fix: limit network info response fields

Author: NateIsern

server/index.ts

@@ -14,6 +14,7 @@ import { fileURLToPath } from 'url'
 import { blockCache } from './lib/cache'
 import { handleRouteError, parseNetwork, parseLimit, parseOffset, parseBlockOffset, parseAddress, ValidationError } from './lib/http'
 import { computeCirculatingSupply, currentBlockReward } from './lib/supply'
+import { toPublicNetworkInfo } from './lib/network-info'
 import { rpcWithNetwork } from '@fairco.in/rpc-client'
 import priceRouter from './routes/price'
 import statsHistoryRouter from './routes/stats-history'
@@ -441,7 +442,7 @@ app.get('/api/network-info', async (req, res) => {
   try {
     const network = parseNetwork(req.query.network)
     const networkInfo = await blockCache.getNetworkInfo(network)
-    res.json(networkInfo)
+    res.json(toPublicNetworkInfo(networkInfo))
   } catch (error) {
     handleRouteError(res, 'Failed to get network info', error)
   }

server/lib/network-info.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, it } from 'vitest'
+import { toPublicNetworkInfo } from './network-info'
+
+describe('toPublicNetworkInfo', () => {
+  it('returns only the public fields consumed by the frontend', () => {
+    const publicInfo = toPublicNetworkInfo({
+      version: 3000000,
+      subversion: '/FairCoin:3.0.0/',
+      protocolversion: 70015,
+      connections: 8,
+      relayfee: 0.001,
+      networks: [{ name: 'ipv4', proxy: 'socks5://10.0.0.5:9050' }],
+      localaddresses: [{ address: '203.0.113.7', port: 40404 }],
+      localrelay: true,
+      timeoffset: 0,
+      warnings: 'backend warning text',
+    })
+
+    expect(publicInfo).toEqual({
+      version: 3000000,
+      subversion: '/FairCoin:3.0.0/',
+      protocolversion: 70015,
+      connections: 8,
+      relayfee: 0.001,
+    })
+    expect(publicInfo).not.toHaveProperty('networks')
+    expect(publicInfo).not.toHaveProperty('localaddresses')
+    expect(publicInfo).not.toHaveProperty('warnings')
+  })
+
+  it('ignores malformed field values', () => {
+    expect(toPublicNetworkInfo({ version: '3000000', connections: Number.NaN })).toEqual({
+      version: undefined,
+      subversion: undefined,
+      protocolversion: undefined,
+      connections: undefined,
+      relayfee: undefined,
+    })
+  })
+})

server/lib/network-info.ts

@@ -0,0 +1,31 @@
+export interface PublicNetworkInfo {
+  version?: number
+  subversion?: string
+  protocolversion?: number
+  connections?: number
+  relayfee?: number
+}
+
+function pickNumber(value: unknown): number | undefined {
+  return typeof value === 'number' && Number.isFinite(value) ? value : undefined
+}
+
+function pickString(value: unknown): string | undefined {
+  return typeof value === 'string' ? value : undefined
+}
+
+export function toPublicNetworkInfo(networkInfo: unknown): PublicNetworkInfo {
+  if (!networkInfo || typeof networkInfo !== 'object') {
+    return {}
+  }
+
+  const info = networkInfo as Record<string, unknown>
+
+  return {
+    version: pickNumber(info.version),
+    subversion: pickString(info.subversion),
+    protocolversion: pickNumber(info.protocolversion),
+    connections: pickNumber(info.connections),
+    relayfee: pickNumber(info.relayfee),
+  }
+}