@b3dotfun/sdk 0.0.62 → 0.0.63-alpha.1

package/src/global-account/react/stores/useModalStore.ts

@@ -223,6 +223,21 @@ export interface AnySpendStakeB3Props extends BaseModalProps {
   onSuccess?: () => void;
 }
 
+/**
+ * Props for the AnySpend Stake B3 (Custom Exact In) modal
+ * Handles B3 token staking operations using the custom exact in flow
+ */
+export interface AnySpendStakeB3ExactInProps extends BaseModalProps {
+  /** Modal type identifier */
+  type: "anySpendStakeB3ExactIn";
+  /** Recipient address to stake B3 for */
+  recipientAddress: string;
+  /** Stake amount */
+  stakeAmount?: string;
+  /** Callback function called when the stake is successful */
+  onSuccess?: () => void;
+}
+
 /**
  * Props for the AnySpend Stake Contract modal
  * Handles token staking operations to a given contract
@@ -244,6 +259,23 @@ export interface AnySpendStakeUpsideProps extends BaseModalProps {
   onSuccess?: () => void;
 }
 
+/**
+ * Props for the AnySpend Stake Upside (Exact In) modal
+ * Handles token staking operations using the custom exact in flow
+ */
+export interface AnySpendStakeUpsideExactInProps extends BaseModalProps {
+  /** Modal type identifier */
+  type: "anySpendStakeUpsideExactIn";
+  /** Recipient address to stake tokens for */
+  recipientAddress: string;
+  /** Staking contract address */
+  stakingContractAddress: string;
+  /** Token to stake */
+  token: components["schemas"]["Token"];
+  /** Callback function called when the stake is successful */
+  onSuccess?: () => void;
+}
+
 /**
  * Props for the AnySpend Buy Spin modal
  * Handles spin wheel entry purchases
@@ -341,6 +373,13 @@ export interface AvatarEditorModalProps extends BaseModalProps {
   onSuccess?: () => void;
 }
 
+export interface ProfileEditorModalProps extends BaseModalProps {
+  /** Modal type identifier */
+  type: "profileEditor";
+  /** Callback function called when profile is successfully updated */
+  onSuccess?: () => void;
+}
+
 /**
  * Union type of all possible modal content types
  */
@@ -355,13 +394,16 @@ export type ModalContentType =
   | AnySpendFundTournamentProps
   | AnySpendOrderHistoryProps
   | AnySpendStakeB3Props
+  | AnySpendStakeB3ExactInProps
   | AnySpendStakeUpsideProps
+  | AnySpendStakeUpsideExactInProps
   | AnySpendBuySpinProps
   | AnySpendSignatureMintProps
   | AnySpendBondKitProps
   | LinkAccountModalProps
   | AnySpendDepositHypeProps
-  | AvatarEditorModalProps;
+  | AvatarEditorModalProps
+  | ProfileEditorModalProps;
 // Add other modal types here like: | OtherModalProps | AnotherModalProps
 
 /**

package/src/global-account/react/utils/profileDisplay.ts

@@ -1,5 +1,68 @@
+import { debugB3React } from "@b3dotfun/sdk/shared/utils/debug";
 import { type Profile } from "thirdweb/wallets";
 
+const debug = debugB3React("profileDisplay");
+
+/**
+ * Validates that an image URL uses an allowed schema
+ * @param url - The URL to validate
+ * @returns The URL if valid, null otherwise
+ */
+export function validateImageUrl(url: string | null | undefined): string | null {
+  if (!url) return null;
+
+  try {
+    // For blob URLs (from createObjectURL)
+    if (url.startsWith("blob:")) {
+      return url;
+    }
+
+    // For IPFS protocol URLs
+    if (url.startsWith("ipfs://")) {
+      return url;
+    }
+
+    // Parse URL to validate protocol and hostname
+    const parsedUrl = new URL(url);
+
+    // Only allow http and https protocols
+    if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+      debug("Rejected unsafe protocol:", parsedUrl.protocol, url);
+      return null;
+    }
+
+    // Whitelist of allowed IPFS gateway hostnames
+    const allowedIpfsGateways = [
+      "ipfs.io",
+      "gateway.pinata.cloud",
+      "cloudflare-ipfs.com",
+      "dweb.link",
+      "nftstorage.link",
+      "w3s.link",
+    ];
+
+    // Check if hostname matches allowed IPFS gateways
+    const hostname = parsedUrl.hostname.toLowerCase();
+    const isAllowedIpfsGateway = allowedIpfsGateways.some(gateway => {
+      // Exact match or subdomain of the gateway
+      return hostname === gateway || hostname.endsWith(`.${gateway}`);
+    });
+
+    if (isAllowedIpfsGateway) {
+      return url;
+    }
+
+    // For standard HTTP(S) URLs from trusted sources
+    // Add additional hostname validation here if needed
+    // For now, allow all HTTP(S) URLs (can be restricted further if needed)
+    return url;
+  } catch (error) {
+    // Invalid URL format
+    debug("Invalid image URL format:", url, error);
+    return null;
+  }
+}
+
 export interface ExtendedProfileDetails {
   id?: string;
   email?: string;
@@ -40,7 +103,7 @@ export function getProfileDisplayInfo(profile: ExtendedProfile): ProfileDisplayI
       displayInfo = {
         title: details.name || details.username || "Unknown",
         subtitle: details.username ? `@${details.username}` : "X Account",
-        imageUrl: details.profileImageUrl || null,
+        imageUrl: validateImageUrl(details.profileImageUrl),
         initial: "X",
         type,
       };
@@ -49,7 +112,7 @@ export function getProfileDisplayInfo(profile: ExtendedProfile): ProfileDisplayI
       displayInfo = {
         title: details.name || details.username || "Unknown",
         subtitle: details.username ? `@${details.username}` : "Farcaster Account",
-        imageUrl: details.profileImageUrl || null,
+        imageUrl: validateImageUrl(details.profileImageUrl),
         initial: "F",
         type,
       };
@@ -58,7 +121,7 @@ export function getProfileDisplayInfo(profile: ExtendedProfile): ProfileDisplayI
       displayInfo = {
         title: details.name || details.email || "Unknown",
         subtitle: details.email || "Google Account",
-        imageUrl: details.profileImageUrl || null,
+        imageUrl: validateImageUrl(details.profileImageUrl),
         initial: "G",
         type,
       };
@@ -67,7 +130,7 @@ export function getProfileDisplayInfo(profile: ExtendedProfile): ProfileDisplayI
       displayInfo = {
         title: details.username || details.name || "Unknown",
         subtitle: "Discord Account",
-        imageUrl: details.profileImageUrl || null,
+        imageUrl: validateImageUrl(details.profileImageUrl),
         initial: "D",
         type,
       };