Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: prevent PhishingController invalid API requests with -Infinity timestamp #5385

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

cryptodev-2s
Copy link
Contributor

@cryptodev-2s cryptodev-2s commented Feb 24, 2025

Explanation

This PR fixes an edge case in the PhishingController where empty phishingLists would trigger API requests with an invalid -Infinity timestamp.

When the phishingLists array is empty and #updateHotlist() is called, the code attempts to get the maximum timestamp using Math.max(...this.state.phishingLists.map(({ lastUpdated }) => lastUpdated)). With an empty array, this results in -Infinity, causing invalid API requests to /v1/diffsSince/-Infinity.

Added an early return check in #updateHotlist() when phishingLists is empty to prevent making the invalid API request.

References

Fixes #4194

Changelog

Check Changelog

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've highlighted breaking changes using the "BREAKING" category above as appropriate
  • I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes

@cryptodev-2s cryptodev-2s self-assigned this Feb 24, 2025
@cryptodev-2s cryptodev-2s requested a review from a team as a code owner February 24, 2025 15:41
@cryptodev-2s cryptodev-2s marked this pull request as draft February 24, 2025 15:42
@cryptodev-2s cryptodev-2s force-pushed the cryptodev2s/fix-phishing-controller-infinity branch from 8f9fe5a to a878d2c Compare February 24, 2025 15:46
@cryptodev-2s cryptodev-2s force-pushed the cryptodev2s/fix-phishing-controller-infinity branch from 5899fcf to de9942c Compare February 24, 2025 17:28
@cryptodev-2s cryptodev-2s marked this pull request as ready for review February 24, 2025 17:29
@cryptodev-2s cryptodev-2s requested a review from a team as a code owner February 24, 2025 17:29
let hotlistResponse: DataResultWrapper<Hotlist> | null;

try {
if (this.state.phishingLists.length === 0) {
return;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want a test for this to ensure that this doesn't cause a problem again?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

PhishingDetection Controller generating requests to API with invalid value
2 participants