feat: add a configurable maximum batch size for RPC requests

[andynog]

close: #2867

Adds middleware for the JSONRPC server to enforce a configurable maximum batch size for RPC requests.

---

PR checklist

• Tests written/updated
• Changelog entry added in .changelog (we use unclog to manage our changelog)
• Updated relevant documentation (docs/ or spec/) and code comments
• Title follows the Conventional Commits spec

[andynog]

I still need to find a way to implement some unit tests for the batch requests

[andynog]

@melekes, do you think that it would be helpful if I implemented some refactoring for this handler

cometbft/rpc/jsonrpc/server/http_server.go

Line 263 in ea1f896

func (h maxBytesHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {

I thought of combining this into just one middleware. I think doing this as a pre-check middleware might also be more beneficial since if the body is over the max size then it breaks before processing anything. please let me know what you think.

[melekes]

@melekes, do you think that it would be helpful if I implemented some refactoring for this handler

cometbft/rpc/jsonrpc/server/http_server.go

Line 263 in ea1f896

func (h maxBytesHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {

I thought of combining this into just one middleware. I think doing this as a pre-check middleware might also be more beneficial since if the body is over the max size then it breaks before processing anything. please let me know what you think.

sound good to me 👍

[andynog]

This should be ready to review @melekes, implemented a test too.

I've tagged it to be back ported to v1, not sure if it should be back ported to others. I think it could without breaking changes. Please let me know what you think.

[melekes]

Thanks @andynog ❤️

[adizere]

Makes sense to backport to 0.38 IMO.

[andynog]

If you want to test this locally you can:

• make install
• cometbft init
• vim ~/.cometbft/config/config.toml
• change max_request_batch_size = 1
• cometbft start --proxy_app=kvstore
• on another terminal, make a curl JSON-RPC batch request sending two requests in the batch:

curl --location --request GET 'http://localhost:26657/' \
--header 'Content-Type: application/json' \
--data '[
    {
        "jsonrpc": "2.0",
        "method": "net_info",
        "params": {},
        "id": 1
    },
    {
        "jsonrpc": "2.0",
        "method": "net_info",
        "params" : {},
        "id": 2
    }
]'

• you should get an error:

{"jsonrpc":"2.0","error":{"code":-32600,"message":"Invalid Request","data":"batch request exceeds maximum (1) allowed number of requests"}}%

• if you want to test the max body size, edit theconfig.toml file again and set max_body_bytes = 100, then re-start the kvstore app again and send the curl request one more time. This time you should get an error like:

{"jsonrpc":"2.0","error":{"code":-32600,"message":"Invalid Request","data":"error reading request body: http: request body too large"}}

[melekes]

👍

[cason]

Thank you for this. :)

I wish we could simplify the code under the node package, moving it to the rpc package (where it belongs), but lets keep this to a next refactoring effort.