Potential fix for code scanning alert no. 7: Server-side request forgery#1
Merged
Potential fix for code scanning alert no. 7: Server-side request forgery#1
Conversation
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: AU_gdev_19 <[email protected]>
Reviewer's guide (collapsed on small PRs)Reviewer's GuideAfter validating the Ethereum address, the PR normalizes it to a canonical lowercase form with a ‘0x’ prefix and updates the downstream fetch call to use this sanitized value, eliminating the SSRF risk. Sequence diagram for Ethereum address normalization in GET requestsequenceDiagram
participant Client
participant API_Server
participant fetchStamps
Client->>API_Server: GET /api/metadata/gitcoin/[address]
API_Server->>API_Server: Validate address (isValidEthereumAddress)
API_Server->>API_Server: Normalize address (lowercase, enforce '0x' prefix)
API_Server->>fetchStamps: fetchStamps(safeAddress)
fetchStamps-->>API_Server: Return stamps
API_Server-->>Client: Response with details
Class diagram for address normalization in GET methodclassDiagram
class APIHandler {
+GET(req: NextRequest): Promise<NextResponse>
}
APIHandler : -address: string
APIHandler : -safeAddress: string
APIHandler : +isValidEthereumAddress(address: string): boolean
APIHandler : +fetchStamps(address: string): Stamp[]
APIHandler : +Normalization: safeAddress = "0x" + address.replace(/^0x/i, "").toLowerCase()
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
Hey there - I've reviewed your changes - here's some feedback:
- After normalizing the address, re-run your isValidEthereumAddress check (or an equivalent) on
safeAddressto guard against any unexpected input circumvention. - For more robust normalization and validation, consider using a battle-tested utility like ethers.js’s
getAddressto checksum and canonicalize the address instead of manual string ops.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- After normalizing the address, re-run your isValidEthereumAddress check (or an equivalent) on `safeAddress` to guard against any unexpected input circumvention.
- For more robust normalization and validation, consider using a battle-tested utility like ethers.js’s `getAddress` to checksum and canonicalize the address instead of manual string ops.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/Dargon789/web3bio/security/code-scanning/7
To eliminate any risk of SSRF, ensure that
addressis strictly validated before it is used as part of an outgoing URL. Currently, the validation logic usesisValidEthereumAddress(address). To strengthen this, we should guarantee the address string is normalized (e.g., ensure it’s lowercase and starts with "0x"), and recheck that it contains only allowed characters (hex string of 40 chars after "0x", or 42 with the prefix). The best fix is to sanitize and normalize the value right after the validation in theGETmethod, so the only value passed intofetchStampsand further is guaranteed safe.Thus:
isValidEthereumAddress(address), normalize and strictly parse theaddressto ensure canonical, unambiguous behavior.isValidEthereumAddressis robust and you can guarantee this, the fix can be minimal: forcibly lowercasing and enforcing "0x" prefix before passing tofetchStamps(or, if not, add a simple sanitation function inline).Make this change in
GET()inapp/api/metadata/gitcoin/[address]/route.tsafter the validation, before using address.Suggested fixes powered by Copilot Autofix. Review carefully before merging.
Summary by Sourcery
Sanitize and normalize the Ethereum address in the Gitcoin metadata API route to prevent server-side request forgery by enforcing a lowercase 0x-prefixed canonical format before making external requests.
Bug Fixes: