fix: sanitize forms, validate API routes and staking balances, and re…

api/artist/[id].tsx

@@ -0,0 +1,3 @@
+/* eslint-disable react-refresh/only-export-components */
+export * from '../../src/api/artist/[id]'
+export { default } from '../../src/api/artist/[id]'

api/marketplace/[id].tsx

@@ -0,0 +1,3 @@
+/* eslint-disable react-refresh/only-export-components */
+export * from '../../src/api/marketplace/[id]'
+export { default } from '../../src/api/marketplace/[id]'

api/portfolio/[id].tsx

@@ -0,0 +1,3 @@
+/* eslint-disable react-refresh/only-export-components */
+export * from '../../src/api/portfolio/[id]'
+export { default } from '../../src/api/portfolio/[id]'

components/CompoundStakeForm.tsx

@@ -0,0 +1,3 @@
+/* eslint-disable react-refresh/only-export-components */
+export * from '../src/components/CompoundStakeForm'
+export { default } from '../src/components/CompoundStakeForm'

components/DelegateStakeForm.tsx

@@ -0,0 +1,3 @@
+/* eslint-disable react-refresh/only-export-components */
+export * from '../src/components/DelegateStakeForm'
+export { default } from '../src/components/DelegateStakeForm'

components/Header.tsx

@@ -0,0 +1,3 @@
+/* eslint-disable react-refresh/only-export-components */
+export * from '../src/components/Header'
+export { default } from '../src/components/Header'

components/Layout.tsx

@@ -0,0 +1,3 @@
+/* eslint-disable react-refresh/only-export-components */
+export * from '../src/components/Layout'
+export { default } from '../src/components/Layout'

components/StakeForm.tsx

@@ -0,0 +1,3 @@
+/* eslint-disable react-refresh/only-export-components */
+export * from '../src/components/StakeForm'
+export { default } from '../src/components/StakeForm'

components/ThemeToggle.tsx

@@ -0,0 +1,3 @@
+/* eslint-disable react-refresh/only-export-components */
+export * from '../src/components/ThemeToggle'
+export { default } from '../src/components/ThemeToggle'

components/UnstakeForm.tsx

@@ -0,0 +1,3 @@
+/* eslint-disable react-refresh/only-export-components */
+export * from '../src/components/UnstakeForm'
+export { default } from '../src/components/UnstakeForm'

hooks/useStellarBalance.ts

@@ -0,0 +1 @@
+export * from '../src/hooks/useStellarBalance'

src/api/artist/[id].tsx

@@ -0,0 +1,127 @@
+/* eslint-disable react-refresh/only-export-components */
+import { validateArtistId } from '@/validators/artist-id.validator'
+
+/** Rate limit bucket storage for artist endpoint */
+const rateLimitMap = new Map<string, { count: number; resetAt: number }>()
+export const ARTIST_ROUTE_LIMIT = { maxRequests: 30, windowMs: 60_000 }
+
+export function resetArtistApiRateLimits(): void {
+  rateLimitMap.clear()
+}
+
+/** Check rate limiting for a client key/IP */
+export function checkArtistRouteRateLimit(key = 'client-default'): boolean {
+  const now = Date.now()
+  const entry = rateLimitMap.get(key)
+  if (!entry || now >= entry.resetAt) {
+    rateLimitMap.set(key, { count: 1, resetAt: now + ARTIST_ROUTE_LIMIT.windowMs })
+    return true
+  }
+  if (entry.count >= ARTIST_ROUTE_LIMIT.maxRequests) {
+    return false
+  }
+  entry.count += 1
+  return true
+}
+
+/**
+ * Mock parameterized database fetch for artist.
+ * Prevents SQL injection by using parameters rather than string concatenation (#940).
+ */
+export async function getArtistById(artistId: string) {
+  // Parameterized query simulation:
+  // e.g. db.query('SELECT * FROM artists WHERE id = $1', [artistId])
+  return {
+    id: artistId,
+    name: 'Artist Profile',
+    verified: true,
+  }
+}
+
+export interface ApiRequest {
+  url?: string
+  headers?: Headers | Record<string, string | undefined>
+  query?: Record<string, string | string[] | undefined>
+  params?: Record<string, string | undefined>
+}
+
+export interface ApiResponse {
+  status: (code: number) => ApiResponse
+  json: (body: unknown) => void
+}
+
+/**
+ * Next.js App Router style route handler:
+ * GET(request, { params })
+ */
+export async function GET(
+  request: Request | ApiRequest,
+  context?: { params?: { id?: string } | Promise<{ id?: string }> },
+): Promise<Response> {
+  const resolvedParams = context?.params ? await context.params : undefined
+  const rawId =
+    resolvedParams?.id ?? (request as ApiRequest)?.query?.id ?? (request as ApiRequest)?.params?.id
+
+  // 1. Rate limiting check (#940)
+  const clientKey = 'client-default'
+  if (!checkArtistRouteRateLimit(clientKey)) {
+    return new Response(
+      JSON.stringify({
+        error: 'Too Many Requests',
+        message: 'Rate limit exceeded for artist API endpoint. Please try again later.',
+      }),
+      {
+        status: 429,
+        headers: { 'Content-Type': 'application/json' },
+      },
+    )
+  }
+
+  // 2. Validate id parameter (#940)
+  const validation = validateArtistId(rawId)
+  if (!validation.success) {
+    return new Response(
+      JSON.stringify({
+        error: 'Bad Request',
+        message: validation.error,
+      }),
+      {
+        status: 400,
+        headers: { 'Content-Type': 'application/json' },
+      },
+    )
+  }
+
+  // 3. Fetch artist with parameterized query
+  const artist = await getArtistById(validation.data)
+  return new Response(JSON.stringify(artist), {
+    status: 200,
+    headers: { 'Content-Type': 'application/json' },
+  })
+}
+
+/**
+ * Next.js Pages Router / Express style handler:
+ * handler(req, res)
+ */
+export default async function handler(req: ApiRequest, res: ApiResponse) {
+  const rawId = req.query?.id ?? req.params?.id
+
+  if (!checkArtistRouteRateLimit('client-default')) {
+    return res.status(429).json({
+      error: 'Too Many Requests',
+      message: 'Rate limit exceeded for artist API endpoint. Please try again later.',
+    })
+  }
+
+  const validation = validateArtistId(rawId)
+  if (!validation.success) {
+    return res.status(400).json({
+      error: 'Bad Request',
+      message: validation.error,
+    })
+  }
+
+  const artist = await getArtistById(validation.data)
+  return res.status(200).json(artist)
+}

src/api/marketplace/[id].tsx

@@ -0,0 +1,69 @@
+/* eslint-disable react-refresh/only-export-components */
+import { validateMarketplaceId } from '@/validators/artist-id.validator'
+import type { ApiRequest, ApiResponse } from '../artist/[id]'
+
+/**
+ * Mock parameterized database fetch for marketplace listing.
+ * Prevents SQL injection by using parameters rather than string concatenation (#940).
+ */
+export async function getMarketplaceItemById(listingId: string) {
+  // Parameterized query simulation:
+  // e.g. db.query('SELECT * FROM listings WHERE id = $1', [listingId])
+  return {
+    id: listingId,
+    title: 'Marketplace Listing',
+    status: 'active',
+  }
+}
+
+/**
+ * Next.js App Router style route handler:
+ * GET(request, { params })
+ */
+export async function GET(
+  request: Request | ApiRequest,
+  context?: { params?: { id?: string } | Promise<{ id?: string }> },
+): Promise<Response> {
+  const resolvedParams = context?.params ? await context.params : undefined
+  const rawId =
+    resolvedParams?.id ?? (request as ApiRequest)?.query?.id ?? (request as ApiRequest)?.params?.id
+
+  const validation = validateMarketplaceId(rawId)
+  if (!validation.success) {
+    return new Response(
+      JSON.stringify({
+        error: 'Bad Request',
+        message: validation.error,
+      }),
+      {
+        status: 400,
+        headers: { 'Content-Type': 'application/json' },
+      },
+    )
+  }
+
+  const listing = await getMarketplaceItemById(validation.data)
+  return new Response(JSON.stringify(listing), {
+    status: 200,
+    headers: { 'Content-Type': 'application/json' },
+  })
+}
+
+/**
+ * Next.js Pages Router / Express style handler:
+ * handler(req, res)
+ */
+export default async function handler(req: ApiRequest, res: ApiResponse) {
+  const rawId = req.query?.id ?? req.params?.id
+
+  const validation = validateMarketplaceId(rawId)
+  if (!validation.success) {
+    return res.status(400).json({
+      error: 'Bad Request',
+      message: validation.error,
+    })
+  }
+
+  const listing = await getMarketplaceItemById(validation.data)
+  return res.status(200).json(listing)
+}

src/api/portfolio/[id].tsx

@@ -0,0 +1,69 @@
+/* eslint-disable react-refresh/only-export-components */
+import { validatePortfolioId } from '@/validators/artist-id.validator'
+import type { ApiRequest, ApiResponse } from '../artist/[id]'
+
+/**
+ * Mock parameterized database fetch for portfolio artwork.
+ * Prevents SQL injection by using parameters rather than string concatenation (#940).
+ */
+export async function getPortfolioItemById(artworkId: string) {
+  // Parameterized query simulation:
+  // e.g. db.query('SELECT * FROM artworks WHERE id = $1', [artworkId])
+  return {
+    id: artworkId,
+    title: 'Artwork Item',
+    published: true,
+  }
+}
+
+/**
+ * Next.js App Router style route handler:
+ * GET(request, { params })
+ */
+export async function GET(
+  request: Request | ApiRequest,
+  context?: { params?: { id?: string } | Promise<{ id?: string }> },
+): Promise<Response> {
+  const resolvedParams = context?.params ? await context.params : undefined
+  const rawId =
+    resolvedParams?.id ?? (request as ApiRequest)?.query?.id ?? (request as ApiRequest)?.params?.id
+
+  const validation = validatePortfolioId(rawId)
+  if (!validation.success) {
+    return new Response(
+      JSON.stringify({
+        error: 'Bad Request',
+        message: validation.error,
+      }),
+      {
+        status: 400,
+        headers: { 'Content-Type': 'application/json' },
+      },
+    )
+  }
+
+  const artwork = await getPortfolioItemById(validation.data)
+  return new Response(JSON.stringify(artwork), {
+    status: 200,
+    headers: { 'Content-Type': 'application/json' },
+  })
+}
+
+/**
+ * Next.js Pages Router / Express style handler:
+ * handler(req, res)
+ */
+export default async function handler(req: ApiRequest, res: ApiResponse) {
+  const rawId = req.query?.id ?? req.params?.id
+
+  const validation = validatePortfolioId(rawId)
+  if (!validation.success) {
+    return res.status(400).json({
+      error: 'Bad Request',
+      message: validation.error,
+    })
+  }
+
+  const artwork = await getPortfolioItemById(validation.data)
+  return res.status(200).json(artwork)
+}