From 9b867bd2d7f334b63b1fd6cfcbce82cc9f0b3f0e Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 16 Jun 2026 20:59:34 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?=
 =?UTF-8?q?Add=20timeouts=20to=20external=20fetch=20requests?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add `AbortSignal.timeout` to external `fetch` calls across the codebase (GitHub sync, Dexscreener market data, and Farcaster node info) to prevent hanging requests and mitigate resource exhaustion risks.

Co-authored-by: felirami <6752178+felirami@users.noreply.github.com>
---
 .jules/sentinel.md       | 4 ++++
 scripts/sync-sources.mjs | 2 ++
 src/lib/network.ts       | 1 +
 src/lib/snap-market.ts   | 2 ++
 4 files changed, 9 insertions(+)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index b5d9250..77c2eba 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -12,3 +12,7 @@
 **Vulnerability:** XSS risk via unsanitized `<` characters in `JSON.stringify` output injected into `<script type="application/ld+json">`.
 **Learning:** `JSON.stringify()` does not automatically escape `<` as `\u003c`. If dynamic or unsanitized content is serialized into a `<script>` tag via `dangerouslySetInnerHTML`, an attacker can include `</script>` to break out of the context and inject malicious scripts.
 **Prevention:** Always replace `<` with `\u003c` when injecting JSON output into script tags, e.g., `JSON.stringify(data).replace(/</g, '\\u003c')`.
+## 2025-06-06 - Missing timeouts on external fetch calls
+**Vulnerability:** Denial of Service (DoS) and hanging requests due to external HTTP calls lacking timeouts.
+**Learning:** The native `fetch` API in Node.js/browser environments does not time out by default. If external APIs (like GitHub or Dexscreener) fail to respond or respond slowly, requests hang indefinitely, leading to resource exhaustion or blocked event loops.
+**Prevention:** Always include an explicit timeout in `fetch` calls using `signal: AbortSignal.timeout(TIMEOUT_MS)` to ensure network requests fail gracefully if a timely response is not received.
diff --git a/scripts/sync-sources.mjs b/scripts/sync-sources.mjs
index 7dbc002..825ae52 100644
--- a/scripts/sync-sources.mjs
+++ b/scripts/sync-sources.mjs
@@ -32,6 +32,7 @@ async function fetchGithubJson(url, { optional = false } = {}) {
       "X-GitHub-Api-Version": "2022-11-28",
       ...(githubToken ? { Authorization: `Bearer ${githubToken}` } : {}),
     },
+    signal: AbortSignal.timeout(10000),
   });
 
   if ((response.status === 404 || response.status === 409) && optional) {
@@ -53,6 +54,7 @@ async function fetchGithubText(url, { optional = false } = {}) {
       "X-GitHub-Api-Version": "2022-11-28",
       ...(githubToken ? { Authorization: `Bearer ${githubToken}` } : {}),
     },
+    signal: AbortSignal.timeout(10000),
   });
 
   if ((response.status === 404 || response.status === 409) && optional) {
diff --git a/src/lib/network.ts b/src/lib/network.ts
index 049cc1e..8a390b6 100644
--- a/src/lib/network.ts
+++ b/src/lib/network.ts
@@ -85,6 +85,7 @@ export async function getNetworkStatus(): Promise<NetworkStatus> {
       headers: {
         Accept: "application/json",
       },
+      signal: AbortSignal.timeout(NODE_PROBE_TIMEOUT_MS),
     });
 
     if (!response.ok) {
diff --git a/src/lib/snap-market.ts b/src/lib/snap-market.ts
index 19b7c1a..63f8103 100644
--- a/src/lib/snap-market.ts
+++ b/src/lib/snap-market.ts
@@ -1,6 +1,7 @@
 import { SNAP, correctedSnapFdv } from "@/lib/snap";
 
 export const SNAP_MARKET_REVALIDATE = 30;
+const MARKET_FETCH_TIMEOUT_MS = 10_000;
 
 type DexPeriod = {
   buys?: number;
@@ -79,6 +80,7 @@ export async function getSnapMarketData(): Promise<SnapMarketResponse> {
         "user-agent": "hypersnap.org market data checker",
       },
       next: { revalidate: SNAP_MARKET_REVALIDATE },
+      signal: AbortSignal.timeout(MARKET_FETCH_TIMEOUT_MS),
     });
 
     if (!response.ok) {