diff --git a/CHANGELOG.md b/CHANGELOG.md index 04568b2d3e62..30bf59c12d83 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -37,6 +37,8 @@ Ref: https://keepachangelog.com/en/1.0.0/ ## [Unreleased] +## [v0.46.10](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.10) - 2022-02-16 + ### Improvements * (cli) [#14953](https://github.com/cosmos/cosmos-sdk/pull/14953) Enable profiling block replay during abci handshake with `--cpu-profile`. diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index 60f9309f9214..c5f8b0140af2 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,8 +1,7 @@ -# Cosmos SDK v0.46.9 Release Notes +# Cosmos SDK v0.46.10 Release Notes -This release introduces bug fixes and improvements. Notably an extra config in the `app.toml`, `iavl-lazy-loading`, to enable lazy loading of IAVL store. -Changes to be made in the `app.toml` can be found in the [CHANGELOG](https://github.com/cosmos/cosmos-sdk/blob/release/v0.46.x/CHANGELOG.md). +This release improves CPU profiling when using the `--cpu-profile` flag, and fixes a possible way to DoS a node. Please see the [CHANGELOG](https://github.com/cosmos/cosmos-sdk/blob/release/v0.46.x/CHANGELOG.md) for an exhaustive list of changes. -Full Commit History: https://github.com/cosmos/cosmos-sdk/compare/v0.46.8...v0.46.9 +Full Commit History: https://github.com/cosmos/cosmos-sdk/compare/v0.46.9...v0.46.10 diff --git a/baseapp/abci.go b/baseapp/abci.go index d93779d02943..7147d6d88593 100644 --- a/baseapp/abci.go +++ b/baseapp/abci.go @@ -400,6 +400,10 @@ func (app *BaseApp) Query(req abci.RequestQuery) (res abci.ResponseQuery) { telemetry.IncrCounter(1, "query", req.Path) defer telemetry.MeasureSince(time.Now(), req.Path) + if req.Path == "/cosmos.tx.v1beta1.Service/BroadcastTx" { + return sdkerrors.QueryResult(sdkerrors.Wrap(sdkerrors.ErrInvalidRequest, "can't route a broadcast tx message"), app.trace) + } + // handle gRPC routes first rather than calling splitPath because '/' characters // are used as part of gRPC paths if grpcHandler := app.grpcQueryRouter.Route(req.Path); grpcHandler != nil {