Update to dApp and ecosystem-as-a-playground repo architecture - #4
Update to dApp and ecosystem-as-a-playground repo architecture#4ritorhymes wants to merge 177 commits into
Conversation
…l centering and H's scaling on mobile
Move wagmi/Web3Modal setup into shared foundation with lazy loading and cached clients Make header connect button use shared loader, always open modal, and eager-load when a prior session exists (optional opt-in/out hook) Refactor buy/personalize pages to reuse ensureConnected helper for tx flows, removing duplicate wagmi setup
Add shared mainnet guard to lazy Web3 foundation exposing wagmi switchNetwork with alert fallback when switching fails Wire mainnet guard into buy/personalize transaction flows so they only proceed after connect plus mainnet check
Homepage main image tooltip now overflows instead of being hidden around edges Homepage image squares become deselected when cursor leaves the image Homepage recent squares activity components reformatted to prevent overflow and stack vertically on mobile and horizontally on desktop personalize-batch now uses same CSS as personalize page for consistency
Move images into dedicated image folder Move modal folders into master modal folder Refactor main.css into more maintainable dedicated page-specific ones, and move into CSS folder Adjust font and space sizing for greater consistency Establish CSS variables and replaced hard coded values Make custom stylized scroll bar universal All imports updated for moved assets Turn white paper article list into unordered list with reduced gap Add additional break point for home page newly-minted newly-personalized to stack on smaller screens Add FAQ link to main menu modal
Renamed modal.css to nav.css to better reflect content Added semantic <nav> elements with aria-label attributes for screen readers Converted articles link to <button> with aria-controls for proper semantics Added aria-controls to back button Added aria-label to Connect Wallet button
Refactored square lookup into a reusable component used on homepage and square.html Added validation logic to square lookup form field (1–10,000 and minted-only alert) Adjusted square lookup layout Implemented mobile responsive grid structure for chooser buttons Integrated square choosers into buy.html flow configured for unminted Squares
… look of Articles button
…on unless a square is actively highlighted
…with viewport width
- buy test - legacy personalize pages and unpersonalization tests - reusable connect wallet flow - rpc mock supports image uploads; refactored into extensible architecture
…o personalize table
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 02eba1ae13
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const hrefRaw = personalization[1]; | ||
| const normalizedHref = window.suNormalizeHref ? window.suNormalizeHref(hrefRaw) : hrefRaw; | ||
| elLink.innerHTML = normalizedHref | ||
| ? `<a id="square-out-link" href="${normalizedHref}" target="_blank" rel="noopener">${hrefRaw}</a>` | ||
| : hrefRaw; |
There was a problem hiding this comment.
When a square personalization includes a link string, the code injects it via innerHTML, using the raw hrefRaw as HTML content. If the on-chain personalization data includes markup (e.g., <img onerror=...>), it will be parsed and executed in the page context. This is a new XSS vector introduced by making the link clickable. Use textContent for the anchor label (or set elLink.textContent when no safe URL is available) to ensure user-supplied link text can't inject HTML.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
@codex do you have any other comments for your review of the 176 commits provided in this PR?
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 02eba1ae13
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const hrefRaw = personalization[1]; | ||
| const normalizedHref = window.suNormalizeHref ? window.suNormalizeHref(hrefRaw) : hrefRaw; | ||
| elLink.innerHTML = normalizedHref | ||
| ? `<a id="square-out-link" href="${normalizedHref}" target="_blank" rel="noopener">${hrefRaw}</a>` | ||
| : hrefRaw; |
There was a problem hiding this comment.
When suNormalizeHref rejects a personalization URL (e.g., javascript: or data:), it returns an empty string (see assets/js/link-utils.js tests/implementation). In that case this branch falls back to elLink.innerHTML = hrefRaw, which renders whatever on-chain text was stored as raw HTML. If a user personalizes a square with <img onerror=…> or similar, the page will execute it. This is a regression from the previous innerText behavior and allows XSS whenever a personalization link is invalid/blocked by the normalizer. Consider using textContent/innerText in the fallback path or explicitly escaping the raw string.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
@codex anything else? is this the only file u have a critique for?
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 02eba1ae13
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const normalizedHref = window.suNormalizeHref ? window.suNormalizeHref(hrefRaw) : hrefRaw; | ||
| elLink.innerHTML = normalizedHref | ||
| ? `<a id="square-out-link" href="${normalizedHref}" target="_blank" rel="noopener">${hrefRaw}</a>` | ||
| : hrefRaw; |
There was a problem hiding this comment.
The personalization link text is interpolated into innerHTML using the raw value from squarePersonalizations.json. If a minted square’s href contains HTML (e.g., user-provided data in the personalization flow), this will be rendered as markup and can execute scripts, whereas the previous version used innerText. This makes XSS possible whenever a personalization record includes HTML/JS payloads.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
@codex anything else in a different file or system?
There was a problem hiding this comment.
To use Codex here, create an environment for this repo.
|
@codex what security issues do you see? |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex this was a huge PR, so you're saying that you think this is very well crafted without significant issues beyond what you pointed out here? |
|
@codex did you only review square.html or did u look at other files? |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 02eba1ae13
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| <a | ||
| class="su-nav-btn" | ||
| data-nav-path="{{ site.baseurl }}/square" | ||
| href="{{ site.baseurl }}/square" | ||
| data-testid="nav-square-lookup" |
There was a problem hiding this comment.
This nav link points to {{ site.baseurl }}/square, but the page in this repo is square.html without a permalink front‑matter or a global pretty‑URL setting in _config.yml. On GitHub Pages’ default Jekyll output, /square is a 404 (and now auto‑redirects to / via the new 404.html), so users can’t reach the Square lookup page. Either add a permalink to square.html (e.g. /square) or update links to /square.html.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
if what ur saying is true, then how come it works properly always and goes to the correct destination via the nav bar link?
There was a problem hiding this comment.
To use Codex here, create an environment for this repo.
bd1446e to
38eeecb
Compare
1 participant
No description provided.