fix(doc): revert mis-change (+3 squashed commits)

Squashed commits:
[f15651c] fix(doc): revert mis-change
[ded714c] fix(doc): revert mis-change
[54bbdc9] fix format (+16 squashed commits)
Squashed commits:
[5e642e991c] update issue template
[0f9134a3eb] update issue template
[886b8a3d8f] fix review
[221e1eac7a] fix lint
[2c6a4d2f3d] fix lint
[87873db079] clean code
[d9190dc0d9] update jsonrpcTest
[67cb174618] fix qps config
[0c97a6908b] fix test
[21561c41c3] add ByteArrayTest
[761246f31e] lower the default QPS limit
[28d265ecf6] remove check
[67ffbf652e] revert some changes
[eb0290b87c] fix merge
[a798968c7a] update getByJsonBlockId
[bb112b59aa] fix rpc blockNum or hash or tag too long risk

Author: Little-Peony

README.md

@@ -7,7 +7,7 @@
 </h4>
 
 <p align="center">
-  <a href="https://gitter.im/tronprotocol/allcoredev"><img src="https://img.shields.io/gitter/room/tronprotocol/java-tron.svg"></a>
+  <a href="https://discord.gg/hqKvyAM"><img src="https://img.shields.io/badge/chat-on%20discord-7289da.svg"></a>
   <a href="https://codecov.io/gh/tronprotocol/java-tron"><img src="https://codecov.io/gh/tronprotocol/java-tron/branch/develop/graph/badge.svg" /></a>
   <a href="https://github.com/tronprotocol/java-tron/issues"><img src="https://img.shields.io/github/issues/tronprotocol/java-tron.svg"></a>
   <a href="https://github.com/tronprotocol/java-tron/pulls"><img src="https://img.shields.io/github/issues-pr/tronprotocol/java-tron.svg"></a>
@@ -31,14 +31,14 @@
 
 TRON is building the foundational infrastructure for the decentralized internet ecosystem with a focus on high-performance, scalability, and security.
 
-- TRON Protocol: High-throughput（2000+ TPS), scalable blockchain OS (DPoS consensus) powering the TRON ecosystem.
+- TRON Protocol: High-throughput (2000+ TPS), scalable blockchain OS (DPoS consensus) powering the TRON ecosystem.
 - TRON Virtual Machine (TVM): EVM-compatible smart-contract engine for fast smart-contract execution.
 
 # Building the Source Code
 Before building java-tron, make sure you have:
 - Hardware with at least 4 CPU cores, 16 GB RAM, 10 GB free disk space for a smooth compilation process.
 - Operating system: `Linux` or `macOS` (`Windows` is not supported).
-- Git and correct JDK（version `8` or `17`） installed based on your CPU architecture.
+- Git and correct JDK (version `8` or `17`) installed based on your CPU architecture.
 
 There are two ways to install the required dependencies:
 
@@ -84,7 +84,7 @@ The java-tron project comes with several runnable artifacts and helper scripts f
 | Deployment Tier | CPU Cores | Memory | High-performance SSD Storage    | Network Downstream |
 |--------------------------|-------|--------|---------------------------|-----------------|
 | FullNode (Minimum)        | 8 | 16 GB | 200 GB ([Lite](https://tronprotocol.github.io/documentation-en/using_javatron/litefullnode/#lite-fullnode))                  | ≥ 5 MBit/sec  |
-| FullNode (Stable)         | 8 | 32 GB | 200 GB (Lite) 3.5 TB (Full) | ≥ 5 MBit/sec  |
+| FullNode (Stable)         | 8 | 32 GB | 200 GB (Lite) / 3.5 TB (Full) | ≥ 5 MBit/sec  |
 | FullNode (Recommend)      | 16+ | 32 GB+ | 4 TB         | ≥ 50 MBit/sec  |
 | Super Representative      | 32+ | 64 GB+ | 4 TB              | ≥ 50 MBit/sec  |
 
@@ -128,7 +128,7 @@ tail -f ./logs/tron.log
 Use [TronScan](https://tronscan.org/#/), TRON's official block explorer, to view main network transactions, blocks, accounts, witness voting, and governance metrics, etc.
 
 ### 2. Join Nile test network
-Utilize the `-c` flag to direct the node to the configuration file corresponding to the desired network. Since Nile TestNet may incorporate features not yet available on the MainNet, it is **strongly advised** to compile the source code following the [Building the Source Code](https://github.com/tron-nile-testnet/nile-testnet/blob/master/README.md#building-the-source-code) instructions for the Nile TestNet.
+Utilize the `-c` flag to direct the node to the configuration file corresponding to the desired network. Since Nile Testnet may incorporate features not yet available on the Mainnet, it is **strongly advised** to compile the source code following the [Building the Source Code](https://github.com/tron-nile-testnet/nile-testnet/blob/master/README.md#building-the-source-code) instructions for the Nile Testnet.
 
 ```bash
 java -jar ./build/libs/FullNode.jar -c config-nile.conf
@@ -139,7 +139,7 @@ Nile resources: explorer, faucet, wallet, developer docs, and network statistics
 ### 3. Access Shasta test network
 Shasta does not accept public node peers. Programmatic access is available via TronGrid endpoints; see [TronGrid Service](https://developers.tron.network/docs/trongrid) for details.
 
-Shasta resources: explorer, faucet, wallet, developer docs, and network statistics at [shastaex.io](https://shasta.tronex.io/).
+Shasta resources: explorer, faucet, wallet, developer docs, and network statistics at [shasta.tronex.io](https://shasta.tronex.io/).
 
 ### 4. Set up a private network
 To set up a private network for testing or development, follow the [Private Network guidance](https://tronprotocol.github.io/documentation-en/using_javatron/private_network/).
@@ -160,7 +160,7 @@ You could also test the process by connecting to a testnet or setting up a priva
 
 ## Programmatically interfacing FullNode
 
-Upon the FullNode startup successfully, interaction with the TRON network is facilitated through a comprehensive suite of programmatic interfaces exposed by java-tron:
+Once the FullNode starts successfully, interaction with the TRON network is facilitated through a comprehensive suite of programmatic interfaces exposed by java-tron:
 - **HTTP API**: See the complete [HTTP API reference and endpoint list](https://tronprotocol.github.io/documentation-en/api/http/).
 - **gRPC**: High-performance APIs suitable for service-to-service integration. See the supported [gRPC reference](https://tronprotocol.github.io/documentation-en/api/rpc/).
 - **JSON-RPC**: Provides Ethereum-compatible JSON-RPC methods for logs, transactions and contract calls, etc. See the supported [JSON-RPC methods](https://tronprotocol.github.io/documentation-en/api/json-rpc/).
@@ -201,14 +201,14 @@ Thank you for considering to help out with the source code! If you'd like to con
 
 # Resources
 
-- [Medium](https://medium.com/@coredevs) java-tron's official technical articles are published there.
-- [Documentation](https://tronprotocol.github.io/documentation-en/) and [TRON Developer Hub](https://developers.tron.network/) serve as java-tron’s primary documentation websites.
-- [TronScan](https://tronscan.org/#/) TRON main network blockchain browser.
-- [Nile Test network](http://nileex.io/) A stable test network of TRON contributed by TRON community.
-- [Shasta Test network](https://shasta.tronex.io/) A stable test network of TRON contributed by TRON community.
-- [Wallet-cli](https://github.com/tronprotocol/wallet-cli) TRON network wallet using command line.
-- [TIP](https://github.com/tronprotocol/tips) TRON Improvement Proposal (TIP) describes standards for the TRON network.
-- [TP](https://github.com/tronprotocol/tips/tree/master/tp) TRON Protocol (TP) describes standards already implemented in TRON network but not published as a TIP.
+- [Medium](https://medium.com/@coredevs) — Official technical articles from the java-tron core development team.
+- [Documentation](https://tronprotocol.github.io/documentation-en/) and [TRON Developer Hub](https://developers.tron.network/) — Primary documentation for java-tron developers.
+- [TronScan](https://tronscan.org/#/) — TRON mainnet blockchain explorer.
+- [Nile Test Network](http://nileex.io/) — A stable test network for TRON development and testing.
+- [Shasta Test Network](https://shasta.tronex.io/) — A stable test network mirroring mainnet features.
+- [Wallet-cli](https://github.com/tronprotocol/wallet-cli) — Command-line wallet for the TRON network.
+- [TIP](https://github.com/tronprotocol/tips) — TRON Improvement Proposals describing standards for the TRON network.
+- [TP](https://github.com/tronprotocol/tips/tree/master/tp) — TRON Protocols already implemented but not yet published as TIPs.
 
 # Integrity Check
 

chainbase/src/main/java/org/tron/core/db2/core/Chainbase.java

@@ -35,7 +35,7 @@ public enum Cursor {
   //true:fullnode, false:soliditynode
   private ThreadLocal<Cursor> cursor = new ThreadLocal<>();
   private ThreadLocal<Long> offset = new ThreadLocal<>();
-  private Snapshot head;
+  private volatile Snapshot head;
 
   public Chainbase(Snapshot head) {
     this.head = head;

common/src/main/java/org/tron/common/parameter/CommonParameter.java

@@ -25,6 +25,11 @@ public class CommonParameter {
 
   protected static CommonParameter PARAMETER = new CommonParameter();
 
+  // Default QPS values for rate limiters
+  public static final int DEFAULT_RATE_LIMITER_GLOBAL_QPS = 1000;
+  public static final int DEFAULT_RATE_LIMITER_GLOBAL_IP_QPS = 1000;
+  public static final int DEFAULT_RATE_LIMITER_GLOBAL_API_QPS = 1000;
+
   // Runtime chain state: set by VMConfig.initVmHardFork()
   // when the energy-limit governance proposal is activated.
   // Legacy: should belong to VMConfig, not here.
@@ -373,12 +378,12 @@ public class CommonParameter {
   public RateLimiterInitialization rateLimiterInitialization;
   @Getter
   @Setter
-  public int rateLimiterGlobalQps = 50000; // from clearParam(), consistent with mainnet.conf
+  public int rateLimiterGlobalQps = DEFAULT_RATE_LIMITER_GLOBAL_QPS; // from clearParam(), consistent with mainnet.conf
   @Getter
   @Setter
-  public int rateLimiterGlobalIpQps = 10000; // from clearParam(), consistent with mainnet.conf
+  public int rateLimiterGlobalIpQps = DEFAULT_RATE_LIMITER_GLOBAL_IP_QPS; // from clearParam(), consistent with mainnet.conf
   @Getter
-  public int rateLimiterGlobalApiQps = 1000; // from clearParam(), consistent with mainnet.conf
+  public int rateLimiterGlobalApiQps = DEFAULT_RATE_LIMITER_GLOBAL_API_QPS; // from clearParam(), consistent with mainnet.conf
   @Getter
   @Setter
   public double rateLimiterSyncBlockChain; // clearParam: 3.0

common/src/main/java/org/tron/common/utils/ByteArray.java

@@ -152,6 +152,12 @@ public static BigInteger hexToBigInteger(String input) {
   }
 
   public static long jsonHexToLong(String x) throws JsonRpcInvalidParamsException {
+    // Constants for input length validation to prevent DDoS attacks
+    int MAX_HEX_LONG_LENGTH = 20; // For 64-bit long values (18 chars for 0x7FFFFFFFFFFFFFFF) + safety buffer
+    if (x == null || x.length() > MAX_HEX_LONG_LENGTH) {
+      throw new JsonRpcInvalidParamsException("Input cannot be null or too long");
+    }
+
     if (!x.startsWith("0x")) {
       throw new JsonRpcInvalidParamsException("Incorrect hex syntax");
     }
@@ -160,6 +166,12 @@ public static long jsonHexToLong(String x) throws JsonRpcInvalidParamsException
   }
 
   public static int jsonHexToInt(String x) throws Exception {
+    // Constants for input length validation to prevent DDoS attacks
+    int MAX_HEX_INT_LENGTH = 12; // For 32-bit int values (10 chars for 0x7FFFFFFF) + safety buffer 
+    if (x == null || x.length() > MAX_HEX_INT_LENGTH) {
+      throw new Exception("Incorrect string length");
+    }
+
     if (!x.startsWith("0x")) {
       throw new Exception("Incorrect hex syntax");
     }

framework/src/main/java/org/tron/core/config/args/Args.java

@@ -100,7 +100,6 @@ public class Args extends CommonParameter {
   private static final ConcurrentHashMap<Long, BlockingQueue<ContractEventTrigger>>
       solidityContractEventTriggerMap = new ConcurrentHashMap<>();
 
-
   /**
    * set parameters.
    */
@@ -711,15 +710,15 @@ public static void applyConfigParams(
 
     PARAMETER.rateLimiterGlobalQps =
         config.hasPath(ConfigKey.RATE_LIMITER_GLOBAL_QPS) ? config
-            .getInt(ConfigKey.RATE_LIMITER_GLOBAL_QPS) : 50000;
+            .getInt(ConfigKey.RATE_LIMITER_GLOBAL_QPS) : DEFAULT_RATE_LIMITER_GLOBAL_QPS;
 
     PARAMETER.rateLimiterGlobalIpQps =
         config.hasPath(ConfigKey.RATE_LIMITER_GLOBAL_IP_QPS) ? config
-            .getInt(ConfigKey.RATE_LIMITER_GLOBAL_IP_QPS) : 10000;
+            .getInt(ConfigKey.RATE_LIMITER_GLOBAL_IP_QPS) : DEFAULT_RATE_LIMITER_GLOBAL_IP_QPS;
 
     PARAMETER.rateLimiterGlobalApiQps =
       config.hasPath(ConfigKey.RATE_LIMITER_GLOBAL_API_QPS) ? config
-        .getInt(ConfigKey.RATE_LIMITER_GLOBAL_API_QPS) : 1000;
+        .getInt(ConfigKey.RATE_LIMITER_GLOBAL_API_QPS) : DEFAULT_RATE_LIMITER_GLOBAL_API_QPS;
 
     PARAMETER.rateLimiterInitialization = getRateLimiterFromConfig(config);
 

framework/src/main/java/org/tron/core/services/jsonrpc/JsonRpcApiUtil.java

@@ -56,6 +56,11 @@
 
 @Slf4j(topic = "API")
 public class JsonRpcApiUtil {
+  /**
+   * Maximum allowed length for block identifiers to prevent DDoS attacks.
+   * Supports block hashes (66 chars) + safety buffer.
+   */
+  private static final int MAX_BLOCK_IDENTIFIER_LENGTH = 128;
 
   public static byte[] convertToTronAddress(byte[] address) {
     byte[] newAddress = new byte[21];
@@ -85,6 +90,13 @@ public static String getMethodSign(String method) {
     return Hex.toHexString(selector);
   }
 
+  public static void validateBlockNumOrHashOrTag(String input)
+      throws JsonRpcInvalidParamsException {
+    if (input == null || input.length() > MAX_BLOCK_IDENTIFIER_LENGTH) {
+      throw new JsonRpcInvalidParamsException("input is null or length exceeds maximum allowed");
+    }
+  }
+
   public static TriggerSmartContract triggerCallContract(byte[] address, byte[] contractAddress,
       long callValue, byte[] data, long tokenValue, String tokenId) {
     TriggerSmartContract.Builder builder = TriggerSmartContract.newBuilder();

framework/src/main/java/org/tron/core/services/jsonrpc/TronJsonRpcImpl.java

@@ -9,6 +9,7 @@
 import static org.tron.core.services.jsonrpc.JsonRpcApiUtil.getTransactionIndex;
 import static org.tron.core.services.jsonrpc.JsonRpcApiUtil.getTxID;
 import static org.tron.core.services.jsonrpc.JsonRpcApiUtil.triggerCallContract;
+import static org.tron.core.services.jsonrpc.JsonRpcApiUtil.validateBlockNumOrHashOrTag;
 
 import com.alibaba.fastjson.JSON;
 import com.google.common.cache.Cache;
@@ -296,6 +297,7 @@ public String web3Sha3(String data) throws JsonRpcInvalidParamsException {
   @Override
   public String ethGetBlockTransactionCountByHash(String blockHash)
       throws JsonRpcInvalidParamsException {
+    validateBlockNumOrHashOrTag(blockHash);
     Block b = getBlockByJsonHash(blockHash);
     if (b == null) {
       return null;
@@ -308,6 +310,7 @@ public String ethGetBlockTransactionCountByHash(String blockHash)
   @Override
   public String ethGetBlockTransactionCountByNumber(String blockNumOrTag)
       throws JsonRpcInvalidParamsException {
+    validateBlockNumOrHashOrTag(blockNumOrTag);
     List<Transaction> list = wallet.getTransactionsByJsonBlockId(blockNumOrTag);
     if (list == null) {
       return null;
@@ -327,6 +330,7 @@ public BlockResult ethGetBlockByHash(String blockHash, Boolean fullTransactionOb
   @Override
   public BlockResult ethGetBlockByNumber(String blockNumOrTag, Boolean fullTransactionObjects)
       throws JsonRpcInvalidParamsException {
+    validateBlockNumOrHashOrTag(blockNumOrTag);
     final Block b = wallet.getByJsonBlockId(blockNumOrTag);
     return (b == null ? null : getBlockResult(b, fullTransactionObjects));
   }
@@ -393,6 +397,9 @@ public String getLatestBlockNum() {
   @Override
   public String getTrxBalance(String address, String blockNumOrTag)
       throws JsonRpcInvalidParamsException {
+    // Add length check and validate hex format to prevent DDoS attacks
+    validateBlockNumOrHashOrTag(blockNumOrTag);
+
     if (EARLIEST_STR.equalsIgnoreCase(blockNumOrTag)
         || PENDING_STR.equalsIgnoreCase(blockNumOrTag)
         || FINALIZED_STR.equalsIgnoreCase(blockNumOrTag)) {
@@ -409,12 +416,6 @@ public String getTrxBalance(String address, String blockNumOrTag)
       }
       return ByteArray.toJsonHex(balance);
     } else {
-      try {
-        ByteArray.hexToBigInteger(blockNumOrTag);
-      } catch (Exception e) {
-        throw new JsonRpcInvalidParamsException(BLOCK_NUM_ERROR);
-      }
-
       throw new JsonRpcInvalidParamsException(QUANTITY_NOT_SUPPORT_ERROR);
     }
   }
@@ -535,6 +536,7 @@ private String call(byte[] ownerAddressByte, byte[] contractAddressByte, long va
   @Override
   public String getStorageAt(String address, String storageIdx, String blockNumOrTag)
       throws JsonRpcInvalidParamsException {
+    validateBlockNumOrHashOrTag(blockNumOrTag);
     if (EARLIEST_STR.equalsIgnoreCase(blockNumOrTag)
         || PENDING_STR.equalsIgnoreCase(blockNumOrTag)
         || FINALIZED_STR.equalsIgnoreCase(blockNumOrTag)) {
@@ -558,19 +560,14 @@ public String getStorageAt(String address, String storageIdx, String blockNumOrT
       DataWord value = storage.getValue(new DataWord(ByteArray.fromHexString(storageIdx)));
       return ByteArray.toJsonHex(value == null ? new byte[32] : value.getData());
     } else {
-      try {
-        ByteArray.hexToBigInteger(blockNumOrTag);
-      } catch (Exception e) {
-        throw new JsonRpcInvalidParamsException(BLOCK_NUM_ERROR);
-      }
-
       throw new JsonRpcInvalidParamsException(QUANTITY_NOT_SUPPORT_ERROR);
     }
   }
 
   @Override
   public String getABIOfSmartContract(String contractAddress, String blockNumOrTag)
       throws JsonRpcInvalidParamsException {
+    validateBlockNumOrHashOrTag(blockNumOrTag);
     if (EARLIEST_STR.equalsIgnoreCase(blockNumOrTag)
         || PENDING_STR.equalsIgnoreCase(blockNumOrTag)
         || FINALIZED_STR.equalsIgnoreCase(blockNumOrTag)) {
@@ -589,12 +586,6 @@ public String getABIOfSmartContract(String contractAddress, String blockNumOrTag
       }
 
     } else {
-      try {
-        ByteArray.hexToBigInteger(blockNumOrTag);
-      } catch (Exception e) {
-        throw new JsonRpcInvalidParamsException(BLOCK_NUM_ERROR);
-      }
-
       throw new JsonRpcInvalidParamsException(QUANTITY_NOT_SUPPORT_ERROR);
     }
   }
@@ -791,6 +782,7 @@ private TransactionResult getTransactionByBlockAndIndex(Block block, String inde
   @Override
   public TransactionResult getTransactionByBlockHashAndIndex(String blockHash, String index)
       throws JsonRpcInvalidParamsException {
+    validateBlockNumOrHashOrTag(blockHash);
     final Block block = getBlockByJsonHash(blockHash);
 
     if (block == null) {
@@ -803,6 +795,9 @@ public TransactionResult getTransactionByBlockHashAndIndex(String blockHash, Str
   @Override
   public TransactionResult getTransactionByBlockNumberAndIndex(String blockNumOrTag, String index)
       throws JsonRpcInvalidParamsException {
+    // Add length check and validate hex format to prevent DDoS attacks
+    validateBlockNumOrHashOrTag(blockNumOrTag);
+
     Block block = wallet.getByJsonBlockId(blockNumOrTag);
     if (block == null) {
       return null;
@@ -888,6 +883,8 @@ private TransactionContext findTransactionContext(TransactionInfoList infoList,
   @Override
   public List<TransactionReceipt> getBlockReceipts(String blockNumOrHashOrTag)
       throws JsonRpcInvalidParamsException, JsonRpcInternalException {
+    // Add length check and validate hex format to prevent DDoS attacks
+    validateBlockNumOrHashOrTag(blockNumOrHashOrTag);
 
     Block block = null;
 
@@ -973,6 +970,8 @@ public String getCall(CallArguments transactionCall, Object blockParamObj)
 
         long blockNumber;
         try {
+          // Add length check to prevent DDoS attacks
+          validateBlockNumOrHashOrTag(blockNumOrTag);
           blockNumber = ByteArray.hexToBigInteger(blockNumOrTag).longValue();
         } catch (Exception e) {
           throw new JsonRpcInvalidParamsException(BLOCK_NUM_ERROR);
@@ -1014,12 +1013,6 @@ public String getCall(CallArguments transactionCall, Object blockParamObj)
       return call(addressData, contractAddressData, transactionCall.parseValue(),
           ByteArray.fromHexString(transactionCall.getData()));
     } else {
-      try {
-        ByteArray.hexToBigInteger(blockNumOrTag);
-      } catch (Exception e) {
-        throw new JsonRpcInvalidParamsException(BLOCK_NUM_ERROR);
-      }
-
       throw new JsonRpcInvalidParamsException(QUANTITY_NOT_SUPPORT_ERROR);
     }
   }

framework/src/main/resources/config.conf

@@ -442,10 +442,10 @@ rate.limiter = {
     # disconnect = 1.0
   }
 
-  # global qps, default 50000
-  global.qps = 50000
-  # IP-based global qps, default 10000
-  global.ip.qps = 10000
+  # global qps, default 1000
+  global.qps = 1000
+  # IP-based global qps, default 1000
+  global.ip.qps = 1000
 }