validate the address when APIService.GetAccount() is called.

rpc/api_service.go

@@ -17,6 +17,7 @@ package rpc
 
 import (
 	"encoding/hex"
+	"strings"
 
 	"github.com/medibloc/go-medibloc/consensus/dpos"
 
@@ -49,14 +50,18 @@ func newAPIService(bm *core.BlockManager, tm *core.TransactionManager, ee *core.
 	}
 }
 
+func isValidAccount(account string) bool {
+	return len(account) == 66 && (strings.HasPrefix(account, "02") || strings.HasPrefix(account, "03"))
+}
+
 // GetAccount handles GetAccount rpc.
 func (s *APIService) GetAccount(ctx context.Context, req *rpcpb.GetAccountRequest) (*rpcpb.Account,
 	error) {
 	var block *core.Block
 	var err error
 
 	// XOR
-	if !(math.XOR(len(req.Address) != 66, req.Alias == "") && math.XOR(req.Type == "", req.Height == 0)) {
+	if !(math.XOR(isValidAccount(req.Address), req.Alias != "") && math.XOR(req.Type != "", req.Height != 0)) {
 		return nil, status.Error(codes.InvalidArgument, ErrMsgInvalidRequest)
 	}
 

rpc/api_service_test.go

@@ -41,6 +41,18 @@ func TestAPIService_GetAccount(t *testing.T) {
 
 	e := httpexpect.New(t, testutil.IP2Local(seed.Config.Config.Rpc.HttpListen[0]))
 
+	e.GET("/v1/account").
+		WithQuery("type", "tail").
+		WithQuery("address", "0000").
+		Expect().
+		Status(http.StatusBadRequest)
+
+	e.GET("/v1/account").
+		WithQuery("type", "tail").
+		WithQuery("address", "000000000000000000000000000000000000000000000000000000000000000000").
+		Expect().
+		Status(http.StatusBadRequest)
+
 	e.GET("/v1/account").
 		WithQuery("type", "tail").
 		WithQuery("address", payer.Addr).