Skip to content

Validate config inputs before building (DONATION integer, hostname) #8

Closed

Description

@VijitSingh97

Problem

DONATION is read from config.json (rigforge.sh:107) and then sed'd into the XMRig source (donate.h, :235/:242) and --argjson'd into jq (:359) with no validation. A non-integer/garbage value breaks the build opaquely or risks injecting into source before compile. Other inputs (hostname) are also unvalidated.

Proposed

  • Validate DONATION is an integer within XMRig's allowed range (0–100) before patching/build; fail fast with a clear message.
  • Sanity-check P2POOL_NODE_HOSTNAME (non-empty, reasonable charset).

Acceptance

  • Invalid DONATION/hostname is rejected with a clear error before any source patch or build.

Activity

  1. added this to the v1.0 milestone on Jun 3, 2026
  2. added
    setupConfiguration and first-run setup
    securitySecurity-sensitive issue or hardening
    on Jun 3, 2026
  3. added theissue type on Jun 3, 2026
  4. VijitSingh97 commented on Jun 6, 2026

    @VijitSingh97
    ContributorAuthor

    Partially implemented by #26 (which closes #5).

    The DONATION half is done: parse_config now rejects a non-integer or out-of-range value (allowed 0–100) with a clear error before any donate.h patch or build, and it's covered by the test suite (accepts 0/1/100; rejects 101, -1, 1.5, abc).

    Still open: P2POOL_NODE_HOSTNAME validation — deliberately left out of #26 because hostname handling is entangled with the .local/Avahi removal (#14 / #15); cleaner to land the hostname check alongside that work.

    Keeping open for the hostname validation.

  5. added 2 commits that reference this issue on Jun 7, 2026
    6adaf90
    bbae0b9
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    securitySecurity-sensitive issue or hardeningsetupConfiguration and first-run setup

    Type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions