Reject malformed Beacon blob hash filters

crates/anvil/src/server/beacon/handlers.rs

@@ -1,4 +1,7 @@
-use super::{error::BeaconError, utils::must_be_ssz};
+use super::{
+    error::{BeaconError, BeaconErrorCode},
+    utils::must_be_ssz,
+};
 use crate::eth::EthApi;
 use alloy_eips::BlockId;
 use alloy_primitives::{B256, aliases::B32};
@@ -45,13 +48,17 @@ pub async fn handle_get_blobs(
 
     // Parse indices from query parameters
     // Supports both comma-separated (?indices=1,2,3) and repeated parameters (?indices=1&indices=2)
-    let versioned_hashes: Vec<B256> = versioned_hashes
+    let Ok(versioned_hashes) = versioned_hashes
         .get("versioned_hashes")
-        .map(|s| s.split(',').filter_map(|hash| B256::from_str(hash.trim()).ok()).collect())
-        .unwrap_or_default();
+        .map(|s| s.split(',').map(|hash| B256::from_str(hash.trim())).collect())
+        .transpose()
+    else {
+        return BeaconError::new(BeaconErrorCode::BadRequest, "Invalid versioned_hashes")
+            .into_response();
+    };
 
     // Get the blob sidecars using existing EthApi logic
-    match api.anvil_get_blobs_by_block_id(block_id, versioned_hashes) {
+    match api.anvil_get_blobs_by_block_id(block_id, versioned_hashes.unwrap_or_default()) {
         Ok(Some(blobs)) => {
             if must_be_ssz(&headers) {
                 blobs.as_ssz_bytes().into_response()

crates/anvil/tests/it/beacon_api.rs

@@ -218,6 +218,17 @@ async fn test_beacon_api_get_blobs() {
         "Expected 0 blobs when filtering by non-existent versioned_hash"
     );
 
+    // Ignoring invalid filters would broaden the request
+    let partly_invalid = format!("{},0xzz", actual_versioned_hashes[0]);
+    for filter in ["0x1234", "not-a-hash", "", partly_invalid.as_str()] {
+        let url = format!(
+            "{}/eth/v1/beacon/blobs/{block_number}?versioned_hashes={filter}",
+            handle.http_endpoint()
+        );
+        let response = client.get(&url).send().await.unwrap();
+        assert_eq!(response.status(), reqwest::StatusCode::BAD_REQUEST, "filter {filter:?}");
+    }
+
     // Test with special block identifiers
     let test_ids = vec!["latest", "finalized", "safe", "earliest"];
     for block_id in test_ids {