Fixing a nasty peer_id bug

Power2All · Power2All · commit b91c5e4ead25 · 2022-03-15T16:55:46.000+01:00
diff --git a/src/torrust_http_tracker/errors.rs b/src/torrust_http_tracker/errors.rs
@@ -9,6 +9,9 @@ pub enum ServerError {
     #[error("info_hash is either missing or invalid")]
     InvalidInfoHash,
 
+    #[error("peer_id is either missing or invalid")]
+    InvalidPeerId,
+
     #[error("could not find remote address")]
     AddressNotFound,
 
diff --git a/src/torrust_http_tracker/handlers.rs b/src/torrust_http_tracker/handlers.rs
@@ -45,6 +45,10 @@ pub async fn handle_announce(announce_request: AnnounceRequest, auth_key: Option
         false => announce_request.peer_addr.ip()
     };
 
+    if announce_request.peer_id.len() != 40 {
+        return Err(reject::custom(ServerError::InvalidPeerId))
+    }
+
     let peer = TorrentPeer::from_http_announce_request(&announce_request, peer_ip, tracker.config.get_ext_ip());
     let torrent_stats = tracker.update_torrent_with_peer_and_get_stats(&announce_request.info_hash, &peer).await;
     // get all peers excluding the client_addr
