[ioctl] Incorrect conversion between integer types

action/consignment_transfer.go

@@ -57,8 +57,8 @@ type (
 
 	// ConsignMsgEther is the consignment message format of Ethereum
 	ConsignMsgEther struct {
-		BucketIdx int    `json:"bucket"`
-		Nonce     int    `json:"nonce"`
+		BucketIdx uint64 `json:"bucket"`
+		Nonce     uint64 `json:"nonce"`
 		Recipient string `json:"recipient"`
 		Reclaim   string `json:"reclaim"`
 	}
@@ -148,8 +148,8 @@ func NewConsignMsg(sigType, recipient string, bucketIdx, nonce uint64) ([]byte,
 	switch sigType {
 	case "Ethereum":
 		msg := ConsignMsgEther{
-			BucketIdx: int(bucketIdx),
-			Nonce:     int(nonce),
+			BucketIdx: bucketIdx,
+			Nonce:     nonce,
 			Recipient: recipient,
 			Reclaim:   _reclaim,
 		}

action/protocol/staking/handlers_test.go

@@ -2057,7 +2057,7 @@ func TestProtocol_HandleConsignmentTransfer(t *testing.T) {
 		// transfer to test.to through consignment
 		var consign []byte
 		if !test.nilPayload {
-			consign = newconsignment(require, int(test.sigIndex), int(test.sigNonce), test.bucketOwner, test.to.String(), test.consignType, test.reclaim, test.wrongSig)
+			consign = newconsignment(require, test.sigIndex, test.sigNonce, test.bucketOwner, test.to.String(), test.consignType, test.reclaim, test.wrongSig)
 		}
 
 		act, err := action.NewTransferStake(1, caller.String(), 0, consign, gasLimit, gasPrice)
@@ -2713,7 +2713,7 @@ func depositGas(ctx context.Context, sm protocol.StateManager, gasFee *big.Int)
 	return nil, accountutil.StoreAccount(sm, actionCtx.Caller, acc)
 }
 
-func newconsignment(r *require.Assertions, bucketIdx, nonce int, senderPrivate, recipient, consignTpye, reclaim string, wrongSig bool) []byte {
+func newconsignment(r *require.Assertions, bucketIdx, nonce uint64, senderPrivate, recipient, consignTpye, reclaim string, wrongSig bool) []byte {
 	msg := action.ConsignMsgEther{
 		BucketIdx: bucketIdx,
 		Nonce:     nonce,

ioctl/cmd/bc/bcbucketlist.go

@@ -87,24 +87,26 @@ func (m *bucketlistMessage) String() string {
 
 // getBucketList get bucket list from chain
 func getBucketList(method, addr string, args ...string) (err error) {
-	offset, limit := uint64(0), uint64(1000)
+	offset, limit := uint32(0), uint32(1000)
 	if len(args) > 0 {
-		offset, err = strconv.ParseUint(args[0], 10, 64)
+		val, err := strconv.ParseUint(args[0], 10, 32)
 		if err != nil {
 			return output.NewError(output.ValidationError, "invalid offset", err)
 		}
+		offset = uint32(val)
 	}
 	if len(args) > 1 {
-		limit, err = strconv.ParseUint(args[1], 10, 64)
+		val, err := strconv.ParseUint(args[1], 10, 32)
 		if err != nil {
 			return output.NewError(output.ValidationError, "invalid limit", err)
 		}
+		limit = uint32(val)
 	}
 	switch method {
 	case _bucketlistMethodByVoter:
-		return getBucketListByVoter(addr, uint32(offset), uint32(limit))
+		return getBucketListByVoter(addr, offset, limit)
 	case _bucketlistMethodByCandidate:
-		return getBucketListByCand(addr, uint32(offset), uint32(limit))
+		return getBucketListByCand(addr, offset, limit)
 	}
 	return output.NewError(output.InputError, "unknown <method>", nil)
 }

ioctl/cmd/contract/contractshare.go

@@ -117,7 +117,7 @@ func isExist(path string) bool {
 }
 
 func rename(oldPath string, newPath string, c chan bool) {
-	if isExist(_givenPath + "/" + oldPath) {
+	if isExist(oldPath) {
 		if err := os.Rename(oldPath, newPath); err != nil {
 			log.Println("Rename file failed: ", err)
 		}
@@ -127,7 +127,7 @@ func rename(oldPath string, newPath string, c chan bool) {
 }
 
 func share(args []string) error {
-	_givenPath = args[0]
+	_givenPath = filepath.Clean(args[0])
 	if len(_givenPath) == 0 {
 		return output.NewError(output.ReadFileError, "failed to get directory", nil)
 	}
@@ -186,7 +186,7 @@ func share(args []string) error {
 			case "list":
 				payload := make(map[string]bool)
 				for _, ele := range _fileList {
-					payload[ele] = isReadOnly(_givenPath + "/" + ele)
+					payload[ele] = isReadOnly(filepath.Join(_givenPath, ele))
 				}
 				response.Payload = payload
 				if err := conn.WriteJSON(&response); err != nil {
@@ -197,57 +197,95 @@ func share(args []string) error {
 
 				t := request.Payload
 				getPayload := reflect.ValueOf(t).Index(0).Interface().(map[string]interface{})
-				getPayloadPath := getPayload["path"].(string)
-				upload, err := os.ReadFile(_givenPath + "/" + getPayloadPath)
+				getPayloadPath, err := cleanPath(getPayload["path"].(string))
+				if err != nil {
+					log.Println("clean file path failed: ", err)
+					break
+				}
+				getPayloadPath = filepath.Join(_givenPath, getPayloadPath)
+				upload, err := os.ReadFile(getPayloadPath)
 				if err != nil {
 					log.Println("read file failed: ", err)
+					break
 				}
 				payload["content"] = string(upload)
-				payload["readonly"] = isReadOnly(_givenPath + "/" + getPayloadPath)
+				payload["readonly"] = isReadOnly(getPayloadPath)
 				response.Payload = payload
 				if err := conn.WriteJSON(&response); err != nil {
 					log.Println("send get response: ", err)
 					break
 				}
-				log.Println("share: " + _givenPath + "/" + getPayloadPath)
+				log.Println("share: " + easpcapeString(getPayloadPath))
 
 			case "rename":
 				c := make(chan bool)
 				t := request.Payload
 				renamePayload := reflect.ValueOf(t).Index(0).Interface().(map[string]interface{})
-				oldPath := renamePayload["oldPath"].(string)
-				newPath := renamePayload["newPath"].(string)
-				go rename(oldPath, newPath, c)
+				oldRenamePath, err := cleanPath(renamePayload["oldPath"].(string))
+				if err != nil {
+					log.Println("clean file path failed: ", err)
+					break
+				}
+				newRenamePath, err := cleanPath(renamePayload["newPath"].(string))
+				if err != nil {
+					log.Println("clean file path failed: ", err)
+					break
+				}
+				oldRenamePath = filepath.Join(_givenPath, oldRenamePath)
+				newRenamePath = filepath.Join(_givenPath, newRenamePath)
+				go rename(oldRenamePath, newRenamePath, c)
 				response.Payload = <-c
 				if err := conn.WriteJSON(&response); err != nil {
 					log.Println("send get response: ", err)
 					break
 				}
-				log.Println("rename: " + _givenPath + "/" + oldPath + " to " + _givenPath + "/" + newPath)
+				log.Println("rename: " + easpcapeString(oldRenamePath) + " to " + easpcapeString(newRenamePath))
 
 			case "set":
 				t := request.Payload
 				setPayload := reflect.ValueOf(t).Index(0).Interface().(map[string]interface{})
-				setPath := setPayload["path"].(string)
 				content := setPayload["content"].(string)
-				err := os.WriteFile(_givenPath+"/"+setPath, []byte(content), 0777)
+				setPath, err := cleanPath(setPayload["path"].(string))
 				if err != nil {
+					log.Println("clean file path failed: ", err)
+					break
+				}
+				setPath = filepath.Join(_givenPath, setPath)
+				if err := os.MkdirAll(filepath.Dir(setPath), 0755); err != nil {
+					log.Println("mkdir failed: ", err)
+					break
+				}
+				if err := os.WriteFile(setPath, []byte(content), 0644); err != nil {
 					log.Println("set file failed: ", err)
+					break
 				}
 				if err := conn.WriteJSON(&response); err != nil {
 					log.Println("send set response: ", err)
 					break
 				}
-				log.Println("set: " + _givenPath + "/" + setPath)
+				log.Println("set: " + easpcapeString(setPath))
 
 			default:
-				log.Println("Don't support this IDE yet. Can not handle websocket method: " + request.Key)
+				log.Println("Don't support this IDE yet. Can not handle websocket method: " + easpcapeString(request.Key))
 
 			}
 		}
 	})
 	log.Fatal(http.ListenAndServe(*_addr, nil))
 
 	return nil
+}
+
+func cleanPath(path string) (string, error) {
+	path = filepath.Clean(filepath.Join("/", path))
+	real, err := filepath.Rel("/", path)
+	if err != nil {
+		return "", err
+	}
+	return real, nil
+}
 
+func easpcapeString(str string) string {
+	escaped := strings.Replace(str, "\n", "", -1)
+	return strings.Replace(escaped, "\r", "", -1)
 }

ioctl/newcmd/bc/bcbucketlist.go

@@ -65,37 +65,40 @@ func NewBCBucketListCmd(client ioctl.Client) *cobra.Command {
 				err     error
 			)
 
-			offset, limit := uint64(0), uint64(1000)
-			method, addr := args[0], args[1]
-			s := args[2:]
+			offset, limit := uint32(0), uint32(1000)
+			method, addr, s := args[0], args[1], args[2:]
 
 			if len(s) > 0 {
-				offset, err = strconv.ParseUint(s[0], 10, 64)
+				val, err := strconv.ParseUint(s[0], 10, 32)
 				if err != nil {
 					return errors.Wrap(err, "invalid offset")
 				}
+				offset = uint32(val)
 			}
 			if len(s) > 1 {
-				limit, err = strconv.ParseUint(s[1], 10, 64)
+				val, err := strconv.ParseUint(s[1], 10, 32)
 				if err != nil {
 					return errors.Wrap(err, "invalid limit")
 				}
+				limit = uint32(val)
 			}
+
 			switch method {
 			case MethodVoter:
 				address, err = client.AddressWithDefaultIfNotExist(addr)
 				if err != nil {
 					return err
 				}
-				bl, err = getBucketListByVoterAddress(client, address, uint32(offset), uint32(limit))
+				bl, err = getBucketListByVoterAddress(client, address, offset, limit)
 			case MethodCandidate:
-				bl, err = getBucketListByCandidateName(client, addr, uint32(offset), uint32(limit))
+				bl, err = getBucketListByCandidateName(client, addr, offset, limit)
 			default:
 				return errors.New("unknown <method>")
 			}
 			if err != nil {
 				return err
 			}
+
 			var lines []string
 			if len(bl.Buckets) == 0 {
 				lines = append(lines, "Empty bucketlist with given address")