Potential fix for code scanning alert no. 7: Server-side request forgery#3
Merged
Potential fix for code scanning alert no. 7: Server-side request forgery#3
Conversation
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com>
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR strengthens SSRF mitigation by introducing a strict regex for Ethereum addresses and integrating it into the GET handler validation flow, ensuring only lowercase, 0x-prefixed 40-hex-digit addresses are accepted before any server request is made. Sequence diagram for stricter Ethereum address validation in GET API routesequenceDiagram
actor User
participant API as "API Route (/metadata/gitcoin/[address])"
participant Validator as "Ethereum Address Validator"
User->>API: GET request with address param
API->>Validator: Validate address (isValidEthereumAddress)
Validator-->>API: Validation result
API->>Validator: Apply STRICT_ETH_ADDR_RE regex
Validator-->>API: Regex test result
alt Address is valid
API->>User: Return metadata response
else Address is invalid
API->>User: Return empty response
end
Class diagram for updated address validation logicclassDiagram
class "API Route Handler" {
+GET(req: NextRequest): Promise<NextResponse>
}
class "Ethereum Address Validator" {
+isValidEthereumAddress(address: string): boolean
+STRICT_ETH_ADDR_RE: RegExp
}
"API Route Handler" --> "Ethereum Address Validator" : uses
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
Hey there - I've reviewed your changes and they look great!
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location> `app/api/metadata/gitcoin/[address]/route.ts:61` </location>
<code_context>
+ if (
+ !address ||
+ !isValidEthereumAddress(address) ||
+ !STRICT_ETH_ADDR_RE.test("0x" + address.replace(/^0x/i, "").toLowerCase())
+ ) {
return NextResponse.json(createResponse(0, []));
</code_context>
<issue_to_address>
**question (bug_risk):** Lowercasing the address before validation may cause issues with checksum addresses.
Forcing lowercase may reject valid EIP-55 checksum addresses. If lowercase is required, update documentation or error messages to clarify this behavior.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/Dargon789/web3bio/security/code-scanning/7
To completely mitigate SSRF possibilities, we need to ensure the interpolated user input into the URL path does not allow for any path traversal or URL manipulation. The current
isValidEthereumAddressfunction should strictly enforce thataddressconsists only of the allowed Ethereum address characters (0x+ 40 lowercase hexadecimal digits), without allowing any extra characters. After validation/normalization, the value should not contain slashes, periods, or any reserved URI characters.For extra certainty and defense-in-depth, we should:
/^0x[a-f0-9]{40}$/).fetchStampsfunction accept only a validated address or refuse unsafe forms.You only need to edit within the code shown in the snippet in
app/api/metadata/gitcoin/[address]/route.ts.Suggested fixes powered by Copilot Autofix. Review carefully before merging.
Summary by Sourcery
Enforce strict Ethereum address validation in the GET route to mitigate SSRF risks by rejecting any input that does not match the exact lowercase 0x-prefixed 40-hex-digit format.
Bug Fixes:
Enhancements: