Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
558 changes: 558 additions & 0 deletions bin/testTokenEndpoints.ts

Large diffs are not rendered by default.

1 change: 1 addition & 0 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
"*.{js,jsx,ts,tsx}": "eslint"
},
"devDependencies": {
"@solana/web3.js": "^1.98.4",
"@types/chai": "^4.2.9",
"@types/express": "^4.17.13",
"@types/mocha": "^7.0.1",
Expand Down
5 changes: 3 additions & 2 deletions src/coinrankEngine.ts
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ import { getDelay, logger, snooze } from './utils/utils'
const PAGE_SIZE = 250
const DEFAULT_WAIT_MS = 5 * 1000
const MAX_WAIT_MS = 5 * 60 * 1000
const NUM_PAGES = 8

const { defaultFiatCode } = config

Expand Down Expand Up @@ -63,8 +62,10 @@ export const coinrankEngine = async (
const reply = await response.json()
const marketsPage = asCoingeckoMarkets(reply)
markets = [...markets, ...marketsPage]
if (marketsPage.length < PAGE_SIZE) {
break
}
page++
if (page > NUM_PAGES) break
}
const data: CoinrankRedis = { lastUpdate, markets }
await setAsync(
Expand Down
4 changes: 3 additions & 1 deletion src/types.ts
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
import {
asArray,
asDate,
asEither,
asNull,
asNumber,
asObject,
asOptional,
Expand Down Expand Up @@ -35,7 +37,7 @@ const asCoingeckoAsset = (raw: any) => {
image: asString,
current_price: asOptional(asNumber),
market_cap: asOptional(asNumber),
market_cap_rank: asNumber,
market_cap_rank: asEither(asNumber, asNull),

high_24h: asOptional(asNumber),
low_24h: asOptional(asNumber),
Expand Down
2 changes: 2 additions & 0 deletions src/v3/constants.ts
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ export const TWENTY_FOUR_HOURS = 24 * ONE_HOUR

export const LEADERBOARD_KEY = 'edgerates:topAssets'
export const TOKEN_TYPES_KEY = 'tokenTypes'
export const NETWORK_LOCATION_TYPES_KEY = 'networkLocationTypes'
export const TOKEN_OVERRIDES_KEY = 'tokenOverrides'

export const CRYPTO_LIMIT = 100
export const FIAT_LIMIT = 256
302 changes: 302 additions & 0 deletions src/v3/getTokenInfo.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,302 @@
import { asObject, asOptional, asString } from 'cleaners'
import type { MangoSelector } from 'nano'
import type { HttpResponse } from 'serverlet'
import type { ExpressRequest } from 'serverlet/express'

import { dbTokens } from './providers/couch'
import { asTokenInfoDoc, type EdgeTokenInfo } from './types'
import { toCryptoKey } from './utils'

// ---------------------------
// Shared helpers
// ---------------------------

const parsePluginIds = (pluginIds?: string): string[] | undefined =>
pluginIds?.split(',').filter(Boolean)

const chooseTokenIdIndex = (withPlugin: boolean): [string, string] =>
withPlugin
? ['idxTokenIdPlugin', 'idx_tokenId_plugin']
: ['idxTokenId', 'idx_tokenId']

const chooseTextIndex = (withPlugin: boolean): [string, string] =>
withPlugin
? ['idxTokensTextPlugin', 'idx_tokens_text_plugin']
: ['idxTokensText', 'idx_tokens_text']

const chooseRankIndex = (withPlugin: boolean): [string, string] =>
withPlugin ? ['idxRankPlugin', 'idx_rank_plugin'] : ['idxRank', 'idx_rank']

const getTokenDocs = async (params: {
selector: MangoSelector
useIndex?: [string, string]
limit?: number
skip?: number
}): Promise<EdgeTokenInfo[]> => {
const { selector, useIndex, limit, skip } = params
const response = await dbTokens.find({
selector,
use_index: useIndex,
limit,
skip,
sort: [{ rank: 'asc' }]
})
return response.docs.map(doc => asTokenInfoDoc(doc).doc)
}

function escapeRegex(str: string): string {
return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
}

const buildMangoSelector = (options: {
searchTerm?: string
field?: 'currencyCode' | 'displayName' | 'tokenId' | 'contractAddress'
chainPluginIds?: string[]
}): MangoSelector => {
const { searchTerm, field, chainPluginIds } = options

const selector: MangoSelector = {}

if (chainPluginIds != null && chainPluginIds.length > 0) {
selector.chainPluginId =
chainPluginIds.length === 1 ? chainPluginIds[0] : { $in: chainPluginIds }
}

if (searchTerm == null) return selector

// Handle the field search
if (field === 'currencyCode') {
selector.currencyCode = {
$regex: `(?i)^${escapeRegex(searchTerm)}`
}
} else if (field === 'displayName') {
selector.displayName = { $regex: `(?i).*${escapeRegex(searchTerm)}.*` }
} else if (field === 'tokenId') {
selector.tokenId = searchTerm
} else if (field === 'contractAddress') {
selector.contractAddress = {
$regex: `(?i).*${escapeRegex(searchTerm)}.*`
}
}

return selector
}

// ---------------------------
// Endpoints
// ---------------------------

const asGetTokenQuery = asObject({
tokenId: asString,
pluginId: asString
})

export const getTokenV1 = async (
request: ExpressRequest
): Promise<HttpResponse> => {
try {
const { tokenId, pluginId } = asGetTokenQuery(request.req.query)

const mangoSelector = buildMangoSelector({
searchTerm: tokenId,
field: 'tokenId',
chainPluginIds: [pluginId]
})

const result = await getTokenDocs({
selector: mangoSelector,
useIndex: chooseTokenIdIndex(true),
limit: 1
})

if (result.length === 0) {
return {
status: 404,
headers: { 'content-type': 'application/json' },
body: JSON.stringify({ error: 'Token not found' })
}
}

return {
headers: { 'content-type': 'application/json' },
body: JSON.stringify(result[0])
}
} catch (e) {
return {
status: 400,
headers: { 'content-type': 'application/json' },
body: JSON.stringify({ error: `Invalid request body ${String(e)}` })
}
}
}

const asFindTokenQuery = asObject({
searchTerm: asString,
pluginIds: asOptional(asString)
})

export const findTokensV1 = async (
request: ExpressRequest
): Promise<HttpResponse> => {
try {
const { searchTerm, pluginIds } = asFindTokenQuery(request.req.query)
if (searchTerm.length === 0) {
return {
status: 400,
headers: { 'content-type': 'application/json' },
body: JSON.stringify({
error: 'Search term must be at least 1 character'
})
}
}

const whitelistPluginIds = parsePluginIds(pluginIds)
const usingPluginFilter =
whitelistPluginIds != null && whitelistPluginIds.length > 0

const textIndex = chooseTextIndex(usingPluginFilter)

// Currency code lookup
const currencyCodeSelector = buildMangoSelector({
searchTerm,
field: 'currencyCode',
chainPluginIds: whitelistPluginIds
})
const currencyCodeMatches = await getTokenDocs({
selector: currencyCodeSelector,
useIndex: textIndex,
limit: 100
})

// Display name lookup
const displayNameSelector = buildMangoSelector({
searchTerm,
field: 'displayName',
chainPluginIds: whitelistPluginIds
})
const displayNameMatches = await getTokenDocs({
selector: displayNameSelector,
useIndex: textIndex,
limit: 100
})

// Token ID lookup
const tokenIdIndex = chooseTokenIdIndex(usingPluginFilter)
const tokenIdSelector = buildMangoSelector({
searchTerm,
field: 'tokenId',
chainPluginIds: whitelistPluginIds
})
const tokenIdMatches = await getTokenDocs({
selector: tokenIdSelector,
useIndex: tokenIdIndex,
limit: 100
})

// Contract address lookup
const contractAddressSelector = buildMangoSelector({
searchTerm,
field: 'contractAddress',
chainPluginIds: whitelistPluginIds
})
const contractAddressMatches = await getTokenDocs({
selector: contractAddressSelector,
useIndex: textIndex,
limit: 100
})

// Filter out duplicates
const uniqueResults: Record<string, EdgeTokenInfo> = {}
for (const doc of [
...currencyCodeMatches,
...displayNameMatches,
...tokenIdMatches,
...contractAddressMatches
]) {
const key = toCryptoKey({
pluginId: doc.chainPluginId,
tokenId: doc.tokenId
})
uniqueResults[key] ??= doc
}
const sortedResults = Object.values(uniqueResults).sort(
(a, b) => a.rank - b.rank
)

return {
headers: { 'content-type': 'application/json' },
body: JSON.stringify(sortedResults)
}
} catch (e) {
return {
status: 400,
headers: { 'content-type': 'application/json' },
body: JSON.stringify({ error: `Invalid request body ${String(e)}` })
}
}
}

const asListTokensQuery = asObject({
page: asOptional(asString, '0'),
pageSize: asOptional(asString, '10'),
pluginIds: asOptional(asString)
})

export const listTokensV1 = async (
request: ExpressRequest
): Promise<HttpResponse> => {
try {
const {
page: pageStr,
pageSize: pageSizeStr,
pluginIds
} = asListTokensQuery(request.req.query)
const page = Number(pageStr)
const pageSize = Number(pageSizeStr)

if (!Number.isInteger(page) || page < 0) {
return {
status: 400,
headers: { 'content-type': 'application/json' },
body: JSON.stringify({
error: 'Page must be an integer greater than or equal to 0'
})
}
}
if (!Number.isInteger(pageSize) || pageSize > 100 || pageSize < 10) {
return {
status: 400,
headers: { 'content-type': 'application/json' },
body: JSON.stringify({
error: 'Page size must be an integer between 10 and 100'
})
}
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NaN from parseInt bypasses all validation checks

Low Severity

parseInt(pageStr) and parseInt(pageSizeStr) return NaN for non-numeric input like "abc". All subsequent validation comparisons (NaN < 0, NaN > 100, NaN < 10) evaluate to false, so NaN passes through all guards and gets forwarded to CouchDB as skip and limit values, resulting in an unhelpful error message from the catch block.

Fix in Cursor Fix in Web


const whitelistPluginIds = parsePluginIds(pluginIds)
const usingPluginFilter =
whitelistPluginIds != null && whitelistPluginIds.length > 0

const selector = buildMangoSelector({
chainPluginIds: whitelistPluginIds
})

const result = await getTokenDocs({
selector,
useIndex: chooseRankIndex(usingPluginFilter),
limit: pageSize,
skip: page * pageSize
})

return {
headers: { 'content-type': 'application/json' },
body: JSON.stringify(result)
}
} catch (e) {
return {
status: 400,
headers: { 'content-type': 'application/json' },
body: JSON.stringify({ error: `Invalid request body ${String(e)}` })
}
}
}
4 changes: 4 additions & 0 deletions src/v3/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ import { pickMethod, pickPath, withCors } from 'serverlet'
import { makeExpressRoute } from 'serverlet/express'

import { config } from '../config'
import { findTokensV1, getTokenV1, listTokensV1 } from './getTokenInfo'
import {
ratesV2,
rateV2,
Expand All @@ -21,6 +22,9 @@ function server(): void {
const server = withCors(
pickPath({
'/': pickMethod({ GET: heartbeatV3 }),
'/v1/getToken': pickMethod({ GET: getTokenV1 }),
'/v1/findTokens': pickMethod({ GET: findTokensV1 }),
'/v1/listTokens': pickMethod({ GET: listTokensV1 }),
'/v2/exchangeRate': pickMethod({ GET: rateV2 }),
'/v2/exchangeRates': pickMethod({ POST: ratesV2 }),
'/v2/coinrank': pickMethod({ GET: sendCoinranksV2 }),
Expand Down
Loading
Loading