From 7817e8e550d4336b79401c4bbd3864206ac6cef8 Mon Sep 17 00:00:00 2001 From: Money Bund Date: Wed, 15 Jul 2026 09:24:43 +0800 Subject: [PATCH 1/2] security: harden CORS origin validation on faucet and index-supply --- src/pages/_api/api/index-supply.ts | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/src/pages/_api/api/index-supply.ts b/src/pages/_api/api/index-supply.ts index 2035baf9..f428570d 100644 --- a/src/pages/_api/api/index-supply.ts +++ b/src/pages/_api/api/index-supply.ts @@ -119,19 +119,26 @@ export async function OPTIONS(request: Request): Promise { return new Response(null, { status: 200, headers: cors(origin) }) } -function cors(origin: string | null): Record { +function isAllowedOrigin(origin: string): boolean { const allowedOrigins = ['https://tempo.xyz', 'https://mainnet.docs.tempo.xyz'] - - if (origin?.includes('vercel.app')) allowedOrigins.push(origin) if (process.env.NODE_ENV === 'development') allowedOrigins.push('http://localhost:5173') + if (allowedOrigins.includes(origin)) return true + + try { + const { protocol, hostname } = new URL(origin) + return protocol === 'https:' && hostname.endsWith('.vercel.app') + } catch { + return false + } +} +function cors(origin: string | null): Record { const headers: Record = { 'Access-Control-Allow-Methods': 'POST, OPTIONS', 'Access-Control-Allow-Headers': 'Content-Type, x-api-token', } - if (origin && allowedOrigins.some((allowed) => origin.startsWith(allowed))) - headers['Access-Control-Allow-Origin'] = origin + if (origin && isAllowedOrigin(origin)) headers['Access-Control-Allow-Origin'] = origin return headers } From 7ddc1b7d593147d9b724ca7909b79f893b5d90f7 Mon Sep 17 00:00:00 2001 From: Money Bund Date: Wed, 15 Jul 2026 09:25:24 +0800 Subject: [PATCH 2/2] security: harden CORS origin validation on faucet and index-supply --- src/pages/_api/api/faucet.ts | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/src/pages/_api/api/faucet.ts b/src/pages/_api/api/faucet.ts index 67056781..864060cd 100644 --- a/src/pages/_api/api/faucet.ts +++ b/src/pages/_api/api/faucet.ts @@ -53,18 +53,26 @@ async function fund(address: `0x${string}`, headers: Record): Pr } } -function cors(origin: string | null): Record { +function isAllowedOrigin(origin: string): boolean { const allowedOrigins = ['https://tempo.xyz', 'https://docs.tempo.xyz'] - - if (origin?.includes('vercel.app')) allowedOrigins.push(origin) if (process.env.NODE_ENV === 'development') allowedOrigins.push('http://localhost:5173') + if (allowedOrigins.includes(origin)) return true + + try { + const { protocol, hostname } = new URL(origin) + return protocol === 'https:' && hostname.endsWith('.vercel.app') + } catch { + return false + } +} +function cors(origin: string | null): Record { const headers: Record = { 'Access-Control-Allow-Methods': 'POST, OPTIONS', 'Access-Control-Allow-Headers': 'Content-Type, x-api-token', } - if (origin && allowedOrigins.includes(origin)) headers['Access-Control-Allow-Origin'] = origin + if (origin && isAllowedOrigin(origin)) headers['Access-Control-Allow-Origin'] = origin return headers }