zingolabs / zingolib_original

ZingoLib
MIT License
1 stars 1 forks source link

Audit http-match path in `get_client` #2

Open zancas opened 2 years ago

zancas commented 2 years ago

As seen here:

https://github.com/zingolabs/zecwallet-light-cli/blob/99a90a382396829ba9af60c33d3dd5fb432de1ec/lib/src/grpc_connector.rs#L38

It's possible to connect over HTTP, this may be reasonable for some cases (e.g. test).. but it's necessary for us to review what occurs on match, and where this method is called.

For example, perhaps the only allowed http connections should be https://localhost:PORT#.