Skip to content

fix: resolve assigned security issues #448, #442, #439, #431 - #560

Merged
nanaf6203-bit merged 2 commits into
MettaChain:mainfrom
danieloche635-bit:fix/assigned-security-issues
Jun 28, 2026
Merged

fix: resolve assigned security issues #448, #442, #439, #431#560
nanaf6203-bit merged 2 commits into
MettaChain:mainfrom
danieloche635-bit:fix/assigned-security-issues

Conversation

@danieloche635-bit

@danieloche635-bit danieloche635-bit commented Jun 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Changes

deviceId stored unencrypted in localStorage

  • Replaced localStorage-based device ID with per-session in-memory ID
  • Added \hashDeviceId()\ for use cases requiring persistence

Chainalysis API key exposed via window global

  • Removed \window.CHAINALYSIS_API_KEY\ from client-side code
  • Created /api/security/address-check\ proxy API route
  • API key is now read from \CHAINALYSIS_API_KEY\ env var server-side only
  • Added \checkAddressRiskViaProxy()\ for browser-side calls

chart.tsx uses dangerouslySetInnerHTML for SVG payload

  • Added DOMPurify sanitization for style tag content
  • Extracted CSS building into pure \�uildChartCSS()\ function
  • Sanitizes CSS before injecting into DOM

batchTransaction confirmation logic races simulation branches

  • Replaced \Math.random()\ simulation with real viem provider reads
  • Demo/simulation path now behind \NEXT_PUBLIC_DEMO_TX\ feature flag
  • Uses \waitForTransactionReceipt\ for production path

Closes #431
Closes #439
Closes #442
Closes #448
Closes #451
Closes #452
Closes #453
Closes #454

@sandrawillow001-afk
fix: resolve 4 assigned a11y and security issues
63798e5 
Issue MettaChain#453 (P1): PropertyCard - remove nested interactive elements
- Replace outer <Link> with <article> to fix nested-interactive violation
- Add explicit <Link> for property title and View button
- Remove stopPropagation calls (no longer needed without parent link)
- Update a11y tests to match new DOM structure

Issue MettaChain#454 (P3): ViewToggle - add accessible names
- Add aria-labels to grid/list buttons for screen-reader support
- Wrap text in <span> for icon-only rendering scenarios

Issue MettaChain#451 (P2): Share URL security
- Create centralized share URL utility with URL validation
- Sanitize display strings to constrained character set
- Use URL constructor to validate all URLs
- Integrate into ShareButton and MortgageCalculator

Issue MettaChain#452 (P2): Global listener leak prevention
- Add cleanup functions for extension event listeners
- Track console overrides for restoration on cleanup
- Create usePerformanceMonitoring hook with lifecycle management
@sandrawillow001-afk
fix: resolve assigned security issues
64ff095 
- MettaChain#448: deviceId stored unencrypted in localStorage - use per-session in-memory ID
- MettaChain#442: Chainalysis API key exposed via window global - proxy API route
- MettaChain#439: chart.tsx dangerouslySetInnerHTML - sanitize with DOMPurify
- MettaChain#431: batchTransaction confirmation races - viem provider reads + DEMO flag
@nanaf6203-bit GitHub Codespaces

nanaf6203-bit commented Jun 28, 2026

Copy link
Copy Markdown
Contributor

Comprehensive security bundle. Merging.

@nanaf6203-bit
nanaf6203-bit merged commit 7221491 into MettaChain:main Jun 28, 2026
This was referenced Jun 28, 2026
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment