A JSON parse failure in the stdin read loop is treated as fatal, so a
single malformed frame kills the whole plugin process.
Observed in the field via lightning-cli: an unquoted short_channel_id
inside a -k array argument, e.g.
lightning-cli -k myplugin-cmd channels='[123456x1x0]'
is tolerated by lightning-cli and by lightningd (jsmn is permissive)
and reaches the plugin verbatim. cln-plugin's framing rejects it
(serde_json is strict), the read loop treats the error as fatal, and
the process exits. lightningd then logs "Killing plugin: ... exited
during normal operation" and the caller gets "Plugin terminated
before replying".
Also reproducible by piping garbage directly to any cln-plugin
binary's stdin.
Expected: a malformed frame should fail that one request (or be
logged and skipped) and the read loop should continue. As it stands,
any client typo takes down the plugin, and this affects every plugin
built on the crate.
Observed with cln-plugin 0.7 (crates.io); the code path is unchanged
on master.
A JSON parse failure in the stdin read loop is treated as fatal, so a
single malformed frame kills the whole plugin process.
Observed in the field via lightning-cli: an unquoted short_channel_id
inside a -k array argument, e.g.
lightning-cli -k myplugin-cmd channels='[123456x1x0]'
is tolerated by lightning-cli and by lightningd (jsmn is permissive)
and reaches the plugin verbatim. cln-plugin's framing rejects it
(serde_json is strict), the read loop treats the error as fatal, and
the process exits. lightningd then logs "Killing plugin: ... exited
during normal operation" and the caller gets "Plugin terminated
before replying".
Also reproducible by piping garbage directly to any cln-plugin
binary's stdin.
Expected: a malformed frame should fail that one request (or be
logged and skipped) and the read loop should continue. As it stands,
any client typo takes down the plugin, and this affects every plugin
built on the crate.
Observed with cln-plugin 0.7 (crates.io); the code path is unchanged
on master.