Skip to content

fix(anchor): cap search term length and restrict ILIKE to indexed columns - #194

Open
pengshenghai wants to merge 1 commit into
vespera-labs:mainfrom
pengshenghai:fix/anchor-search-bounds
Open

fix(anchor): cap search term length and restrict ILIKE to indexed columns#194
pengshenghai wants to merge 1 commit into
vespera-labs:mainfrom
pengshenghai:fix/anchor-search-bounds

Conversation

@pengshenghai

Copy link
Copy Markdown
Contributor

关联 Issue

Closes #37 — Anchor listTransactions ILIKE search bounds

改动摘要

  • QueryAnchorTransactionsDto:给 search 字段添加 @Length(1, 100) 校验
  • AnchorService.listTransactions:将 ILIKE 模糊搜索从 7 列缩减到仅索引列(anchorTransactionId、stellarTransactionId、walletAddress)
  • 更新 API 描述使其与搜索范围一致

验证方法

cd backend && pnpm test -- --testPathPattern=anchor.service
15/15 测试全部通过,包括新增的 restricted-column 测试

改动文件

  • backend/src/modules/stellar/dto/query-anchor-transactions.dto.ts
  • backend/src/modules/stellar/services/anchor.service.ts
  • backend/src/modules/stellar/tests/anchor.service.spec.ts

风险说明

  • 移除 id::text、currency、destination、memo 的 ILIKE 搜索可能改变现有搜索结果范围,但这些列本身没有索引,预期影响极小
  • @Length(1, 100) 会拒绝超长/空搜索词,与需求预期一致

执行边界

  • 仅修改 listTransactions 搜索逻辑
  • 未添加数据库迁移
  • 分页参数验证已在 DTO 中由 @max(100) 保证

安全边界

  • 不涉及敏感数据变更或权限改动
  • 仅提升查询性能,不引入新攻击面

钱包地址

RTC269fa5650798c3aa5086a128c025a546e0a41d0b

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Backend] Anchor listTransactions ILIKE search builds broad OR scans without input bounds

1 participant