Upgrade jsonrpc to upgrade hyper

CHANGELOG.md

@@ -1,3 +1,12 @@
+## Unreleased
+
+### BUG FIXES
+
+* `[light-node]` Upgrade `jsonrpc` dependency to v17.0 to fix security
+  vulnerability in `hyper` v0.12.35 ([#803])
+
+[#803]: https://github.com/informalsystems/tendermint-rs/issues/803
+
 ## v0.18.0
 
 *Jan 29, 2021*

light-node/Cargo.toml

@@ -30,10 +30,10 @@ path = "src/bin/tendermint-light-node/main.rs"
 anomaly = { version = "0.2", features = ["serializer"] }
 async-trait = "0.1"
 gumdrop = "0.7"
-jsonrpc-core = "14.2"
-jsonrpc-core-client = "14.2"
-jsonrpc-http-server = "14.2"
-jsonrpc-derive = "14.2"
+jsonrpc-core = "17.0"
+jsonrpc-core-client = "17.0"
+jsonrpc-http-server = "17.0"
+jsonrpc-derive = "17.0"
 serde = { version = "1", features = ["serde_derive"] }
 serde_json = "1.0"
 thiserror = "1.0"

light-node/src/rpc.rs

@@ -34,8 +34,9 @@ where
 }
 
 mod sealed {
-    use jsonrpc_core::futures::future::{self, FutureResult};
+    use jsonrpc_core::futures;
     use jsonrpc_core::types::Error;
+    use jsonrpc_core::{BoxFuture, Result};
     use jsonrpc_derive::rpc;
 
     use tendermint_light_client::supervisor::Handle;
@@ -46,11 +47,11 @@ mod sealed {
     pub trait Rpc {
         /// Returns the latest trusted block.
         #[rpc(name = "state")]
-        fn state(&self) -> FutureResult<Option<LightBlock>, Error>;
+        fn state(&self) -> BoxFuture<Result<Option<LightBlock>>>;
 
         /// Returns the latest status.
         #[rpc(name = "status")]
-        fn status(&self) -> FutureResult<LatestStatus, Error>;
+        fn status(&self) -> BoxFuture<Result<LatestStatus>>;
     }
 
     pub use self::rpc_impl_Rpc::gen_client::Client;
@@ -75,34 +76,32 @@ mod sealed {
     where
         H: Handle + Send + Sync + 'static,
     {
-        fn state(&self) -> FutureResult<Option<LightBlock>, Error> {
+        fn state(&self) -> BoxFuture<Result<Option<LightBlock>>> {
             let res = self.handle.latest_trusted().map_err(|e| {
                 let mut err = Error::internal_error();
                 err.message = e.to_string();
                 err.data = serde_json::to_value(e.kind()).ok();
                 err
             });
 
-            future::result(res)
+            Box::pin(futures::future::ready(res))
         }
 
-        fn status(&self) -> FutureResult<LatestStatus, Error> {
+        fn status(&self) -> BoxFuture<Result<LatestStatus>> {
             let res = self.handle.latest_status().map_err(|e| {
                 let mut err = Error::internal_error();
                 err.message = e.to_string();
                 err.data = serde_json::to_value(e.kind()).ok();
                 err
             });
 
-            future::result(res)
+            Box::pin(futures::future::ready(res))
         }
     }
 }
 
 #[cfg(test)]
 mod test {
-    use futures::compat::Future01CompatExt as _;
-    use jsonrpc_core::futures::future::Future;
     use jsonrpc_core::IoHandler;
     use jsonrpc_core_client::transports::local;
     use pretty_assertions::assert_eq;
@@ -117,13 +116,15 @@ mod test {
     #[tokio::test]
     async fn state() {
         let server = Server::new(MockHandle {});
-        let fut = {
+        let have = {
             let mut io = IoHandler::new();
             io.extend_with(server.to_delegate());
             let (client, server) = local::connect::<Client, _, _>(io);
-            client.state().join(server)
+            tokio::select! {
+                result = client.state() => result.unwrap(),
+                _ = server => panic!("server terminated before client state request completed"),
+            }
         };
-        let (have, _) = fut.compat().await.unwrap();
         let want = serde_json::from_str(LIGHTBLOCK_JSON).unwrap();
 
         assert_eq!(have, want);
@@ -132,13 +133,15 @@ mod test {
     #[tokio::test]
     async fn status() {
         let server = Server::new(MockHandle {});
-        let fut = {
+        let have = {
             let mut io = IoHandler::new();
             io.extend_with(server.to_delegate());
             let (client, server) = local::connect::<Client, _, _>(io);
-            client.status().join(server)
+            tokio::select! {
+                result = client.status() => result.unwrap(),
+                _ = server => panic!("server terminated before client status request completed"),
+            }
         };
-        let (have, _) = fut.compat().await.unwrap();
         let want = serde_json::from_str(STATUS_JSON).unwrap();
 
         assert_eq!(have, want);