Is SQL injection a possibility while using JSON-RPC and Descriptor wallet RPCs?

Consider one parameter in some descriptor wallet RPC is vulnerable and returns some data with SQL queries that shouldn't be returned. Will it really affect anything if RPC is only accessible from localhost?

Any difference in security when using REST API because I have not tried -rest option yet?

  • You mean because descriptor wallets use sqlite as storage backend? None of that is exposed through RPC or otherwise. Commented Aug 4, 2021 at 16:09
  • Yes because of SQLite. Not sure if I understand second sentence. If a descriptor wallet RPC updates something in SQL db it should be assumed exposed.
    – user103136
    Commented Aug 4, 2021 at 16:16
  • I mean there is no way to create an RPC that will pass through SQL code to sqlite. All sql queries are constructed inside the wallet, so there isn't any way to test this. Commented Aug 4, 2021 at 16:19

1 Answer 1


The vast majority of database entries are generated by the wallet and do not contain anything that the user can enter. Things that users can enter are generally validated prior to writing to the database, e.g. descriptors imported with importdescriptors must be valid descriptors before they are written.

The sole exception are labels which, by definition, contain user generated data. As such, if the record writing were implemented incorrectly, a user could use setlabel to perform a SQL injection attack. This is because the label string provided to setlabel must be provided directly to the SQL query that actually adds it to the database.

However Bitcoin Core's use of sqlite prevents SQL injection attacks. Bitcoin Core uses prepared statements so it is not possible to perform a SQL injection, barring some implementation error on the side of sqlite. These statements are prepared at the time the wallet is loaded. They are fixed queries and cannot be modified by the user.

  • Ah, I had forgotten about labels and update statement of course. It's very limited, and using prepared statements it should categorically be impossible to do SQL injection, but that is indeed an example where RPC arguments are passed through. Commented Aug 4, 2021 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.