Conversation
### Description This pull request addresses a medium-severity network reliability finding in `quantus-cli` identified during the Quantus workspace security audit (**FM-11**). Previously, `SubsquidClient::new` instantiated `reqwest::Client` using default settings without an explicit request timeout. Because reqwest has no default timeout, a stalled or non-responsive Subsquid GraphQL indexer endpoint would block calling tasks indefinitely, locking reward-collection and privacy-preserving transfer query CLI operations without recovery paths or errors. ### Key Changes & Remediations #### Bound Indexer HTTP Transport (FM-11 - `src/subsquid/client.rs`) * **Configured Request Timeout:** Configured `Client::builder().timeout(std::time::Duration::from_secs(30))` during `SubsquidClient` initialization. * **Consistency Across Clients:** Aligns the HTTP indexer timeout contract with the 30-second timeout already utilized by the WebSocket chain client. * **Graceful Degradation:** Ensures network interruptions and hung indexer connections fail-fast with a typed error rather than blocking the CLI indefinitely. ### How to Review 1. Inspect `SubsquidClient::new` in `src/subsquid/client.rs` to verify that `Client::builder().timeout(...)` is configured with a 30-second duration. 2. Verify existing unit tests (`test_transfer_query_params_builder`, pagination tests) continue to pass without timeout disruptions.
Contributor
|
I think this has the wrong formatting, use our formatter then the code changes will look clean |
Author
|
Thanks @n13. The line endings/formatting noise has been cleaned up using the project's |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This pull request addresses a medium-severity network reliability finding in
quantus-cliidentified during the Quantus workspace security audit (FM-11).Previously,
SubsquidClient::newinstantiatedreqwest::Clientusing default settings without an explicit request timeout. Because reqwest has no default timeout, a stalled or non-responsive Subsquid GraphQL indexer endpoint would block calling tasks indefinitely, locking reward-collection and privacy-preserving transfer query CLI operations without recovery paths or errors.Key Changes & Remediations
Bound Indexer HTTP Transport (FM-11 -
src/subsquid/client.rs)Client::builder().timeout(std::time::Duration::from_secs(30))duringSubsquidClientinitialization.How to Review
SubsquidClient::newinsrc/subsquid/client.rsto verify thatClient::builder().timeout(...)is configured with a 30-second duration.test_transfer_query_params_builder, pagination tests) continue to pass without timeout disruptions.