173 Updates TZP dapp to sanitize network type at all possible inputs,…

… adds explicit checks for vec access in worker
spruceid · Dec 2, 2021 · 67fcf67 · 67fcf67
1 parent 758b89d
commit 67fcf67
Show file tree

Hide file tree

Showing 7 changed files with 296 additions and 307 deletions.
diff --git a/dapp/src/routes/Search/Search.svelte b/dapp/src/routes/Search/Search.svelte
@@ -10,7 +10,7 @@
   import { useNavigate } from 'svelte-navigator';
   import { onMount } from 'svelte';
   import { defaultSearchOpts, search, network, alert } from 'src/store';
-  import type NetworkType from 'enumsNetworkType';
+  import NetworkType from 'enums/NetworkType';
   import { findAddressFromDomain } from './searchHelper';
   import './search.scss';
 
@@ -32,7 +32,9 @@
   };
 
   const setSelectedNetwork = () => {
-    network.set(localNetwork as NetworkType);
+    if (Object.values(NetworkType).includes(localNetwork as NetworkType)) {
+      network.set(localNetwork as NetworkType);
+    }
   };
 
   const searchProfiles = async () => {

diff --git a/dapp/src/routes/View.svelte b/dapp/src/routes/View.svelte
@@ -8,7 +8,7 @@
     search,
     network,
   } from 'src/store';
-  import type NetworkType from 'enumsNetworkType';
+  import NetworkType from 'enums/NetworkType';
   import { BasePage, LoadingSpinner, PublicProfileView } from 'components';
 
   const params = useParams();
@@ -21,9 +21,13 @@
   onMount(() => {
     // TODO: Generalize over claim types?
     if (!$searchClaims?.basic.content || !$searchClaims?.twitter.content) {
-      network.set(
-        ($params.network as NetworkType) || ('mainnet' as NetworkType)
-      );
+      const n = $params.network;
+      if (Object.values(NetworkType).includes(n as NetworkType)) {
+        network.set(n as NetworkType);
+      } else {
+        network.set(NetworkType.MAINNET)
+      }
+
       fetching = true;
       search($params.address, defaultSearchOpts).finally(() => {
         fetching = false;

diff --git a/dapp/src/store.ts b/dapp/src/store.ts
@@ -391,8 +391,13 @@ wallet.subscribe((w) => {
   }
 });
 
-network.subscribe((network) => {
-  if (network === NetworkType.CUSTOM) {
+network.subscribe((n) => {
+  if (!Object.values(NetworkType).includes(n as NetworkType)) {
+    network.set(NetworkType.MAINNET)
+    return
+  }
+
+  if (n === NetworkType.CUSTOM) {
     networkStr.set('custom');
     // TODO can't read from writeable, but then I don't understand why others work.
     networkStrTemp = 'custom';
@@ -404,12 +409,12 @@ network.subscribe((network) => {
     tzktBaseTemp = 'http://localhost:5000';
     tzktBase.set(tzktBaseTemp);
   } else {
-    networkStr.set(network);
+    networkStr.set(n);
     // TODO can't read from writeable, but then I don't understand why others work.
-    networkStrTemp = network;
-    strNetwork = network;
+    networkStrTemp = n;
+    strNetwork = n;
 
-    urlNode = `https://${network}.api.tez.ie/`;
+    urlNode = `https://${n}.api.tez.ie/`;
     nodeUrl.set(urlNode);
 
     tzktBaseTemp = `https://api.${networkStrTemp}.tzkt.io`;