From c1192daf56b146250b5ea2dbc2c29bee626028ce Mon Sep 17 00:00:00 2001 From: Zoro Date: Tue, 7 Jan 2025 21:00:41 +0800 Subject: [PATCH] docs: update `global type registration` code link (#23230) --- docs/architecture/adr-019-protobuf-state-encoding.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/architecture/adr-019-protobuf-state-encoding.md b/docs/architecture/adr-019-protobuf-state-encoding.md index 267896d962..ae797d93fe 100644 --- a/docs/architecture/adr-019-protobuf-state-encoding.md +++ b/docs/architecture/adr-019-protobuf-state-encoding.md @@ -150,7 +150,7 @@ and client developer UX. ### Safe usage of `Any` By default, the [gogo protobuf implementation of `Any`](https://pkg.go.dev/github.com/cosmos/gogoproto/types) -uses [global type registration]( https://github.com/cosmos/gogoproto/blob/master/proto/properties.go#L540) +uses [global type registration](https://github.com/cosmos/gogoproto/blob/v1.7.0/proto/properties.go#L546) to decode values packed in `Any` into concrete go types. This introduces a vulnerability where any malicious module in the dependency tree could register a type with the global protobuf registry