Harden XCM v1 for Recursions (#3586)

* Guard against XCM recursive bombs by setting a recursion limit * Add test and set a lower recursion limit * Use u32 instead of usize for recursion limit * Make spellcheck happy * Cargo fmt * Limit XCM decoding depth in UMP message processing * Modify test to check for recursion in BuyExecution * Update xcm/xcm-simulator/example/src/lib.rs Co-authored-by: Kian Paimani <5588131+kianenigma@users.noreply.github.com> * Make cargo fmt happy * WIP for testing recursion limit in WASM * Revert "WIP for testing recursion limit in WASM" This reverts commit 39181b46d1adf79358f5ae8aafcf480e0c0c22e6. * Remove XCM recursion limit test * Add recursion test for XCM message execution * Set a more sensible recursion limit * Cargo fmt * Implement successful_origin for benchmarks * Set recursion limit to 8 and create integration tests directory for xcm-executor * Cargo fmt * Add runtime-benchmarks feature to test-runtime * Give up creating ConvertOriginToLocal and use EnsureXcm * Re-add ConvertOriginToLocal * Fix compilation * Update xcm/xcm-executor/src/lib.rs Co-authored-by: Gavin Wood <gavin@parity.io> * Add decoding limit to all versioned XCM decode calls * Fix recursion limit test * Set a lower recursion count for recursion test * move integration tests to their own folder, fix recursion check in execute_effects * Remove xcm-executor integration tests directory * fix up * Update Cargo.lock * Update runtime/parachains/src/ump.rs * use proper decode limit * fix decode depth limit * here too * Update traits.rs * fix compile * fix test * Revert `decode_all_with_depth_limit` changes in parachain.rs * Remove unused imports in parachain.rs Co-authored-by: Keith Yeung <kungfukeith11@gmail.com> Co-authored-by: Kian Paimani <5588131+kianenigma@users.noreply.github.com> Co-authored-by: Bastian Köcher <info@kchr.de> Co-authored-by: Gavin Wood <gavin@parity.io>
2026-07-20 23:15:42 +00:00 · 2021-08-07 21:29:12 +02:00
parent d1ef456a4d
commit 9ee8013d6d
14 changed files with 375 additions and 13 deletions
@@ -0,0 +1,141 @@
+// Copyright 2021 Parity Technologies (UK) Ltd.
+// This file is part of Polkadot.
+
+// Polkadot is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Polkadot is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Polkadot.  If not, see <http://www.gnu.org/licenses/>.
+
+#![cfg_attr(not(feature = "std"), no_std)]
+#![cfg(test)]
+
+use polkadot_test_client::{
+	BlockBuilderExt, ClientBlockImportExt, DefaultTestClientBuilderExt, ExecutionStrategy,
+	InitPolkadotBlockBuilder, TestClientBuilder, TestClientBuilderExt,
+};
+use polkadot_test_service::construct_extrinsic;
+use sp_runtime::{generic::BlockId, traits::Block};
+use sp_state_machine::InspectState;
+use xcm::latest::{Error as XcmError, Junction::*, MultiLocation::*, Order, Outcome, Xcm::*};
+use xcm_executor::MAX_RECURSION_LIMIT;
+
+// This is the inflection point where the test should either fail or pass.
+const MAX_RECURSION_CHECK: u32 = MAX_RECURSION_LIMIT / 2;
+
+#[test]
+fn execute_within_recursion_limit() {
+	sp_tracing::try_init_simple();
+	let mut client = TestClientBuilder::new()
+		.set_execution_strategy(ExecutionStrategy::AlwaysWasm)
+		.build();
+
+	let mut msg = WithdrawAsset { assets: (X1(Parent), 100).into(), effects: vec![] };
+	for _ in 0..MAX_RECURSION_CHECK {
+		msg = WithdrawAsset {
+			assets: (X1(Parent), 100).into(),
+			effects: vec![Order::BuyExecution {
+				fees: (X1(Parent), 1).into(),
+				weight: 0,
+				debt: 0,
+				halt_on_error: true,
+				orders: vec![],
+				// nest `msg` into itself on each iteration.
+				instructions: vec![msg],
+			}],
+		};
+	}
+
+	let mut block_builder = client.init_polkadot_block_builder();
+
+	let execute = construct_extrinsic(
+		&client,
+		polkadot_test_runtime::Call::Xcm(pallet_xcm::Call::execute(
+			Box::new(msg.clone()),
+			1_000_000_000,
+		)),
+		sp_keyring::Sr25519Keyring::Alice,
+	);
+
+	block_builder.push_polkadot_extrinsic(execute).expect("pushes extrinsic");
+
+	let block = block_builder.build().expect("Finalizes the block").block;
+	let block_hash = block.hash();
+
+	futures::executor::block_on(client.import(sp_consensus::BlockOrigin::Own, block))
+		.expect("imports the block");
+
+	client
+		.state_at(&BlockId::Hash(block_hash))
+		.expect("state should exist")
+		.inspect_state(|| {
+			assert!(polkadot_test_runtime::System::events().iter().any(|r| matches!(
+				r.event,
+				polkadot_test_runtime::Event::Xcm(pallet_xcm::Event::Attempted(Outcome::Complete(
+					_
+				)),),
+			)));
+		});
+}
+
+#[test]
+fn exceed_recursion_limit() {
+	sp_tracing::try_init_simple();
+	let mut client = TestClientBuilder::new()
+		.set_execution_strategy(ExecutionStrategy::AlwaysWasm)
+		.build();
+
+	let mut msg = WithdrawAsset { assets: (X1(Parent), 100).into(), effects: vec![] };
+	for _ in 0..(MAX_RECURSION_CHECK + 1) {
+		msg = WithdrawAsset {
+			assets: (X1(Parent), 100).into(),
+			effects: vec![Order::BuyExecution {
+				fees: (X1(Parent), 1).into(),
+				weight: 0,
+				debt: 0,
+				halt_on_error: true,
+				orders: vec![],
+				// nest `msg` into itself on each iteration.
+				instructions: vec![msg],
+			}],
+		};
+	}
+
+	let mut block_builder = client.init_polkadot_block_builder();
+
+	let execute = construct_extrinsic(
+		&client,
+		polkadot_test_runtime::Call::Xcm(pallet_xcm::Call::execute(
+			Box::new(msg.clone()),
+			1_000_000_000,
+		)),
+		sp_keyring::Sr25519Keyring::Alice,
+	);
+
+	block_builder.push_polkadot_extrinsic(execute).expect("pushes extrinsic");
+
+	let block = block_builder.build().expect("Finalizes the block").block;
+	let block_hash = block.hash();
+
+	futures::executor::block_on(client.import(sp_consensus::BlockOrigin::Own, block))
+		.expect("imports the block");
+
+	client
+		.state_at(&BlockId::Hash(block_hash))
+		.expect("state should exist")
+		.inspect_state(|| {
+			assert!(polkadot_test_runtime::System::events().iter().any(|r| matches!(
+				r.event,
+				polkadot_test_runtime::Event::Xcm(pallet_xcm::Event::Attempted(
+					Outcome::Incomplete(_, XcmError::RecursionLimitReached),
+				)),
+			)));
+		});
+}