From 6f696f591ce70e19240d89bbfeb977953bd15cc3 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 3 Jul 2026 21:14:41 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?=
 =?UTF-8?q?Add=20timeout=20configurations=20to=20external=20fetch=20calls?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🚨 Severity: MEDIUM
💡 Vulnerability: Missing timeout configurations on external fetch calls to GitHub API and Dexscreener API, which can lead to hanging requests and resource exhaustion.
🎯 Impact: Server connections and resources could be tied up indefinitely if external services are unresponsive, potentially leading to denial of service or degraded performance in Next.js API routes and background sync scripts.
🔧 Fix: Implemented AbortSignal.timeout(TIMEOUT_MS) across all native fetch calls making external requests to enforce explicit time limits.
✅ Verification: Ran `npm run lint`, `npm run typecheck`, and `npm run build` to confirm no compilation issues were introduced. Checked the implementation of AbortSignal in network, market, and sync modules.

Co-authored-by: felirami <6752178+felirami@users.noreply.github.com>
---
 .jules/sentinel.md       | 5 +++++
 scripts/sync-sources.mjs | 3 +++
 src/lib/network.ts       | 1 +
 src/lib/snap-market.ts   | 2 ++
 4 files changed, 11 insertions(+)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index b5d9250..26d59c4 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -12,3 +12,8 @@
 **Vulnerability:** XSS risk via unsanitized `<` characters in `JSON.stringify` output injected into `<script type="application/ld+json">`.
 **Learning:** `JSON.stringify()` does not automatically escape `<` as `\u003c`. If dynamic or unsanitized content is serialized into a `<script>` tag via `dangerouslySetInnerHTML`, an attacker can include `</script>` to break out of the context and inject malicious scripts.
 **Prevention:** Always replace `<` with `\u003c` when injecting JSON output into script tags, e.g., `JSON.stringify(data).replace(/</g, '\\u003c')`.
+
+## 2025-06-06 - Missing Timeout Configurations on External Fetch Calls
+**Vulnerability:** Resource exhaustion / Denial of Service (DoS) risk due to missing timeouts on external API fetch calls.
+**Learning:** The native `fetch` API does not implement a default timeout, meaning requests to unresponsive external servers (like GitHub API or Dexscreener) can hang indefinitely, exhausting server connections and resources in Next.js API routes or sync scripts.
+**Prevention:** Always add explicit timeouts to `fetch` requests, especially when calling external unmanaged resources. Use `AbortSignal.timeout(TIMEOUT_MS)` to enforce time limits and fail securely.
diff --git a/scripts/sync-sources.mjs b/scripts/sync-sources.mjs
index 7dbc002..e71a848 100644
--- a/scripts/sync-sources.mjs
+++ b/scripts/sync-sources.mjs
@@ -22,6 +22,7 @@ const SOURCE_REPO_ORDER = ["hypersnap", "hypersnap-docs-web", "snap", "protocol"
 
 const DOCS_LINK_LIMIT = 80;
 const README_HEADING_LIMIT = 10;
+const GITHUB_FETCH_TIMEOUT_MS = 30000;
 
 const githubToken = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
 
@@ -32,6 +33,7 @@ async function fetchGithubJson(url, { optional = false } = {}) {
       "X-GitHub-Api-Version": "2022-11-28",
       ...(githubToken ? { Authorization: `Bearer ${githubToken}` } : {}),
     },
+    signal: AbortSignal.timeout(GITHUB_FETCH_TIMEOUT_MS),
   });
 
   if ((response.status === 404 || response.status === 409) && optional) {
@@ -53,6 +55,7 @@ async function fetchGithubText(url, { optional = false } = {}) {
       "X-GitHub-Api-Version": "2022-11-28",
       ...(githubToken ? { Authorization: `Bearer ${githubToken}` } : {}),
     },
+    signal: AbortSignal.timeout(GITHUB_FETCH_TIMEOUT_MS),
   });
 
   if ((response.status === 404 || response.status === 409) && optional) {
diff --git a/src/lib/network.ts b/src/lib/network.ts
index 049cc1e..8a390b6 100644
--- a/src/lib/network.ts
+++ b/src/lib/network.ts
@@ -85,6 +85,7 @@ export async function getNetworkStatus(): Promise<NetworkStatus> {
       headers: {
         Accept: "application/json",
       },
+      signal: AbortSignal.timeout(NODE_PROBE_TIMEOUT_MS),
     });
 
     if (!response.ok) {
diff --git a/src/lib/snap-market.ts b/src/lib/snap-market.ts
index 19b7c1a..1cf6006 100644
--- a/src/lib/snap-market.ts
+++ b/src/lib/snap-market.ts
@@ -1,6 +1,7 @@
 import { SNAP, correctedSnapFdv } from "@/lib/snap";
 
 export const SNAP_MARKET_REVALIDATE = 30;
+const SNAP_MARKET_TIMEOUT_MS = 10_000;
 
 type DexPeriod = {
   buys?: number;
@@ -79,6 +80,7 @@ export async function getSnapMarketData(): Promise<SnapMarketResponse> {
         "user-agent": "hypersnap.org market data checker",
       },
       next: { revalidate: SNAP_MARKET_REVALIDATE },
+      signal: AbortSignal.timeout(SNAP_MARKET_TIMEOUT_MS),
     });
 
     if (!response.ok) {