From 1ad60c0d6f6f18572961f0f47faa2d07d8f778c1 Mon Sep 17 00:00:00 2001 From: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com> Date: Fri, 3 Oct 2025 18:23:34 +0700 Subject: [PATCH] Potential fix for code scanning alert no. 7: Server-side request forgery Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com> --- app/api/metadata/gitcoin/[address]/route.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/app/api/metadata/gitcoin/[address]/route.ts b/app/api/metadata/gitcoin/[address]/route.ts index 2f0316ff..0fc5e927 100644 --- a/app/api/metadata/gitcoin/[address]/route.ts +++ b/app/api/metadata/gitcoin/[address]/route.ts @@ -57,7 +57,10 @@ export async function GET(req: NextRequest): Promise { return NextResponse.json(createResponse(0, [])); } - const stamps = await fetchStamps(address); + // Normalize address to lower-case with 0x prefix + const safeAddress = "0x" + address.replace(/^0x/i, "").toLowerCase(); + + const stamps = await fetchStamps(safeAddress); if (!stamps.length) return NextResponse.json(createResponse(0, [])); const detailsArr = stamps.map(gitcoinPassportMapping).filter(Boolean);