From 729834f54beed59e61c430bd82c90aeff34ccacd Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 15 Jun 2026 20:46:12 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?=
 =?UTF-8?q?Add=20explicit=20timeouts=20to=20external=20API=20fetch=20calls?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Severity: MEDIUM
Vulnerability: Missing timeouts on external `fetch` calls.
Impact: The native `fetch` API lacks a default timeout. If the remote server hangs or is unresponsive, the connection remains open indefinitely, leading to server resource exhaustion and potential Denial of Service (DoS).
Fix: Added explicit timeouts using `AbortSignal.timeout()` to `fetch` calls in `src/lib/network.ts` and `src/lib/snap-market.ts`.
Verification: Ran `npm run lint`, `npm run typecheck`, and `npm run build` locally.

Co-authored-by: felirami <6752178+felirami@users.noreply.github.com>
---
 src/lib/network.ts     | 1 +
 src/lib/snap-market.ts | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/src/lib/network.ts b/src/lib/network.ts
index 049cc1e..8a390b6 100644
--- a/src/lib/network.ts
+++ b/src/lib/network.ts
@@ -85,6 +85,7 @@ export async function getNetworkStatus(): Promise<NetworkStatus> {
       headers: {
         Accept: "application/json",
       },
+      signal: AbortSignal.timeout(NODE_PROBE_TIMEOUT_MS),
     });
 
     if (!response.ok) {
diff --git a/src/lib/snap-market.ts b/src/lib/snap-market.ts
index 19b7c1a..3f87ae2 100644
--- a/src/lib/snap-market.ts
+++ b/src/lib/snap-market.ts
@@ -1,6 +1,7 @@
 import { SNAP, correctedSnapFdv } from "@/lib/snap";
 
 export const SNAP_MARKET_REVALIDATE = 30;
+const MARKET_DATA_TIMEOUT_MS = 10_000;
 
 type DexPeriod = {
   buys?: number;
@@ -79,6 +80,7 @@ export async function getSnapMarketData(): Promise<SnapMarketResponse> {
         "user-agent": "hypersnap.org market data checker",
       },
       next: { revalidate: SNAP_MARKET_REVALIDATE },
+      signal: AbortSignal.timeout(MARKET_DATA_TIMEOUT_MS),
     });
 
     if (!response.ok) {