🛡️ Sentinel: Add timeouts to fetch requests#100
Conversation
🚨 Severity: MEDIUM 💡 Vulnerability: Missing timeouts on `fetch` calls across the application (both SSR and client-side). 🎯 Impact: Hanging API requests can lead to resource exhaustion (DoS risk during build) or degraded UX and application hangs when the client encounters slow networks or unresponsive endpoints. 🔧 Fix: Added `signal: AbortSignal.timeout(10000)` to all three internal and external `fetch` calls to enforce a strict 10-second request limit. ✅ Verification: Ran `pnpm test`, `pnpm lint`, `pnpm build`, and `CI=true pnpm test:e2e` to verify no regressions in build or application logic. Co-authored-by: schmug <38227427+schmug@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Superseded by #127 (merged to main), which consolidated the best of the duplicate Bolt/Sentinel/Palette scheduled-agent PRs into one reviewed change. Closing as duplicate. |
Understood. Acknowledging that this work is now obsolete and stopping work on this task. |
1 participant
Adds a robust 10-second timeout to all
fetchrequests across the application usingAbortSignal.timeout(10000).This addresses a medium-severity security and resilience issue:
src/lib/github.ts(SSR build process), an unresponsive GitHub API could previously cause the prerendering phase to hang indefinitely.src/components/os/apps/BlogApp.tsxandsrc/hooks/useProjects.ts, client-side fetches lacked timeouts, which could freeze components or cause poor UX on slow networks.All checks (
pnpm test,pnpm lint,pnpm build, andpnpm test:e2e) are passing.PR created automatically by Jules for task 5705057277548815785 started by @schmug