(c *gin.Context)
| 11 | // resolveFallback answers a request for a non-canonical asset. `?fallback=true` redirects to the |
| 12 | // bundled placeholder; `?fallback=<http(s) url>` redirects the browser to that URL — we never fetch |
| 13 | // it (no SSRF) and it renders on its own origin, http(s) only so the Location cannot carry a |
| 14 | // javascript: or data: scheme. Anything else is a plain 404. |
| 15 | func resolveFallback(c *gin.Context, placeholder string) { |
| 16 | fallback := c.Query("fallback") |
| 17 | if fallback == "true" { |
| 18 | c.Redirect(http.StatusTemporaryRedirect, RedirectBaseURI()+placeholder) |
| 19 | c.Abort() |
| 20 | return |
| 21 | } |
| 22 | if strings.HasPrefix(fallback, "https://") || strings.HasPrefix(fallback, "http://") { |
| 23 | c.Redirect(http.StatusTemporaryRedirect, fallback) |
| 24 | c.Abort() |
| 25 | return |
| 26 | } |
| 27 | c.String(http.StatusNotFound, "Not found") |
| 28 | } |
| 29 | |
| 30 | func ServeToken(c *gin.Context) { |
| 31 | chainIDStr := c.Param("chainID") |
| 32 | tokenAddress := c.Param("tokenAddress") |
| 33 | fileName := c.Param("filename") |
| 34 | |
| 35 | if strings.HasPrefix(tokenAddress, "0x") { |
| 36 | tokenAddress = strings.ToLower(tokenAddress) |
| 37 | } |
| 38 | |
| 39 | if !ContainsSubString([]string{"logo.svg", "logo-32.png", "logo-128.png"}, fileName) { |
| 40 | if tokenAddress == "0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee" { |
| 41 | resolveFallback(c, `/_config/nodeAPI/public/gas-token.png`) |
no outgoing calls
no test coverage detected