{"action":"created","comment":{"url":"https://api.github.com/repos/ripple/rippled/pulls/comments/23738057","id":23738057,"diff_hunk":"@@ -307,13 +308,48 @@ isMemoOkay (STObject const& st, std::string& reason)\n \n         for (auto const& memoElement : *memoObj)\n         {\n-            if ((memoElement.getFName() != sfMemoType) &&\n-                (memoElement.getFName() != sfMemoData) &&\n-                (memoElement.getFName() != sfMemoFormat))\n+            auto const& name = memoElement.getFName();\n+\n+            if (name != sfMemoType &&\n+                name != sfMemoData &&\n+                name != sfMemoFormat)\n+            {\n+                reason = \"A memo may contain only MemoType, MemoData or \"\n+                         \"MemoFormat fields.\";\n+                return false;\n+            }\n+\n+            // The raw data is stored as hex-octets, which we want to decode.\n+            auto data = strUnHex (memoElement.getText ());\n+\n+            if (!data.second)\n             {\n-                reason = \"A memo may contain only MemoType, MemoData or MemoFormat fields.\";\n+                reason = \"The MemoType, MemoData and MemoFormat fields may \"\n+                         \"only contain hex-encoded data.\";\n                 return false;\n             }\n+\n+            if (name == sfMemoData)\n+                continue;\n+\n+            // The only allowed characters for MemoType and MemoFormat are the\n+            // characters allowed in URLs per RFC 3986: alphanumerics and the\n+            // following symbols:\n+            static std::string const allowed_symbols (\"-._~:/?#[]@!$&'()*+,;=%\");\n+\n+            for (auto c : data.first)\n+            {\n+                if (isalnum (c))","path":"src/ripple/protocol/impl/STTx.cpp","position":47,"original_position":47,"commit_id":"9848f12dbd3e45bc017f87946ad56fc97c75d15b","original_commit_id":"9848f12dbd3e45bc017f87946ad56fc97c75d15b","user":{"login":"vinniefalco","id":1503976,"avatar_url":"https://avatars.githubusercontent.com/u/1503976?v=3","gravatar_id":"","url":"https://api.github.com/users/vinniefalco","html_url":"https://github.com/vinniefalco","followers_url":"https://api.github.com/users/vinniefalco/followers","following_url":"https://api.github.com/users/vinniefalco/following{/other_user}","gists_url":"https://api.github.com/users/vinniefalco/gists{/gist_id}","starred_url":"https://api.github.com/users/vinniefalco/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vinniefalco/subscriptions","organizations_url":"https://api.github.com/users/vinniefalco/orgs","repos_url":"https://api.github.com/users/vinniefalco/repos","events_url":"https://api.github.com/users/vinniefalco/events{/privacy}","received_events_url":"https://api.github.com/users/vinniefalco/received_events","type":"User","site_admin":false},"body":"That may be true but what if you're writing library code (e.g. beast)? You want to provide a narrow contract.","created_at":"2015-01-29T00:35:38Z","updated_at":"2015-01-29T00:35:38Z","html_url":"https://github.com/ripple/rippled/pull/817#discussion_r23738057","pull_request_url":"https://api.github.com/repos/ripple/rippled/pulls/817","_links":{"self":{"href":"https://api.github.com/repos/ripple/rippled/pulls/comments/23738057"},"html":{"href":"https://github.com/ripple/rippled/pull/817#discussion_r23738057"},"pull_request":{"href":"https://api.github.com/repos/ripple/rippled/pulls/817"}}},"pull_request":{"url":"https://api.github.com/repos/ripple/rippled/pulls/817","id":27761061,"html_url":"https://github.com/ripple/rippled/pull/817","diff_url":"https://github.com/ripple/rippled/pull/817.diff","patch_url":"https://github.com/ripple/rippled/pull/817.patch","issue_url":"https://api.github.com/repos/ripple/rippled/issues/817","number":817,"state":"open","locked":false,"title":"Constrain valid inputs for MemoFormat and MemoType fields (RIPD-712)","user":{"login":"nbougalis","id":5085415,"avatar_url":"https://avatars.githubusercontent.com/u/5085415?v=3","gravatar_id":"","url":"https://api.github.com/users/nbougalis","html_url":"https://github.com/nbougalis","followers_url":"https://api.github.com/users/nbougalis/followers","following_url":"https://api.github.com/users/nbougalis/following{/other_user}","gists_url":"https://api.github.com/users/nbougalis/gists{/gist_id}","starred_url":"https://api.github.com/users/nbougalis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nbougalis/subscriptions","organizations_url":"https://api.github.com/users/nbougalis/orgs","repos_url":"https://api.github.com/users/nbougalis/repos","events_url":"https://api.github.com/users/nbougalis/events{/privacy}","received_events_url":"https://api.github.com/users/nbougalis/received_events","type":"User","site_admin":false},"body":"Currently, all possible ASCII characters are allowed inside the `MemoType`, `MemoData` and `MemoFormat` fields. This patch will reject any memos that contain ASCII control characters (`0x00,...,0x1F`, and `0x7F`) and will additionally prevent `MemoType` and `MemoFormat` from containing the space character.\r\n\r\n@justmoon is this fine, or would you prefer to more robustly validate the contents of the `MemoType` field against the MIME RFCs? If so, please update https://ripplelabs.atlassian.net/browse/RIPD-712 accordingly.\r\n\r\nReviews: @josh-ripple, @seelabs ","created_at":"2015-01-21T14:00:46Z","updated_at":"2015-01-29T00:35:38Z","closed_at":null,"merged_at":null,"merge_commit_sha":"83c0436282b35a9b3d52c8da653d2b3f0d3f7d06","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/ripple/rippled/pulls/817/commits","review_comments_url":"https://api.github.com/repos/ripple/rippled/pulls/817/comments","review_comment_url":"https://api.github.com/repos/ripple/rippled/pulls/comments/{number}","comments_url":"https://api.github.com/repos/ripple/rippled/issues/817/comments","statuses_url":"https://api.github.com/repos/ripple/rippled/statuses/9848f12dbd3e45bc017f87946ad56fc97c75d15b","head":{"label":"nbougalis:ripd712","ref":"ripd712","sha":"9848f12dbd3e45bc017f87946ad56fc97c75d15b","user":{"login":"nbougalis","id":5085415,"avatar_url":"https://avatars.githubusercontent.com/u/5085415?v=3","gravatar_id":"","url":"https://api.github.com/users/nbougalis","html_url":"https://github.com/nbougalis","followers_url":"https://api.github.com/users/nbougalis/followers","following_url":"https://api.github.com/users/nbougalis/following{/other_user}","gists_url":"https://api.github.com/users/nbougalis/gists{/gist_id}","starred_url":"https://api.github.com/users/nbougalis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nbougalis/subscriptions","organizations_url":"https://api.github.com/users/nbougalis/orgs","repos_url":"https://api.github.com/users/nbougalis/repos","events_url":"https://api.github.com/users/nbougalis/events{/privacy}","received_events_url":"https://api.github.com/users/nbougalis/received_events","type":"User","site_admin":false},"repo":{"id":12092814,"name":"rippled","full_name":"nbougalis/rippled","owner":{"login":"nbougalis","id":5085415,"avatar_url":"https://avatars.githubusercontent.com/u/5085415?v=3","gravatar_id":"","url":"https://api.github.com/users/nbougalis","html_url":"https://github.com/nbougalis","followers_url":"https://api.github.com/users/nbougalis/followers","following_url":"https://api.github.com/users/nbougalis/following{/other_user}","gists_url":"https://api.github.com/users/nbougalis/gists{/gist_id}","starred_url":"https://api.github.com/users/nbougalis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nbougalis/subscriptions","organizations_url":"https://api.github.com/users/nbougalis/orgs","repos_url":"https://api.github.com/users/nbougalis/repos","events_url":"https://api.github.com/users/nbougalis/events{/privacy}","received_events_url":"https://api.github.com/users/nbougalis/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/nbougalis/rippled","description":"Ripple peer-to-peer network daemon","fork":true,"url":"https://api.github.com/repos/nbougalis/rippled","forks_url":"https://api.github.com/repos/nbougalis/rippled/forks","keys_url":"https://api.github.com/repos/nbougalis/rippled/keys{/key_id}","collaborators_url":"https://api.github.com/repos/nbougalis/rippled/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/nbougalis/rippled/teams","hooks_url":"https://api.github.com/repos/nbougalis/rippled/hooks","issue_events_url":"https://api.github.com/repos/nbougalis/rippled/issues/events{/number}","events_url":"https://api.github.com/repos/nbougalis/rippled/events","assignees_url":"https://api.github.com/repos/nbougalis/rippled/assignees{/user}","branches_url":"https://api.github.com/repos/nbougalis/rippled/branches{/branch}","tags_url":"https://api.github.com/repos/nbougalis/rippled/tags","blobs_url":"https://api.github.com/repos/nbougalis/rippled/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/nbougalis/rippled/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/nbougalis/rippled/git/refs{/sha}","trees_url":"https://api.github.com/repos/nbougalis/rippled/git/trees{/sha}","statuses_url":"https://api.github.com/repos/nbougalis/rippled/statuses/{sha}","languages_url":"https://api.github.com/repos/nbougalis/rippled/languages","stargazers_url":"https://api.github.com/repos/nbougalis/rippled/stargazers","contributors_url":"https://api.github.com/repos/nbougalis/rippled/contributors","subscribers_url":"https://api.github.com/repos/nbougalis/rippled/subscribers","subscription_url":"https://api.github.com/repos/nbougalis/rippled/subscription","commits_url":"https://api.github.com/repos/nbougalis/rippled/commits{/sha}","git_commits_url":"https://api.github.com/repos/nbougalis/rippled/git/commits{/sha}","comments_url":"https://api.github.com/repos/nbougalis/rippled/comments{/number}","issue_comment_url":"https://api.github.com/repos/nbougalis/rippled/issues/comments/{number}","contents_url":"https://api.github.com/repos/nbougalis/rippled/contents/{+path}","compare_url":"https://api.github.com/repos/nbougalis/rippled/compare/{base}...{head}","merges_url":"https://api.github.com/repos/nbougalis/rippled/merges","archive_url":"https://api.github.com/repos/nbougalis/rippled/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/nbougalis/rippled/downloads","issues_url":"https://api.github.com/repos/nbougalis/rippled/issues{/number}","pulls_url":"https://api.github.com/repos/nbougalis/rippled/pulls{/number}","milestones_url":"https://api.github.com/repos/nbougalis/rippled/milestones{/number}","notifications_url":"https://api.github.com/repos/nbougalis/rippled/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/nbougalis/rippled/labels{/name}","releases_url":"https://api.github.com/repos/nbougalis/rippled/releases{/id}","created_at":"2013-08-13T20:58:04Z","updated_at":"2015-01-24T06:19:32Z","pushed_at":"2015-01-29T00:34:54Z","git_url":"git://github.com/nbougalis/rippled.git","ssh_url":"git@github.com:nbougalis/rippled.git","clone_url":"https://github.com/nbougalis/rippled.git","svn_url":"https://github.com/nbougalis/rippled","homepage":"https://ripple.com","size":51362,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"develop-next"}},"base":{"label":"ripple:develop","ref":"develop","sha":"b5c7232d6f2b84a446c7df3ee321ed621d152777","user":{"login":"ripple","id":3165523,"avatar_url":"https://avatars.githubusercontent.com/u/3165523?v=3","gravatar_id":"","url":"https://api.github.com/users/ripple","html_url":"https://github.com/ripple","followers_url":"https://api.github.com/users/ripple/followers","following_url":"https://api.github.com/users/ripple/following{/other_user}","gists_url":"https://api.github.com/users/ripple/gists{/gist_id}","starred_url":"https://api.github.com/users/ripple/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ripple/subscriptions","organizations_url":"https://api.github.com/users/ripple/orgs","repos_url":"https://api.github.com/users/ripple/repos","events_url":"https://api.github.com/users/ripple/events{/privacy}","received_events_url":"https://api.github.com/users/ripple/received_events","type":"Organization","site_admin":false},"repo":{"id":2724167,"name":"rippled","full_name":"ripple/rippled","owner":{"login":"ripple","id":3165523,"avatar_url":"https://avatars.githubusercontent.com/u/3165523?v=3","gravatar_id":"","url":"https://api.github.com/users/ripple","html_url":"https://github.com/ripple","followers_url":"https://api.github.com/users/ripple/followers","following_url":"https://api.github.com/users/ripple/following{/other_user}","gists_url":"https://api.github.com/users/ripple/gists{/gist_id}","starred_url":"https://api.github.com/users/ripple/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ripple/subscriptions","organizations_url":"https://api.github.com/users/ripple/orgs","repos_url":"https://api.github.com/users/ripple/repos","events_url":"https://api.github.com/users/ripple/events{/privacy}","received_events_url":"https://api.github.com/users/ripple/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/ripple/rippled","description":"Ripple peer-to-peer network daemon","fork":false,"url":"https://api.github.com/repos/ripple/rippled","forks_url":"https://api.github.com/repos/ripple/rippled/forks","keys_url":"https://api.github.com/repos/ripple/rippled/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ripple/rippled/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ripple/rippled/teams","hooks_url":"https://api.github.com/repos/ripple/rippled/hooks","issue_events_url":"https://api.github.com/repos/ripple/rippled/issues/events{/number}","events_url":"https://api.github.com/repos/ripple/rippled/events","assignees_url":"https://api.github.com/repos/ripple/rippled/assignees{/user}","branches_url":"https://api.github.com/repos/ripple/rippled/branches{/branch}","tags_url":"https://api.github.com/repos/ripple/rippled/tags","blobs_url":"https://api.github.com/repos/ripple/rippled/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ripple/rippled/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ripple/rippled/git/refs{/sha}","trees_url":"https://api.github.com/repos/ripple/rippled/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ripple/rippled/statuses/{sha}","languages_url":"https://api.github.com/repos/ripple/rippled/languages","stargazers_url":"https://api.github.com/repos/ripple/rippled/stargazers","contributors_url":"https://api.github.com/repos/ripple/rippled/contributors","subscribers_url":"https://api.github.com/repos/ripple/rippled/subscribers","subscription_url":"https://api.github.com/repos/ripple/rippled/subscription","commits_url":"https://api.github.com/repos/ripple/rippled/commits{/sha}","git_commits_url":"https://api.github.com/repos/ripple/rippled/git/commits{/sha}","comments_url":"https://api.github.com/repos/ripple/rippled/comments{/number}","issue_comment_url":"https://api.github.com/repos/ripple/rippled/issues/comments/{number}","contents_url":"https://api.github.com/repos/ripple/rippled/contents/{+path}","compare_url":"https://api.github.com/repos/ripple/rippled/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ripple/rippled/merges","archive_url":"https://api.github.com/repos/ripple/rippled/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ripple/rippled/downloads","issues_url":"https://api.github.com/repos/ripple/rippled/issues{/number}","pulls_url":"https://api.github.com/repos/ripple/rippled/pulls{/number}","milestones_url":"https://api.github.com/repos/ripple/rippled/milestones{/number}","notifications_url":"https://api.github.com/repos/ripple/rippled/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ripple/rippled/labels{/name}","releases_url":"https://api.github.com/repos/ripple/rippled/releases{/id}","created_at":"2011-11-07T04:40:15Z","updated_at":"2015-01-28T17:59:37Z","pushed_at":"2015-01-28T02:31:19Z","git_url":"git://github.com/ripple/rippled.git","ssh_url":"git@github.com:ripple/rippled.git","clone_url":"https://github.com/ripple/rippled.git","svn_url":"https://github.com/ripple/rippled","homepage":"https://ripple.com","size":100279,"stargazers_count":906,"watchers_count":906,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":245,"mirror_url":null,"open_issues_count":138,"forks":245,"open_issues":138,"watchers":906,"default_branch":"develop"}},"_links":{"self":{"href":"https://api.github.com/repos/ripple/rippled/pulls/817"},"html":{"href":"https://github.com/ripple/rippled/pull/817"},"issue":{"href":"https://api.github.com/repos/ripple/rippled/issues/817"},"comments":{"href":"https://api.github.com/repos/ripple/rippled/issues/817/comments"},"review_comments":{"href":"https://api.github.com/repos/ripple/rippled/pulls/817/comments"},"review_comment":{"href":"https://api.github.com/repos/ripple/rippled/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/ripple/rippled/pulls/817/commits"},"statuses":{"href":"https://api.github.com/repos/ripple/rippled/statuses/9848f12dbd3e45bc017f87946ad56fc97c75d15b"}}}}