Use backend-provided NFT media type instead of a server-side HEAD request - #3647
Open
tom2drum wants to merge 2 commits into
Open
Use backend-provided NFT media type instead of a server-side HEAD request#3647tom2drum wants to merge 2 commits into
tom2drum wants to merge 2 commits into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Resolves #3210. Resolves #3626.
The backend now returns the classified media type for each token instance directly (
image_media_type/animation_media_type, valuesimage/video/html). This PR reads those fields instead of the frontend making its own server-sideHEADrequest to the NFT metadata URL to detect the type.That HEAD request lived in the
/node-api/tokens/[hash]/instances/[id]/media-typeroute, which was an unauthenticated SSRF vector (#3626): it fetched an attacker-controlled URL from NFT metadata with no host/protocol/redirect validation. The route is deleted entirely, closing the hole. The cheap client-side fallbacks are kept: themedia_typeMIME check (CDN case) and the URL-extension guess still resolve the common cases; the backend field now covers what the HEAD request used to.Environment variables
None.
Minimum API version
Core API v12.0.0+ (ships
image_media_type/animation_media_type).Breaking or incompatible changes
None. Instances on older backends without these fields fall back to the MIME/extension checks; only URLs that need content-type detection and lack a known extension stop resolving — the same URLs that drove the removed SSRF path.
Additional information
getMediaTypeis now synchronous (no network call). Visual output is unchanged, so existing Playwright snapshots stand; the two tests that mocked the deleted route now set the backend fields on the instance mock.