fix(internal/ethapi,console,node,rpc): restrict debug_setHead to local transports by gzliudan · Pull Request #2296 · XinFinOrg/XDPoSChain

gzliudan · 2026-04-09T23:49:24Z

Proposed changes

Move debug_setHead out of the public debug API and expose it only through local transports by introducing a local-only RPC API classification.

This keeps debug_setHead available to in-process clients, IPC, and the local console while removing it from HTTP and WebSocket JSON-RPC exposure. It also updates the console and node tests to cover the new visibility rules.

Types of changes

What types of changes does your code introduce to XDC network?
Put an ✅ in the boxes that apply

Impacted Components

Which parts of the codebase does this PR touch?
Put an ✅ in the boxes that apply

Checklist

Put an ✅ in the boxes once you have confirmed below actions (or provide reasons on not doing so) that

This PR has sufficient test coverage (unit/integration test) OR I have provided reason in the PR description for not having test coverage
Tested on a private network from the genesis block and monitored the chain operating correctly for multiple epochs.
Provide an end-to-end test plan in the PR description on how to manually test it on the devnet/testnet.
Tested the backwards compatibility.
Tested with XDC nodes running this version co-exist with those running the previous version.
Relevant documentation has been updated as part of this PR
N/A

coderabbitai · 2026-04-09T23:49:32Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9380de33-df2d-40a4-8205-bd10680c17cd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

This PR restricts the debug_setHead JSON-RPC method to local transports by introducing a Local RPC API classification, keeping the method available via in-process and IPC while removing it from HTTP/WebSocket exposure.

Changes:

Added rpc.API.Local and updated node RPC startup to split APIs into open/auth/local sets.
Moved debug_setHead off the public DebugAPI into a new local-only PrivateDebugAPI.
Updated console behavior and added tests to enforce/validate the new exposure rules.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
rpc/types.go	Adds `API.Local` flag to mark APIs as local-transport only.
node/node.go	Splits registered APIs by transport visibility and wires open/auth/local sets into RPC startup.
node/node_auth_test.go	Adds test ensuring local-only APIs don’t cause auth endpoints to start and remain hidden from HTTP.
node/api.go	Updates WS admin start path to use filtered open APIs (but HTTP admin path still needs alignment).
internal/ethapi/backend.go	Registers a second `debug` service marked `Local` to host private debug methods.
internal/ethapi/api.go	Introduces `PrivateDebugAPI` and moves `SetHead` implementation to it.
internal/ethapi/api_test.go	Adds test verifying `debug_setHead` is hidden from open RPC but available on local registration.
console/console.go	Hides `debug.setHead` in JS console when the RPC method is not available.
console/console_test.go	Adds tests for console hiding behavior based on method availability.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

node/api.go

internal/ethapi/api.go

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

node/node.go

internal/ethapi/api_test.go

cmd/XDC/consolecmd.go

wanwiset25 · 2026-04-10T05:10:13Z

I think this is too big change just to disble 1 method which will be hard to maintain
also not only debug_setHead but all methods that can exploit the node.

how about we disable through RPC flag default value and properly design the start script here
https://github.com/XinFinOrg/XinFin-Node/blob/master/mainnet/start-node.sh

gzliudan · 2026-04-10T05:16:23Z

I think this is too big change just to disble 1 method which will be hard to maintain also not only debug_setHead but all methods that can exploit the node.

how about we disable through RPC flag default value and properly design the start script here https://github.com/XinFinOrg/XinFin-Node/blob/master/mainnet/start-node.sh

sometime users need debug api

Copilot

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cmd/XDC/consolecmd.go

console/console_test.go

cmd/XDC/consolecmd_test.go

Copilot

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

console/console.go

…l transports Move debug_setHead out of the public debug API and expose it only through local transports by introducing a local-only RPC API classification. This keeps debug_setHead available to in-process clients, IPC, and the local console while removing it from HTTP and WebSocket JSON-RPC exposure. It also updates the console and node tests to cover the new visibility rules.

gzliudan requested review from AnilChinchawale, anunay-xin, benjamin202410, Copilot, liam-lai and wanwiset25 April 9, 2026 23:49

Copilot started reviewing on behalf of gzliudan April 9, 2026 23:49 View session

Copilot AI reviewed Apr 9, 2026

View reviewed changes

node/api.go Show resolved Hide resolved

internal/ethapi/api.go Outdated Show resolved Hide resolved

gzliudan force-pushed the disable-xdc-debug-set-head branch 2 times, most recently from 1dc8a06 to 3b51d37 Compare April 10, 2026 03:14

gzliudan requested a review from Copilot April 10, 2026 03:56

Copilot started reviewing on behalf of gzliudan April 10, 2026 03:57 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

node/node.go Outdated Show resolved Hide resolved

internal/ethapi/api_test.go Outdated Show resolved Hide resolved

cmd/XDC/consolecmd.go Show resolved Hide resolved

gzliudan force-pushed the disable-xdc-debug-set-head branch from 3b51d37 to e0405d9 Compare April 10, 2026 04:11

gzliudan force-pushed the disable-xdc-debug-set-head branch from e0405d9 to ae4f9a4 Compare April 10, 2026 05:35

gzliudan requested a review from Copilot April 10, 2026 05:36

Copilot started reviewing on behalf of gzliudan April 10, 2026 05:36 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

cmd/XDC/consolecmd.go Show resolved Hide resolved

console/console_test.go Outdated Show resolved Hide resolved

cmd/XDC/consolecmd_test.go Outdated Show resolved Hide resolved

gzliudan force-pushed the disable-xdc-debug-set-head branch from ae4f9a4 to a5353e7 Compare April 10, 2026 06:53

gzliudan requested a review from Copilot April 10, 2026 07:23

Copilot started reviewing on behalf of gzliudan April 10, 2026 07:24 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

console/console.go Show resolved Hide resolved

gzliudan force-pushed the disable-xdc-debug-set-head branch from a5353e7 to 9f1d5de Compare April 10, 2026 09:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(internal/ethapi,console,node,rpc): restrict debug_setHead to local transports#2296

fix(internal/ethapi,console,node,rpc): restrict debug_setHead to local transports#2296
gzliudan wants to merge 1 commit intoXinFinOrg:dev-upgradefrom
gzliudan:disable-xdc-debug-set-head

gzliudan commented Apr 9, 2026

Uh oh!

coderabbitai bot commented Apr 9, 2026 •

edited

Loading

Review skipped

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wanwiset25 commented Apr 10, 2026

Uh oh!

gzliudan commented Apr 10, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

gzliudan commented Apr 9, 2026

Proposed changes

Types of changes

Impacted Components

Checklist

Uh oh!

coderabbitai bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wanwiset25 commented Apr 10, 2026

Uh oh!

gzliudan commented Apr 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai bot commented Apr 9, 2026 •

edited

Loading