From cb00e8f021086cbf859ed5b1e0344b0ed855e80f Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 20 Jun 2026 20:55:18 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?=
 =?UTF-8?q?Add=20timeouts=20to=20external=20API=20calls?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit adds `signal: AbortSignal.timeout(...)` to native `fetch` calls across the codebase, specifically in:
- `src/lib/network.ts` (network probe checks)
- `src/lib/snap-market.ts` (Dexscreener API data fetches)
- `scripts/sync-sources.mjs` (GitHub API data fetches)

The native `fetch` API does not enforce a default timeout. Unresponsive endpoints can cause hanging connections, leading to server resource exhaustion (Denial of Service) and permanently stuck build scripts.

Adding explicit abort signals ensures these requests fail quickly and securely when upstream services are unresponsive.

Co-authored-by: felirami <6752178+felirami@users.noreply.github.com>
---
 scripts/sync-sources.mjs | 2 ++
 src/lib/network.ts       | 1 +
 src/lib/snap-market.ts   | 2 ++
 3 files changed, 5 insertions(+)

diff --git a/scripts/sync-sources.mjs b/scripts/sync-sources.mjs
index 7dbc002..825ae52 100644
--- a/scripts/sync-sources.mjs
+++ b/scripts/sync-sources.mjs
@@ -32,6 +32,7 @@ async function fetchGithubJson(url, { optional = false } = {}) {
       "X-GitHub-Api-Version": "2022-11-28",
       ...(githubToken ? { Authorization: `Bearer ${githubToken}` } : {}),
     },
+    signal: AbortSignal.timeout(10000),
   });
 
   if ((response.status === 404 || response.status === 409) && optional) {
@@ -53,6 +54,7 @@ async function fetchGithubText(url, { optional = false } = {}) {
       "X-GitHub-Api-Version": "2022-11-28",
       ...(githubToken ? { Authorization: `Bearer ${githubToken}` } : {}),
     },
+    signal: AbortSignal.timeout(10000),
   });
 
   if ((response.status === 404 || response.status === 409) && optional) {
diff --git a/src/lib/network.ts b/src/lib/network.ts
index 049cc1e..8a390b6 100644
--- a/src/lib/network.ts
+++ b/src/lib/network.ts
@@ -85,6 +85,7 @@ export async function getNetworkStatus(): Promise<NetworkStatus> {
       headers: {
         Accept: "application/json",
       },
+      signal: AbortSignal.timeout(NODE_PROBE_TIMEOUT_MS),
     });
 
     if (!response.ok) {
diff --git a/src/lib/snap-market.ts b/src/lib/snap-market.ts
index 19b7c1a..f0d9ab8 100644
--- a/src/lib/snap-market.ts
+++ b/src/lib/snap-market.ts
@@ -1,6 +1,7 @@
 import { SNAP, correctedSnapFdv } from "@/lib/snap";
 
 export const SNAP_MARKET_REVALIDATE = 30;
+const FETCH_TIMEOUT_MS = 10_000;
 
 type DexPeriod = {
   buys?: number;
@@ -79,6 +80,7 @@ export async function getSnapMarketData(): Promise<SnapMarketResponse> {
         "user-agent": "hypersnap.org market data checker",
       },
       next: { revalidate: SNAP_MARKET_REVALIDATE },
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
     });
 
     if (!response.ok) {