fix: current-cycle-hash resp type issue

[tanuj-shardeum]

No description provided.

[linear]

BLUE-117 syncV2 is breaking in archiver due to 'current-cycle-hash'

ISSUE SUMMARY:

The current-cycle-hash endpoint https://github.com/shardeum/shardus-core/blob/1fa5f1c32f4b1044ea4dbb217a4ebb23a0596eb6/src/p2p/SyncV2/routes.ts#L52) seems to be changed recently. Basically, the response of it appears to be now as text , which seemed to be json before.

const res = await get(url)

  if (res.ok) {
    return (await res.json()) as T
  } else {
    throw new Error(`get failed with status ${res.statusText}`)
  }

I had to change the above code in the archiver

archive-server/src/sync-v2/queries.ts

Line 43 in 2790f66

const res = await get(url)

in the as following to get it working as a temp solution.

  const res = await get(url)

  if (res.ok) {
    let result
    if (url.includes('current-cycle-hash')) result = await res.text()
    else  result = await res.json()
    return (result) as T
  } else {
    throw new Error(`get failed with status ${res.statusText}`)
  }

<<TODO: Replace this with a short summary of the issue.>>

---

ISSUE REPRO STEPS:

<HINT: Add steps to list as-needed. If interaction is complex, add screenshots or a Slack screen-capture video (just drag and drop)>

1. <<TODO: Replace with repro step Bump the npm_and_yarn group across 1 directory with 3 updates #1>>
2. <<TODO: Replace with repro step Challenge receipt #2>>
3. Observe <<TODO: Describe unintended behavior.>>

---

EXPECTED RESULT:

<<TODO: Replace this with your expected results.>>

---

PULL REQUESTS:

<HINT: If your fix requires changes in multiple repos, add the following info per-repository.>

<<TODO: Enter Repository Name>>

Pull Request Link: <<TODO: Insert PR-LINK>>

GPT Review Link: <<TODO: Insert GPT-Review-Link>>

Jenkins Test Link: <<TODO: Insert Jenkins Test Job Link>>

---

ADDITIONAL INSTRUCTIONS:

<HINT: Add any additional instructions needed for the assignee. If you have specific requirements for how the task should be implemented or fixed, enter them or link them here.>

<<TODO: Insert additional instructions for assignee.>>

The problem with the code is that it logs user-provided data without sanitizing it first. This can lead to log injection attacks where an attacker can manipulate the log entries by providing malicious input.

To fix this issue, we need to sanitize the user-provided data before logging it. In this case, we can use the String.prototype.replace method to remove any newline characters from the user-provided data. This will prevent the attacker from creating new log entries by injecting newline characters into the input.

In the file src/API.ts, we need to sanitize the gossipPayload variable before passing it to the Collector.validateGossipData and Collector.processGossipData methods. We can do this by replacing all newline characters in the gossipPayload string with an empty string.

In the file src/Data/Collector.ts, we need to sanitize the getCurrentCycleCounter() function call before logging it. We can do this by converting the result of the function call to a string and then replacing all newline characters with an empty string.

The problem with the code is that it logs user-provided data without sanitizing it first. This can lead to log injection attacks where a malicious user can manipulate the log entries by providing input with special characters that are interpreted when the log output is displayed.

To fix this issue, we need to sanitize the user-provided data before logging it. In this case, we can use the String.prototype.replace method to remove any newline characters from the user-provided data. This will prevent the user from injecting new log entries by providing input with newline characters.

In the file src/API.ts, we need to sanitize the gossipPayload variable before logging it. We can do this by replacing all newline characters in the gossipPayload variable with an empty string.

In the file src/Data/Collector.ts, we need to sanitize the getCurrentCycleCounter() function before logging it. We can do this by converting the function's return value to a string and then replacing all newline characters in the string with an empty string.