Don't feed the placeholder dapp URL to the marketplace iframe - #3630
Merged
Conversation
`useAppQuery` serves a stub app as `placeholderData` while the real dapp is loading. Its `url` is `https://example.com`, which the dapp page passed straight into the iframe `src` — so the browser really fetched example.com and flashed it before the actual dapp URL arrived. The stub URL also broke `getAppUrl`: a legitimate `?url=` param was compared against the stub's origin and silently dropped as foreign. Skip the URL entirely while the query holds placeholder data, and keep the iframe unmounted (loader visible) until a real URL is available. The latter also covers the essential-dapp page, where the URL comes from config and can be undefined. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3581
Problem
useAppQueryserves a stub app (src/features/marketplace/stubs.ts) asplaceholderDatawhile the real dapp loads. That stub'surlishttps://example.com, and the dapp page passed it straight into the iframesrc— so the browser actually fetchedexample.comand flashed it before the real dapp URL arrived.The stub URL caused a second, quieter bug:
getAppUrlvalidates a user-supplied?url=param by comparing its origin against the app's. Against the stub, a legitimate?url=was treated as a foreign origin and silently stripped from the router.Changes
MarketplaceApp.tsx— passundefinedtogetAppUrlwhileisPlaceholderDatais true, so no URL is derived from stub data.MarketplaceAppIframe.tsx— keep the iframe unmounted and theContentLoadervisible until a realappUrlexists. This also covers the essential-dapp page (Swap.tsx), whereappUrlcomes from config and can legitimately beundefined.Notes for the reviewer
example.comwas never requested — it passed with this change. The test is not included in this branch; happy to add it if you'd like a permanent regression guard.playwright-ct.config.tssetstestIgnore: '.claude/worktrees/**', so a run inside one finds 0 tests. I worked around it with a throwaway config override.🤖 Generated with Claude Code