fix: resolve mutable default argument in validateFrameMessage - #556
fix: resolve mutable default argument in validateFrameMessage#556dajiaohuang wants to merge 6 commits into
Conversation
- Remove redundant else branch that was overwriting acc[type] with the same value - Fix mutable default argument by creating requestOptions object fresh each time - Properly merge user-provided hubRequestOptions with default api_key header
Create fresh requestOptions object each time to avoid shared mutable default. Properly merge user-provided hubRequestOptions with default api_key header.
Create fresh requestOptions object each time to avoid shared mutable default. Properly merge user-provided hubRequestOptions with default api_key header.
- Fix mutable default argument by using empty object as default - Add missing api_key header when using default hub URL
|
@dajiaohuang is attempting to deploy a commit to the Discove Team on Vercel. A member of the Team first needs to authorize it. |
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
| const requestHeaders = { | ||
| ...(hubRequestOptions.headers ?? {}), | ||
| api_key: DEFAULT_HUB_API_KEY, | ||
| }; | ||
|
|
||
| const requestOptions = { | ||
| ...hubRequestOptions, | ||
| headers: requestHeaders, | ||
| }; |
There was a problem hiding this comment.
getUserDataForFid unconditionally injects Neynar's public api_key header even for custom (non-Neynar) hubs, leaking the default key contrary to the intended design used elsewhere in the codebase.
| ...(hubRequestOptions.headers ?? {}), | ||
| api_key: DEFAULT_HUB_API_KEY, |
There was a problem hiding this comment.
getAddressForFid unconditionally injects Neynar's public DEFAULT_HUB_API_KEY into request headers after the caller's headers, overriding any user-supplied api_key and leaking the Neynar key to custom (non-Neynar) hubs.
| ...(hubRequestOptions.headers ?? {}), | ||
| api_key: DEFAULT_HUB_API_KEY, |
There was a problem hiding this comment.
getAddressesForFid forces api_key: DEFAULT_HUB_API_KEY after spreading user headers, overriding any caller-supplied api_key and leaking Neynar's public key to custom hubs.
| ...headers, | ||
| api_key: DEFAULT_HUB_API_KEY, |
There was a problem hiding this comment.
validateFrameMessage unconditionally sends Neynar's public api_key and overrides any user-supplied api_key header, breaking auth against custom hubs.
|
Addressed the current review feedback in the latest commit. The user-data reducer now stores the first value for each type and replaces it only when a newer timestamp is seen, so first-seen fields are no longer lost. Validation: git diff --check passed. The local checkout has no Yarn binary/dependencies, so the package test suite could not run here. |
1 participant
Summary
修复
validateFrameMessage函数中的可变默认参数问题。问题
api_keyheader 没有被添加到请求中（当使用默认 hub URL 时）Fix
hubRequestOptions默认值api_key: DEFAULT_HUB_API_KEY