Repository navigation
Governance propose lacks minimum deposit #992
Description
Problem
The API route api/artist/[id].tsx does not validate the id parameter, allowing path traversal attacks and SQL injection through the artist ID parameter. Users can manipulate the URL to access unauthorized data or inject SQL commands.
Why it matters
Unvalidated route parameters:
- Path traversal can access files outside the intended directory
- SQL injection can compromise the database
- Exposes internal system structure and data
- Allows attackers to bypass authentication and authorization
Suggested Direction
- Add
zodorexpress-validatorvalidation for theidparameter inapi/artist/[id].tsx. - Validate that
idis a positive integer or valid UUID format. - Use parameterized queries instead of string concatenation for any database operations.
- Add rate limiting on the artist API endpoint.
- Write a test asserting the validation works and blocks injection attempts.
- Check
api/marketplace/[id].tsxandapi/portfolio/[id].tsxfor the same parameter validation gaps.
Acceptance Criteria
-
api/artist/[id].tsxvalidates theidparameter format - Invalid IDs return 400 Bad Request with clear error message
- SQL injection attempts are blocked
- Path traversal attempts are blocked
- Test asserts validation blocks malicious inputs
- All artist/marketplace/portfolio API routes validate their parameters
- No unvalidated route parameters remain in the API
Related
api/artist/[id].tsx, api/marketplace/[id].tsx, api/portfolio/[id].tsx, validators/artist-id.validator.ts, test/artist-api.test.ts
Activity
shobhamerabacha-star commentedon Oct 13, 2026
Greetings,
I looked into the details for "Governance propose lacks minimum deposit" and would like to contribute the fix.
Technical Implementation Outline:
Address::require_auth).Please assign this issue to me. I will submit a clean, well-tested, and production-ready PR promptly!
Yungmon22 commentedon Oct 19, 2026
@Yungmon22 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Yungmon22 to this issue.
sandrawillow001-afk commentedon Oct 19, 2026
@sandrawillow001-afk has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @sandrawillow001-afk to this issue.
drips-wave commentedon Oct 19, 2026
Congratulations, @sandrawillow001-afk! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @sandrawillow001-afk: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
sandrawillow001-afk commentedon Oct 21, 2026
Checked this against the repo: there is no
api/directory, no Express/Next API routes and no server-side query layer here —src/types/apiholds only wire DTOs for the external backend. The SPA does read unvalidateduseParams()values (listingId,artworkId,slug,username), but adding client-side route-param validation changes routing behaviour, so I did not fold it into #1048 (the #1000 fix). This one belongs with the backend repo that ownsapi/artist/[id].tsx.drips-wave commentedon Oct 26, 2026
This issue has been completed by @sandrawillow001-afk as part of the Stellar Wave Program's 10th Wave 🥳
😎 @sandrawillow001-afk: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.