Repository navigation
fix(explorer): normalize invalid account filters and scope crawl exclusions - #1450
juandolealt wants to merge 1 commit into
Conversation
👁️ Cyclops Security Review✅ Reviewed 06119bc (latest) · Coverage: partial · no open findings · report |
Bundle Size Report
Compared against main branch (baseline from 11/8/2026, 8:47:41 PM) |
Cloudflare Deployments
|
| page: z.optional(z.number()), | ||
| limit: z.optional(z.number()), | ||
| tab: z.optional(z.string()), |
There was a problem hiding this comment.
🟣 pre-existing, not blocking: pre-existing: Legacy token URLs with a malformed page, limit or tab still fail route validation, the same way ?a=444 did before this fix. Only a gets the catch fallback; page/limit use bare z.optional(z.number()) and tab uses z.optional(z.string()). Fix: wrap every optional param in this redirect-only schema with z.catch(..., undefined), as accountFilterSearchSchema does, so beforeLoad always redirects to the address page. Examples: ?page=abc stays a string and ?tab=123 becomes a number after JSON parsing.
A small fix can ride a push you are already making; otherwise a short reply is enough.
Why this was flagged
TanStack's defaultParseSearch JSON-parses query values. So /token/0x...?tab=123 gives tab the number 123, and /token/0x...?page=abc gives page the string "abc". The schema at apps/explorer/src/routes/_layout/token/$address.tsx:10-12 rejects both, and validation fails before beforeLoad can redirect. That is the HTTP 500 failure this PR fixes for a at line 13. The diff changes only a, so these sibling params on the same legacy redirect route behave as on the base branch, and crawled or hand-edited legacy links still error instead of redirecting. Nothing else guards it: there is no catch or coerce on lines 10-12, and the route renders component: () => null, so it only exists to redirect.
Verification: The trigger is a legacy token URL whose page/limit value is not valid JSON, or whose tab value parses as a non-string. In apps/explorer/src/routes/_layout/token/$address.tsx:9-14 the diff wraps only a in the catch fallback. validateSearch therefore throws before beforeLoad (lines 15-39) can issue its redirect. The base branch fails the same way, so this is pre-existing.
Changes
afilters on legacy token and address routes instead of throwing HTTP 500. TanStack parses?a=444as a number before the former string validator runs.Allow: /token/, whetherais first or later in the query string.Verification
pnpm check/pnpm check:typesstill fail on 120 missing Env-binding type errors in untouchedapps/contract-verification; reproduced in that workspace alone, with no explorer type errors.a=444,505,527,622all redirect to the normal address page and return 200; a valid address filter remains intact.Screenshots
The local preview confirms routing and the UI shell; external transfer-data panels remain loading. Production is unchanged. Google needs to recrawl after deployment.
Full Search Console audit and evidence: https://pyramid.tehq.net/threads/d6b799aa-f253-497f-b115-629462c8669c