Cosmos-sdk: Keys are declared as var and exposed
https://github.com/cosmos/cosmos-sdk/blob/develop/x/stake/keeper_keys.go#L15
Other code can modify this values to cause unexpected behavior
mossid
All 12 comments
cc @rigelrozanski
cwgoes
on 15 Jun 2018
Yeah need to be constants and modified to a different type
rigelrozanski
on 19 Jun 2018
Closes by #1119
ValarDragon
on 27 Jun 2018
My bad, I misread what this issue was for. Relevant keys have been moved to /x/stake/stake.go
ValarDragon
on 27 Jun 2018
Pretty sure this has been addressed. Going to close this issue. Please reopen and send any 馃敟 -> @jackzampolin
jackzampolin
on 13 Oct 2018
This is not addressed. https://github.com/cosmos/cosmos-sdk/blob/develop/x/stake/keeper/key.go#L15
ValarDragon
on 13 Oct 2018
Pretty sure this has been addressed. Going to go ahead and close. Please reopen if I'm wrong.
jackzampolin
on 28 May 2019
It has not been addressed, e.g. https://github.com/cosmos/cosmos-sdk/blob/master/x/staking/types/key.go#L13
cwgoes
on 28 May 2019
We should expose some of these for querying from the store.
jackzampolin
on 28 May 2019
(I'm not sure if this is a serious security concern, but the original state of affairs has not changed)
cwgoes
on 28 May 2019
Indeed, string constants should remain exported (eg. for use in queriers). Any keys used for persistent in stores should be constants and private if possible.
alexanderbez
on 28 May 2019
Closing this issue as addressed.
jackzampolin
on 6 Sep 2019
Related issues
hendrikhofstadt
路
3Comments
jackzampolin
路
3Comments
ValarDragon
路
3Comments
ValarDragon
路
3Comments
rigelrozanski
路
3Comments
Most helpful comment
We should expose some of these for querying from the store.