CBORBytes does not validate - change Send() API to accept []byte

[Stebalien]

Unlike cbg.Deferred, runtime.CBORBytes does not validate the input CBOR. It looks like we may be fine at the moment, but anything like the following would be really dangerous:

type Params struct {
    ...
    Params runtime.CBORBytes
    ...
}
...
p = Params{..., Params: runtime.CBORBytes(userDefinedBytes), ...}

I'd feel more comfortable if we used deferred (always checks on deserialize), but this would be a pretty large refactor.

[Stebalien]

My current solution is to"

1. Fix Check deferred method "params" when proposed #973.
2. Use a CheckCBOR([]byte) function (ensures the input is a single cbor object) instead of casting byte arrays to CBORBytes.

[anorth]

I do not understand what's dangerous here. Perhaps a concrete example would help. What would go wrong if something isn't valid CBOR, besides a call failing with ErrSerialization?

[anorth]

See discussion in #973, but I don't think this is a problem or that we should do anything.

[Stebalien]

Concrete example here: #974 (comment)

[Stebalien]

This is effectively a buffer overflow.

[Stebalien]

Resolution: In theory, actor "methods" take bytes and return bytes. However, for convenience, we encode to/from CBOR in the runtime.

This means that, in theory, we shouldn't have to validate CBOR before calling Send. Unfortunately, Send takes a CBORMarshaller and we generally assume that CBORMarshaler produces valid CBOR.

To be specific, the following would be problematic:

type Invocation struct {
    Method abi.MethodNum
    Params CBORMarshaller // Note: we don't do this in practice, we use bytes.
    Amount abi.TokenAmount
}

If Params produced two concatenated CBOR objects, a valid "params" object, and a valid "amount", it would be able to overwrite the amount in the Invocation struct.

So, to be extra-careful, we validate when calling Send.

---

Future proposal:

1. Change the Send API to:

func Send(target Address, method MethodNum, params []bytes, amount TokenAmount) (ret []byte, code ExitCode)

2. Implement a SendCBOR helper:

func SendCBOR(rt Runtime, target Address, method MethodNum, params CBORMarshaler, amount TokenAmount, out CBORUnmarshaler) ExitCode