Merge pull request #111 from agoric-labs/mfig-prevent-future-queries

fix(baseapp): prevent queries for future (or in-progress) blocks

baseapp/abci.go

@@ -416,8 +416,18 @@ func (app *BaseApp) Query(req abci.RequestQuery) (res abci.ResponseQuery) {
 	}()
 
 	// when a client did not provide a query height, manually inject the latest
+	lastHeight := app.LastBlockHeight()
 	if req.Height == 0 {
-		req.Height = app.LastBlockHeight()
+		req.Height = lastHeight
+	}
+	if req.Height > lastHeight {
+		return sdkerrors.QueryResult(
+			sdkerrors.Wrapf(
+				sdkerrors.ErrInvalidHeight,
+				"given height %d is greater than latest height %d",
+				req.Height, lastHeight,
+			),
+		)
 	}
 
 	// handle gRPC routes first rather than calling splitPath because '/' characters
@@ -428,7 +438,7 @@ func (app *BaseApp) Query(req abci.RequestQuery) (res abci.ResponseQuery) {
 
 	path := splitPath(req.Path)
 	if len(path) == 0 {
-		sdkerrors.QueryResult(sdkerrors.Wrap(sdkerrors.ErrUnknownRequest, "no query path provided"))
+		return sdkerrors.QueryResult(sdkerrors.Wrap(sdkerrors.ErrUnknownRequest, "no query path provided"))
 	}
 
 	switch path[0] {
@@ -628,8 +638,17 @@ func (app *BaseApp) createQueryContext(height int64, prove bool) (sdk.Context, e
 	}
 
 	// when a client did not provide a query height, manually inject the latest
+	lastHeight := app.LastBlockHeight()
 	if height == 0 {
-		height = app.LastBlockHeight()
+		height = lastHeight
+	}
+	if height > lastHeight {
+		return sdk.Context{}, sdkerrors.Wrapf(
+			sdkerrors.ErrInvalidRequest,
+			"cannot query with height %d; last height is %d",
+			height,
+			lastHeight,
+		)
 	}
 
 	if height <= 1 && prove {

baseapp/abci_test.go

@@ -139,3 +139,23 @@ func TestBaseAppCreateQueryContextRejectsNegativeHeights(t *testing.T) {
 		})
 	}
 }
+
+func TestBaseAppCreateQueryContextRejectsFutureHeights(t *testing.T) {
+	t.Parallel()
+
+	logger := defaultLogger()
+	db := dbm.NewMemDB()
+	name := t.Name()
+	app := NewBaseApp(name, logger, db, nil)
+
+	proves := []bool{
+		false, true,
+	}
+	for _, prove := range proves {
+		t.Run(fmt.Sprintf("prove=%t", prove), func(t *testing.T) {
+			sctx, err := app.createQueryContext(30, true)
+			require.Error(t, err)
+			require.Equal(t, sctx, sdk.Context{})
+		})
+	}
+}