🛡️ Sentinel: [MEDIUM] Add timeouts to external fetch calls

.jules/sentinel.md

@@ -12,3 +12,8 @@
 **Vulnerability:** XSS risk via unsanitized `<` characters in `JSON.stringify` output injected into `<script type="application/ld+json">`.
 **Learning:** `JSON.stringify()` does not automatically escape `<` as `\u003c`. If dynamic or unsanitized content is serialized into a `<script>` tag via `dangerouslySetInnerHTML`, an attacker can include `</script>` to break out of the context and inject malicious scripts.
 **Prevention:** Always replace `<` with `\u003c` when injecting JSON output into script tags, e.g., `JSON.stringify(data).replace(/</g, '\\u003c')`.
+
+## 2025-06-06 - Missing Fetch Timeouts
+**Vulnerability:** Denial of Service (DoS) risk and server resource exhaustion from hanging external HTTP requests.
+**Learning:** The native Javascript `fetch` API does not have a default timeout. If the requested external service hangs, the `fetch` request will wait indefinitely, consuming resources and potentially bringing down the server or hanging build scripts.
+**Prevention:** Always add an explicit timeout to external `fetch` calls using `signal: AbortSignal.timeout(TIMEOUT_MS)`.

scripts/sync-sources.mjs

@@ -22,6 +22,7 @@ const SOURCE_REPO_ORDER = ["hypersnap", "hypersnap-docs-web", "snap", "protocol"
 
 const DOCS_LINK_LIMIT = 80;
 const README_HEADING_LIMIT = 10;
+const FETCH_TIMEOUT_MS = 30_000;
 
 const githubToken = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
 
@@ -32,6 +33,7 @@ async function fetchGithubJson(url, { optional = false } = {}) {
       "X-GitHub-Api-Version": "2022-11-28",
       ...(githubToken ? { Authorization: `Bearer ${githubToken}` } : {}),
     },
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
   });
 
   if ((response.status === 404 || response.status === 409) && optional) {
@@ -53,6 +55,7 @@ async function fetchGithubText(url, { optional = false } = {}) {
       "X-GitHub-Api-Version": "2022-11-28",
       ...(githubToken ? { Authorization: `Bearer ${githubToken}` } : {}),
     },
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
   });
 
   if ((response.status === 404 || response.status === 409) && optional) {

src/lib/network.ts

@@ -85,6 +85,7 @@ export async function getNetworkStatus(): Promise<NetworkStatus> {
       headers: {
         Accept: "application/json",
       },
+      signal: AbortSignal.timeout(NODE_PROBE_TIMEOUT_MS),
     });
 
     if (!response.ok) {

src/lib/snap-market.ts

@@ -1,6 +1,7 @@
 import { SNAP, correctedSnapFdv } from "@/lib/snap";
 
 export const SNAP_MARKET_REVALIDATE = 30;
+const SNAP_MARKET_TIMEOUT_MS = 10_000;
 
 type DexPeriod = {
   buys?: number;
@@ -79,6 +80,7 @@ export async function getSnapMarketData(): Promise<SnapMarketResponse> {
         "user-agent": "hypersnap.org market data checker",
       },
       next: { revalidate: SNAP_MARKET_REVALIDATE },
+      signal: AbortSignal.timeout(SNAP_MARKET_TIMEOUT_MS),
     });
 
     if (!response.ok) {