388429c
 SHA512:
-  metadata.gz: d818d6a9e3bbcc5ad446de965d70ffe72ecd9f78d9c04e49fe0d547a2be9c148cff3e5c9381ba37888bc6562e43e95b7c928b997622ace8a1dbaad9876438715
-  data.tar.gz: 792d5b93d848ee5d8685a9f4242c99b5753abb21c5071684a98069ca5570adf61470ef9117fdb3a37f7df335b9d2ee9222821430043ac2490cd1733bbe262b56
+  metadata.gz: ca5b3e919cb7442d6944fe6d0b74f212cf8ac52a7762d8f1017fd812c5f535483cd5ca24fee592fa0a1d5b955bb801929b8da7698d7c2704487dec4d9ad99f85
+  data.tar.gz: d7b498c210aef31fe97b9216def70a89b7a0f39c5bc425ab2134f912fb8b56f3e3011446b1538cb89e85509a32ea85780616a4a2b88ebc5e1bb2dd71c86ce32b

data/lib/zold/commands/invoice.rb

@@ -21,6 +21,7 @@
 # SOFTWARE.
 
 require 'slop'
+require 'shellwords'
 require_relative 'thread_badge'
 require_relative 'args'
 require_relative '../log'
@@ -73,7 +74,8 @@ Available options:"
       unless @wallets.acq(id, &:exists?)
         require_relative 'pull'
         Pull.new(wallets: @wallets, remotes: @remotes, copies: @copies, log: @log).run(
-          ['pull', id.to_s, "--network=#{opts['network']}", "--tolerate-quorum=#{opts['tolerate-quorum']}"] +
+          ['pull', id.to_s, "--network=#{Shellwords.escape(opts['network'])}"] +
+          ["--tolerate-quorum=#{Shellwords.escape(opts['tolerate-quorum'])}"] +
           (opts['tolerate-edges'] ? ['--tolerate-edges'] : [])
         )
       end

data/lib/zold/commands/merge.rb

@@ -23,6 +23,7 @@
 require 'slop'
 require 'rainbow'
 require 'backtrace'
+require 'shellwords'
 require_relative 'thread_badge'
 require_relative 'args'
 require_relative 'pull'
@@ -74,9 +75,12 @@ Available options:"
         o.string '--ledger',
           'The name of the file where all new negative transactions will be recorded (default: /dev/null)',
           default: '/dev/null'
-        o.array '--trusted',
-          'List of wallet IDs we fully trust and won\'t pull',
-          default: []
+        o.string '--trusted',
+          'The name of the file with a list of wallet IDs we fully trust and won\'t pull',
+          default: '/dev/null'
+        o.integer '--trusted-max',
+          'The maximum amount of trusted wallets we can see in the list',
+          default: 32
         o.string '--network',
           'The name of the network we work in',
           default: 'test'
@@ -154,11 +158,13 @@ into #{@wallets.acq(id, &:mnemo)} in #{Age.new(start, limit: 0.1 + cps.count * 0
         end
       else
         patch.join(wallet, ledger: opts['ledger']) do |txn|
-          unless opts['trusted'].include?(txn.bnf.to_s) || opts['trusted'].count > 32
+          trusted = IO.read(opts['trusted']).split(',')
+          IO.write(opts['trusted'], (trusted + [txn.bnf.to_s]).join(','))
+          unless trusted.include?(txn.bnf.to_s) || trusted.count > opts['trusted-max']
             Pull.new(wallets: @wallets, remotes: @remotes, copies: @copies, log: @log).run(
-              ['pull', txn.bnf.to_s, "--network=#{opts['network']}", '--quiet-if-absent'] +
+              ['pull', txn.bnf.to_s, "--network=#{Shellwords.escape(opts['network'])}", '--quiet-if-absent'] +
               (opts['deep'] ? ['--deep'] : ['--shallow']) +
-              ['--trusted=' + (opts['trusted'] + [txn.bnf.to_s]).join(',')]
+              ["--trusted=#{Shellwords.escape(opts['trusted'])}"]
             )
           end
           true

data/lib/zold/commands/node.rb

@@ -22,6 +22,7 @@
 
 require 'open3'
 require 'slop'
+require 'shellwords'
 require 'backtrace'
 require 'fileutils'
 require 'zache'
@@ -337,7 +338,8 @@ the node won\'t connect to the network like that; try to do "zold remote reset"
       unless invoice.include?('@')
         require_relative 'invoice'
         invoice = Invoice.new(wallets: @wallets, remotes: @remotes, copies: @copies, log: @log).run(
-          ['invoice', invoice, "--network=#{opts['network']}", "--tolerate-quorum=#{opts['tolerate-quorum']}"] +
+          ['invoice', invoice, "--network=#{Shellwords.escape(opts['network'])}"] +
+          ["--tolerate-quorum=#{Shellwords.escape(opts['tolerate-quorum'])}"] +
           (opts['tolerate-edges'] ? ['--tolerate-edges'] : [])
         )
       end

data/lib/zold/commands/pay.rb

@@ -22,6 +22,7 @@
 
 require 'slop'
 require 'rainbow'
+require 'shellwords'
 require_relative 'thread_badge'
 require_relative 'args'
 require_relative '../id'
@@ -91,7 +92,8 @@ Available options:"
       unless invoice.include?('@')
         require_relative 'invoice'
         invoice = Invoice.new(wallets: @wallets, remotes: @remotes, copies: @copies, log: @log).run(
-          ['invoice', invoice, "--tolerate-quorum=#{opts['tolerate-quorum']}", "--network=#{opts['network']}"] +
+          ['invoice', invoice, "--tolerate-quorum=#{Shellwords.escape(opts['tolerate-quorum'])}"] +
+          ["--network=#{Shellwords.escape(opts['network'])}"] +
           (opts['tolerate-edges'] ? ['--tolerate-edges'] : [])
         )
       end
@@ -123,7 +125,8 @@ Available options:"
       return unless debt
       require_relative 'taxes'
       Taxes.new(wallets: @wallets, remotes: @remotes, log: @log).run(
-        ['taxes', 'pay', "--private-key=#{opts['private-key']}", id.to_s, "--keygap=#{opts['keygap']}"]
+        ['taxes', 'pay', "--private-key=#{Shellwords.escape(opts['private-key'])}"] +
+        [id.to_s, "--keygap=#{Shellwords.escape(opts['keygap'])}"]
       )
     end
 
@@ -138,6 +141,7 @@ the difference is #{(amount - from.balance).to_i} zents"
       end
       pem = IO.read(opts['private-key'])
       unless opts['keygap'].empty?
+        puts opts['keygap']
         pem = pem.sub('*' * opts['keygap'].length, opts['keygap'])
         @log.debug("Keygap \"#{'*' * opts['keygap'].length}\" injected into the RSA private key")
       end

data/lib/zold/commands/routines/reconnect.rb

@@ -20,6 +20,7 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
 
+require 'shellwords'
 require_relative '../remote'
 require_relative '../../node/farm'
 
@@ -42,9 +43,9 @@ module Zold
       def exec(step = 0)
         sleep(60) unless @opts['routine-immediately']
         cmd = Remote.new(remotes: @remotes, log: @log, farm: @farm)
-        args = ['remote', "--network=#{@opts['network']}", '--ignore-ping']
+        args = ['remote', "--network=#{Shellwords.escape(@opts['network'])}", '--ignore-ping']
         score = @farm.best[0]
-        args << "--ignore-node=#{score.host}:#{score.port}" if score
+        args << "--ignore-node=#{Shellwords.escape("#{score.host}:#{score.port}")}" if score
         cmd.run(args + ['masters']) unless @opts['routine-immediately']
         all = @remotes.all
         return if @opts['routine-immediately'] && all.empty?

data/lib/zold/commands/routines/spread.rb

@@ -20,6 +20,7 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
 
+require 'shellwords'
 require_relative '../../log'
 require_relative '../../id'
 require_relative '../../copies'
@@ -47,7 +48,7 @@ module Zold
         @wallets.all.sample(100).each do |id|
           next if Copies.new(File.join(@copies, id)).all.count < 2
           Push.new(wallets: @wallets, remotes: @remotes, log: @log).run(
-            ['push', "--network=#{@opts['network']}", id.to_s]
+            ['push', "--network=#{Shellwords.escape(@opts['network'])}", id.to_s]
           )
         end
       end

data/lib/zold/hungry_wallets.rb

@@ -22,6 +22,7 @@
 
 require 'delegate'
 require 'zache'
+require 'shellwords'
 require_relative 'log'
 require_relative 'thread_pool'
 require_relative 'commands/pull'
@@ -88,7 +89,7 @@ module Zold
       end
       begin
         Pull.new(wallets: @wallets, remotes: @remotes, copies: @copies, log: @log).run(
-          ['pull', id.to_s, "--network=#{@network}", '--tolerate-edges', '--tolerate-quorum=1']
+          ['pull', id.to_s, "--network=#{Shellwords.escape(@network)}", '--tolerate-edges', '--tolerate-quorum=1']
         )
         @missed.remove(id.to_s)
       rescue Fetch::Error => e

data/lib/zold/node/farmers.rb

@@ -92,9 +92,9 @@ for #{after.host}:#{after.port} in #{Age.new(start)}: #{after.suffixes}")
           'ruby',
           Shellwords.escape(bin),
           '--skip-upgrades',
-          "--info-tid=#{Thread.current.thread_variable_get(:tid)}",
+          "--info-tid=#{Shellwords.escape(Thread.current.thread_variable_get(:tid))}",
           "--info-thread=#{Shellwords.escape(Thread.current.name)}",
-          "--info-start=#{Time.now.utc.iso8601}",
+          "--info-start=#{Shellwords.escape(Time.now.utc.iso8601)}",
           '--low-priority',
           'next',
           Shellwords.escape(score)

data/lib/zold/node/front.rb

@@ -25,6 +25,7 @@ STDOUT.sync = true
 require 'get_process_mem'
 require 'thin'
 require 'haml'
+require 'shellwords'
 require 'json'
 require 'sinatra/base'
 require 'concurrent'
@@ -590,7 +591,7 @@ time to stop; use --skip-oom to never quit")
         Remote.new(remotes: settings.remotes, log: settings.log).run(
           [
             'remote', 'add', score.host, score.port.to_s,
-            "--network=#{settings.opts['network']}", '--ignore-if-exists'
+            "--network=#{Shellwords.escape(settings.opts['network'])}", '--ignore-if-exists'
           ] + (settings.opts['ignore-score-weakness'] ? ['--skip-ping'] : [])
         )
       rescue StandardError => e

data/lib/zold/node/pipeline.rb

@@ -21,6 +21,7 @@
 # SOFTWARE.
 
 require 'tempfile'
+require 'shellwords'
 require_relative '../log'
 require_relative '../remotes'
 require_relative '../copies'
@@ -85,9 +86,13 @@ module Zold
 
     def merge(id, copies, wallets, log)
       Tempfile.open do |f|
-        modified = Merge.new(
-          wallets: wallets, remotes: @remotes, copies: copies.root, log: log
-        ).run(['merge', id.to_s, "--ledger=#{f.path}", "--network=#{@network}", '--deep'])
+        modified = Tempfile.open do |t|
+          Merge.new(wallets: wallets, remotes: @remotes, copies: copies.root, log: log).run(
+            ['merge', id.to_s, "--ledger=#{Shellwords.escape(f.path)}"] +
+            ["--trusted=#{Shellwords.escape(t.path)}", '--deep'] +
+            ["--network=#{Shellwords.escape(@network)}"]
+          )
+        end
         @mutex.synchronize do
           txns = File.exist?(@ledger) ? IO.read(@ledger).strip.split("\n") : []
           txns += IO.read(f.path).strip.split("\n")

data/lib/zold/node/spread_entrance.rb

@@ -22,6 +22,7 @@
 
 require 'concurrent'
 require 'tempfile'
+require 'shellwords'
 require_relative '../log'
 require_relative '../remotes'
 require_relative '../copies'
@@ -75,7 +76,7 @@ module Zold
             else
               Thread.current.thread_variable_set(:wallet, id.to_s)
               Push.new(wallets: @wallets, remotes: @remotes, log: @log).run(
-                ['push', "--ignore-node=#{@address}", id.to_s, '--tolerate-quorum=1'] +
+                ['push', "--ignore-node=#{Shellwords.escape(@address)}", id.to_s, '--tolerate-quorum=1'] +
                 (@ignore_score_weakeness ? ['--ignore-score-weakness'] : []) +
                 (@tolerate_edges ? ['--tolerate-edges'] : [])
               )

data/lib/zold/version.rb

@@ -25,7 +25,7 @@
 # Copyright:: Copyright (c) 2018 Yegor Bugayenko
 # License:: MIT
 module Zold
-  VERSION = '0.26.19'
+  VERSION = '0.29.20'
   PROTOCOL = 2
   REPO = 'zold-io/zold'
 end

data/test/commands/test_pay.rb

@@ -23,6 +23,7 @@
 require 'minitest/autorun'
 require 'webmock/minitest'
 require 'threads'
+require 'shellwords'
 require_relative '../test__helper'
 require_relative '../fake_home'
 require_relative '../../lib/zold/wallets'
@@ -92,7 +93,8 @@ class TestPay < Zold::Test
         IO.write(f, pem.gsub(keygap, '*' * keygap.length))
         Zold::Pay.new(wallets: home.wallets, copies: home.dir, remotes: home.remotes, log: test_log).run(
           [
-            'pay', '--force', "--private-key=#{f.path}", "--keygap=#{keygap}",
+            'pay', '--force', "--private-key=#{Shellwords.escape(f.path)}",
+            "--keygap=#{Shellwords.escape(keygap)}",
             wallet.id.to_s, 'NOPREFIX@dddd0000dddd0000', amount.to_zld, '-'
           ]
         )

data/views/layout.haml

@@ -23,28 +23,30 @@
     %section
       %header
         %nav
-          %li
-            %a{href: '/'}
-              %img.logo{src: '//www.zold.io/images/logo.svg', alt: 'Zold logo'}
+          %ul
+            %li
+              %a{href: '/'}
+                %img.logo{src: '//www.zold.io/images/logo.svg', alt: 'Zold logo'}
         %nav
-          %li
-            %a{href: '/'} Home
-          %li
-            %a{href: '/queue'} Queue
-          %li
-            %a{href: '/remotes'} Remotes
-          %li
-            %a{href: '/threads'} Threads
-          %li
-            %a{href: '/wallets'} Wallets
-          %li
-            %a{href: '/ledger'} Ledger
-          %li
-            %a{href: '/journal'} Journal
-          %li
-            %a{href: '/farm'} Farm
-          %li
-            %a{href: '/metronome'} Metronome
+          %ul
+            %li
+              %a{href: '/'} Home
+            %li
+              %a{href: '/queue'} Queue
+            %li
+              %a{href: '/remotes'} Remotes
+            %li
+              %a{href: '/threads'} Threads
+            %li
+              %a{href: '/wallets'} Wallets
+            %li
+              %a{href: '/ledger'} Ledger
+            %li
+              %a{href: '/journal'} Journal
+            %li
+              %a{href: '/farm'} Farm
+            %li
+              %a{href: '/metronome'} Metronome
       = yield
       %footer
         %p.footnotes

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: zold
 version: !ruby/object:Gem::Version
-  version: 0.26.19
+  version: 0.29.20
 platform: ruby
 authors:
 - Yegor Bugayenko
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-03-18 00:00:00.000000000 Z
+date: 2019-03-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: backtrace
@@ -798,7 +798,7 @@ licenses:
 - MIT
 metadata: {}
 post_install_message: |-
-  Thanks for installing Zold 0.26.19!
+  Thanks for installing Zold 0.29.20!
     Study our White Paper: https://papers.zold.io/wp.pdf
     Read our blog posts: https://blog.zold.io
     Try ZLD online wallet at: https://wts.zold.io