[rpc] limit ids (#2694)

rooch-network · Sep 26, 2024 · 0e453b6 · 0e453b6
1 parent 8c4168e
commit 0e453b6
Showing 1 changed file with 14 additions and 4 deletions.
diff --git a/crates/rooch-rpc-server/src/service/rpc_service.rs b/crates/rooch-rpc-server/src/service/rpc_service.rs
@@ -358,13 +358,23 @@ impl RpcService {
         show_display: bool,
         state_type: ObjectStateType,
     ) -> Result<Vec<IndexerObjectStateView>> {
+        const MAX_OBJECT_IDS: usize = 100;
+
         let indexer_ids = match filter {
             // Compatible with object_ids query after split object_states
             // Do not query the indexer, directly return the states query results.
-            ObjectStateFilter::ObjectId(object_ids) => object_ids
-                .into_iter()
-                .map(|v| (v, IndexerStateID::default()))
-                .collect(),
+            ObjectStateFilter::ObjectId(object_ids) => {
+                if object_ids.len() > MAX_OBJECT_IDS {
+                    return Err(anyhow::anyhow!(
+                        "Too many object IDs requested. Maximum allowed: {}",
+                        MAX_OBJECT_IDS
+                    ));
+                }
+                object_ids
+                    .into_iter()
+                    .map(|v| (v, IndexerStateID::default()))
+                    .collect()
+            }
             _ => {
                 self.indexer
                     .query_object_ids(filter, cursor, limit, descending_order, state_type)