Refactor currency validation and API calls with centralized utilities#705
Merged
Conversation
…g in path regex The Copilot autofix in PR #704 introduced two issues: 1. mempool.ts: Math.max(0, Math.trunc(Number(startIndex))) produces NaN for undefined/non-numeric inputs and Infinity for Infinity input, creating invalid URLs like .../txs/NaN. Replace with Number.isFinite guard that safely falls back to 0. 2. blockchain-api.ts: ALLOWED_PATHS regex character class included %, allowing percent-encoded path traversal sequences like %2e%2e that bypass URL parser normalization. No caller uses percent-encoded pathnames, so removing % is safe defense-in-depth. https://claude.ai/code/session_01U1iKew457tGYZEGdynvC3P
…idate currency and range - Route getHistoricalPrice() through fetchJson() instead of raw fetch(), closing the main SSRF bypass that CodeQL flagged - Add runtime VALID_CURRENCIES validation at all server action boundaries (blockchain-api, market, both tax report flows) to prevent query parameter injection via the currency field - Replace raw fetch() in both tax report flow getDailyPrices() with fetchJson(), bringing them under the host/path allowlist - Sanitize market page range parameter as a positive integer - Use encodeURIComponent on all user-influenced query parameters - Tighten Zod schemas from z.string() to z.enum for currency fields - Export VALID_CURRENCIES const array from types.ts for shared validation https://claude.ai/code/session_01U1iKew457tGYZEGdynvC3P
Contributor
Author
|
@claude can you code review the pr 705 and make any changes required |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR refactors currency handling and API calls across the codebase to improve security, maintainability, and consistency:
VALID_CURRENCIESconstant intypes.tsand added validation checks in all functions that accept currency parametersfetchJson()utility function to consolidate HTTP request handling, error handling, and caching logicencodeURIComponent()calls for all user-provided parameters in API URLs to prevent injection attacksType of Change
Changes by File
src/lib/types.tsCurrencytype from union to derived type usingVALID_CURRENCIESconstantsrc/lib/blockchain-api.tsgetHistoricalPrice()andgetHistoricalPriceRange()fetch()calls withfetchJson()utilityencodeURIComponent()for currency and days parametersdaysparametersrc/lib/market.tsgetMarketPageData()fetch()calls withfetchJson()utilityencodeURIComponent()for all URL parametersrangeparametersrc/lib/mempool.tsstartIndexparameter usingNumber.isFinite()src/ai/flows/tax-report-flow.tsz.string()toz.enum(['USD', 'EUR', 'GBP'])getDailyPrices()fetch()calls withfetchJson()utilityencodeURIComponent()for currency parametersrc/ai/flows/enhanced-tax-report-flow.tsz.string()toz.enum(['USD', 'EUR', 'GBP'])getDailyPrices()fetch()calls withfetchJson()utilityencodeURIComponent()for currency parameterTest Plan
Checklist
npm run typecheckpassesnpm run lintpasseshttps://claude.ai/code/session_01U1iKew457tGYZEGdynvC3P