From 4ee81cfb731e8c9efd232ebd136bd2c49a892bd3 Mon Sep 17 00:00:00 2001
From: selsta <selsta@sent.at>
Date: Sat, 25 Jul 2026 14:06:06 +0200
Subject: [PATCH] rpc: hide ZMQ request contents in restricted mode

---
 src/daemon/daemon.cpp        | 2 +-
 src/rpc/zmq_server.cpp       | 8 ++++++--
 src/rpc/zmq_server.h         | 3 ++-
 tests/trezor/daemon.cpp      | 2 +-
 tests/unit_tests/zmq_rpc.cpp | 2 +-
 5 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/src/daemon/daemon.cpp b/src/daemon/daemon.cpp
index fd6fb1150..edff0cee3 100644
--- a/src/daemon/daemon.cpp
+++ b/src/daemon/daemon.cpp
@@ -92,7 +92,7 @@ struct zmq_internals
 {
   explicit zmq_internals(t_core& core, t_p2p& p2p, const bool restricted)
     : rpc_handler{core.get(), p2p.get(), restricted}
-    , server{rpc_handler}
+    , server{rpc_handler, restricted}
   {}
 
   cryptonote::rpc::DaemonHandler rpc_handler;
diff --git a/src/rpc/zmq_server.cpp b/src/rpc/zmq_server.cpp
index 1194c4132..007409522 100644
--- a/src/rpc/zmq_server.cpp
+++ b/src/rpc/zmq_server.cpp
@@ -99,8 +99,9 @@ namespace
 namespace rpc
 {
 
-ZmqServer::ZmqServer(RpcHandler& h) :
+ZmqServer::ZmqServer(RpcHandler& h, const bool restricted) :
     handler(h),
+    restricted(restricted),
     context(zmq_init(num_zmq_threads)),
     rep_socket(nullptr),
     pub_socket(nullptr),
@@ -174,7 +175,10 @@ void ZmqServer::serve()
         }
         else // no errors
         {
-          MDEBUG("Received RPC request: \"" << *message << "\"");
+          if (restricted)
+            MDEBUG("Received RPC request");
+          else
+            MDEBUG("Received RPC request: \"" << *message << "\"");
           epee::byte_slice response = handler.handle(std::move(*message));
 
           const boost::string_ref response_view{reinterpret_cast<const char*>(response.data()), response.size()};
diff --git a/src/rpc/zmq_server.h b/src/rpc/zmq_server.h
index c72730a63..ce2bca28f 100644
--- a/src/rpc/zmq_server.h
+++ b/src/rpc/zmq_server.h
@@ -51,7 +51,7 @@ class ZmqServer final
 {
   public:
 
-    ZmqServer(RpcHandler& h);
+    ZmqServer(RpcHandler& h, bool restricted);
 
     ~ZmqServer();
 
@@ -68,6 +68,7 @@ class ZmqServer final
 
   private:
     RpcHandler& handler;
+    const bool restricted;
 
     net::zmq::context context;
 
diff --git a/tests/trezor/daemon.cpp b/tests/trezor/daemon.cpp
index b4e93e591..fb2359b61 100644
--- a/tests/trezor/daemon.cpp
+++ b/tests/trezor/daemon.cpp
@@ -242,7 +242,7 @@ bool mock_daemon::run_main()
   {
     CHECK_AND_ASSERT_THROW_MES(m_rpc_server.run(2, false), "Failed to start RPC");
     cryptonote::rpc::DaemonHandler rpc_daemon_handler(*m_core, m_server);
-    cryptonote::rpc::ZmqServer zmq_server(rpc_daemon_handler);
+    cryptonote::rpc::ZmqServer zmq_server(rpc_daemon_handler, false);
 
     if (m_start_zmq)
     {
diff --git a/tests/unit_tests/zmq_rpc.cpp b/tests/unit_tests/zmq_rpc.cpp
index 90a8c0f4a..882a0e603 100644
--- a/tests/unit_tests/zmq_rpc.cpp
+++ b/tests/unit_tests/zmq_rpc.cpp
@@ -368,7 +368,7 @@ namespace
     zmq_server()
       : zmq_base(),
         handler(),
-        server(handler),
+        server(handler, false),
         pub(),
         sub()
     {