From 67416feb3afd35af0afb17739152273ab1c8f22f Mon Sep 17 00:00:00 2001
From: Hendrik Hofstadt <dev@slamper.me>
Date: Mon, 4 Jun 2018 22:14:20 +0200
Subject: [PATCH] return 404 for unknown RPC endpoints

---
 rpc/lib/server/handlers.go      | 15 ++++++++++++++-
 rpc/lib/server/handlers_test.go | 11 +++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/rpc/lib/server/handlers.go b/rpc/lib/server/handlers.go
index 07ccfb6f3..b478fd33d 100644
--- a/rpc/lib/server/handlers.go
+++ b/rpc/lib/server/handlers.go
@@ -32,7 +32,7 @@ func RegisterRPCFuncs(mux *http.ServeMux, funcMap map[string]*RPCFunc, cdc *amin
 	}
 
 	// JSONRPC endpoints
-	mux.HandleFunc("/", makeJSONRPCHandler(funcMap, cdc, logger))
+	mux.HandleFunc("/", handleInvalidJSONRPCPaths(makeJSONRPCHandler(funcMap, cdc, logger)))
 }
 
 //-------------------------------------
@@ -153,6 +153,19 @@ func makeJSONRPCHandler(funcMap map[string]*RPCFunc, cdc *amino.Codec, logger lo
 	}
 }
 
+func handleInvalidJSONRPCPaths(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		// Since the pattern "/" matches all paths not matched by other registered patterns we check whether the path is indeed
+		// "/", otherwise return a 404 error
+		if r.URL.Path != "/" {
+			http.NotFound(w, r)
+			return
+		}
+
+		next(w, r)
+	}
+}
+
 func mapParamsToArgs(rpcFunc *RPCFunc, cdc *amino.Codec, params map[string]json.RawMessage, argsOffset int) ([]reflect.Value, error) {
 	values := make([]reflect.Value, len(rpcFunc.argNames))
 	for i, argName := range rpcFunc.argNames {
diff --git a/rpc/lib/server/handlers_test.go b/rpc/lib/server/handlers_test.go
index 92a2d9909..86de0e4c6 100644
--- a/rpc/lib/server/handlers_test.go
+++ b/rpc/lib/server/handlers_test.go
@@ -97,3 +97,14 @@ func TestRPCNotification(t *testing.T) {
 	require.Nil(t, err, "reading from the body should not give back an error")
 	require.Equal(t, len(blob), 0, "a notification SHOULD NOT be responded to by the server")
 }
+
+func TestUnknownRPCPath(t *testing.T) {
+	mux := testMux()
+	req, _ := http.NewRequest("GET", "http://localhost/unknownrpcpath", nil)
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+	res := rec.Result()
+
+	// Always expecting back a 404 error
+	require.Equal(t, http.StatusNotFound, res.StatusCode, "should always return 404")
+}