feat: add zod validation to internal and external endpoints by ECWireless · Pull Request #612 · livepeer/explorer

ECWireless · 2026-03-31T02:30:22Z

See #521 for all details. Original PR created by @Roaring30s .

vercel · 2026-03-31T02:30:27Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
explorer-arbitrum-one	Ready	Preview	Oct 6, 2026 10:55pm UTC

Copilot

Pull request overview

This PR introduces centralized Zod schemas and validation helpers, then applies them across multiple Next.js API routes to harden user-input handling and upstream-response parsing.

Changes:

Added reusable Zod schema modules under lib/api/schemas/* plus shared validation helpers in lib/api/errors.ts.
Updated a broad set of API routes to validate request inputs, external API responses, and/or endpoint outputs before returning JSON.
Added a new /api/totalTokenSupply endpoint backed by a subgraph query with response validation.

Reviewed changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
pages/api/usage.tsx	Uses centralized usage schemas and validates output; adds guardrails for insufficient data.
pages/api/upload-ipfs.tsx	Validates POST body and Pinata response; validates output shape.
pages/api/treasury/votes/[address]/registered.tsx	Validates address input and response output for registered-to-vote.
pages/api/treasury/votes/[address]/index.tsx	Validates address input and voting power output.
pages/api/treasury/proposal/[proposalId]/votes/[address].tsx	Validates proposalId/address inputs and voting-power output.
pages/api/treasury/proposal/[proposalId]/state.tsx	Validates proposalId input and proposal-state output.
pages/api/totalTokenSupply.tsx	New endpoint querying subgraph totalSupply with schema validation.
pages/api/score/index.tsx	Validates query params and upstream responses; adds output validation.
pages/api/score/[address].tsx	Validates address input, upstream responses, and performance-metrics output.
pages/api/regions/index.ts	Validates upstream regions payloads and validates merged output.
pages/api/pipelines/index.tsx	Validates `region` query param and upstream pipelines payload.
pages/api/pending-stake/[address].tsx	Validates address input and pending-stake output.
pages/api/l1-delegator/[address].tsx	Validates address input and L1 delegator output.
pages/api/generateProof.tsx	Validates POST body and proof output.
pages/api/ens-data/index.tsx	Validates subgraph response + addresses and validates ENS identities output.
pages/api/ens-data/image/[name].tsx	Validates ENS name and avatar result; adds URL validation before fetch.
pages/api/ens-data/[address].tsx	Validates address input (including blacklist) and ENS identity output.
pages/api/current-round.tsx	Validates subgraph result and current-round output.
pages/api/contracts.tsx	Validates contracts-info output shape.
pages/api/changefeed.tsx	Validates GraphQL envelope and changefeed response output.
pages/api/account-balance/[address].tsx	Validates address input and account-balance output.
lib/api/schemas/usage.ts	New Zod schemas for `/api/usage` input/output structures.
lib/api/schemas/upload-ipfs.ts	New Zod schemas for IPFS upload input + Pinata response + output.
lib/api/schemas/treasury.ts	New Zod schemas for treasury proposal/voting responses.
lib/api/schemas/total-token-supply.ts	New Zod schemas for total supply subgraph response and output.
lib/api/schemas/subgraph.ts	New Zod schemas for common subgraph envelopes and specific queries.
lib/api/schemas/staking.ts	New Zod schemas for staking-related endpoint outputs.
lib/api/schemas/performance.ts	New Zod schemas for metrics/score-related endpoints.
lib/api/schemas/index.ts	Central barrel export for the new schema modules.
lib/api/schemas/generate-proof.ts	New Zod schemas for generateProof input/output.
lib/api/schemas/ens.ts	New Zod schemas for ENS identity/name/address and provider responses.
lib/api/schemas/current-round.ts	New Zod schema for current-round endpoint output.
lib/api/schemas/contracts.ts	New Zod schema for contracts endpoint output.
lib/api/schemas/common.ts	New shared primitives (Address, URL, handles, regions, etc.).
lib/api/schemas/changefeed.ts	New Zod schemas for changefeed GraphQL/envelope response validation.
lib/api/errors.ts	Adds `validateInput`, `validateOutput`, `validateExternalResponse` helpers.
lib/api/ens.ts	Validates ENS resolver/provider results with graceful fallbacks.
.gitignore	Ignores `*.tsbuildinfo`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

… (#521) * feat: add account-balance zod validation * feat: add ens name validation * feat: add score and pending stake validation * feat: add ens-data image validation * feat: add ens-data index validation * feat: add pipelines validation * feat: add regions validation * feat: add treasury proposal state validation * feat: add proposal vote by address validation * feat: add treasury votes validation * feat: add score validation * feat: add changefeed validation * feat: add contract validation * feat: add current-round validation * feat: add generateProof validation * feat: add totalTokenSupply validation * feat: add upload ipfs validation * refactor: refactor usage validation * feat: add external validation for ens image * refactor: refactor ens schema * feat: add external checks for score endpoint * fix: add guard for projectBySlugs * refactor: refactor schemas * feat: add defense checks to usage endpoint * feat: add getEnsForAddress validation --------- Co-authored-by: ECWireless <40322776+ECWireless@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

Production output validation is bypassed, and several input schemas still permit malformed or injectable values.

Review effort: Balanced
Findings: 2 · 3

Open (5)

Encode regional query values to prevent parameter injection · New
Encode pipeline values to prevent query injection · New
Enforce output validation errors in every environment · New
Reject empty regional records before averaging · New
Validate commit hashes as 40-character hexadecimal strings · New

Copilot

Copilot review overview

🔵 Needs a closer look

Production output validation is ineffective, and several input and upstream-validation edge cases remain unresolved.

Review effort: Balanced
Findings: 2

Open (2)

Reject empty regional records before averaging
Enforce output validation errors in every environment

Resolved since last review (3)

Encode pipeline values to prevent query injection
Encode regional query values to prevent parameter injection
Validate commit hashes as 40-character hexadecimal strings

Previously missed (5)

In code that hasn't changed since last review

ENS schema accepts malformed names before normalization

lib/api/schemas/ens.ts:56

This schema accepts any non-empty string, including malformed ENS names such as values containing spaces. Those inputs pass validateInput, then normalize() throws and the route returns 404 instead of the intended 400. Incorporate ENS normalization into the schema (and apply the blacklist to the normalized name) so malformed names are rejected before the fetch path.

Proposal ID schema allows values beyond uint256

lib/api/schemas/treasury.ts:14

The numeric regex accepts values larger than uint256, but both callers immediately ABI-encode the result as a proposal ID. A value of 2^256 or greater therefore passes input validation and fails later as a 500 instead of a 400. Add the ABI range check to this shared schema.

Payload limit counts UTF-16 units instead of UTF-8 bytes

lib/api/schemas/upload-ipfs.ts:11

z.string().max(500000) limits UTF-16 code units, not payload bytes, so this does not enforce the documented 500KB abuse limit. For example, 200,000 emoji pass this check at 400,000 code units but occupy 800,000 UTF-8 bytes. Enforce the UTF-8 byte length (and use a body-parser limit if the limit is intended for the entire JSON request).

Unvalidated upstream project data causes incorrect responses

pages/api/changefeed.tsx:80

projectBySlugs is still data supplied by changefeed.app, but it is passed to validateOutput. Consequently a malformed upstream payload becomes a 500 in development and is returned with 200 in production. Validate it with validateExternalResponse and return externalApiError (502) on failure, consistent with the other external-service endpoints.

Case-sensitive address comparison reports zero price

pages/api/score/index.tsx:177

The metrics record key may be a valid checksummed address, but only the pricing address is lowercased here. In that case the same address does not match and this endpoint reports pricePerPixel: 0. Compare both sides case-insensitively, as the single-address endpoint already does.

rickstaa · 2026-10-15T13:56:18Z

@@ -0,0 +1,31 @@
+import { z } from "zod";
+
+const ChangeSchema = z.object({


@ECWireless changefeed has been broken for a long time now https://explorer.livepeer.org/whats-new. I think its best to remove it and ask @mehrdadmms on what the best place to link to is. I expect https://livepeer.org/changelog. I asked @mehrdadmms to review #838. This would mean this file can go from this pr.

rickstaa · 2026-10-15T15:50:36Z

        data.dayData = data.dayData.slice(0, -1);
      }

+      if (validateOutput(UsageOutputSchema.safeParse(data), res, "usage")) {


@ECWireless this file can be removed since its no longer used in https://github.com/livepeer/explorer/pull/825/changes. We are not planing to bring it back.

rickstaa · 2026-10-15T15:53:26Z

        currentL2Block: Number(currentL2Block),
      };

+      const validationResult = CurrentRoundInfoSchema.safeParse(roundInfo);


@ECWireless This output is built by us from typed values, so validating it can't fail and can be removed.

rickstaa · 2026-10-15T15:53:38Z

+      const validationResult = ContractInfoSchema.safeParse(contractsInfo);
+      if (validateOutput(validationResult, res, "contracts")) {
+        return;
+      }


@ECWireless This output is built by us from typed values, so validating it can't fail and can be removed.

rickstaa

@ECWireless Thanks for this. It's a big PR, so I'd trim it to where zod actually protects something.

Keep zod where data crosses a trust boundary:

user input (address and id params, generateProof, upload-ipfs body)
third-party responses (Pinata, subgraph, metrics and pricing servers, ENS records)

Remove output validation on responses we build ourselves from typed values (current-round, contracts, account-balance, l1-delegator, pending-stake, treasury routes, generateProof, upload-ipfs, usage). It can't fail there, and validateOutput only errors in development anyway.

Also:

Drop changefeed (removed in #838) and these unused schemas: OptionalStringSchema, EnsAvatarResultSchema, EnsAvatarProviderSchema, SubgraphResponseSchema, CurrentRoundSubgraphResultSchema, TreasuryProposalStateSchema, TreasuryVoteSchema.
usage can go too unless the chart is coming back soon (hidden in #825).
Once trimmed, consider one schema file per route (pending-stake.ts, generate-proof.ts, ...) with common.ts for shared primitives only, all exported from index.ts and imported only from @lib/api/schemas.

rickstaa · 2026-10-15T16:01:08Z

+            errorText,
+            `URL: ${url}`
+          );
+          return externalApiError(


I think this makes sense, is this change from {pipelines: []} handled correctly by the front-end.

rickstaa · 2026-10-15T16:02:23Z

+      }
+
+      const transcodersWithPrice = validateExternalResponse(
+        PriceResponseSchema.safeParse(await response.json()),


@ECWireless right now it requires every row, we could filter invalid rows instead like in regions.

rickstaa · 2026-10-15T16:03:05Z

 import { DEFAULT_CHAIN_ID, NETWORK_RPC_URLS } from "lib/chains";
 import numbro from "numbro";

+export { sanitizeExternalUrl } from "./sanitizeExternalUrl";


@ECWireless why was this moved outside into its own file?

Copilot AI review requested due to automatic review settings March 31, 2026 02:30

github-project-automation Bot added this to Engineering Roadmap Mar 31, 2026

github-project-automation Bot moved this to Triage in Engineering Roadmap Mar 31, 2026

Copilot started reviewing on behalf of ECWireless March 31, 2026 02:30

View session

vercel Bot deployed to Preview March 31, 2026 02:31

View deployment

Copilot AI reviewed Mar 31, 2026

View reviewed changes

vercel Bot reviewed Mar 31, 2026

View reviewed changes

Comment thread pages/api/score/[address].tsx Outdated

vercel Bot deployed to Preview March 31, 2026 03:28

View deployment

vercel Bot reviewed Mar 31, 2026

View reviewed changes

Comment thread lib/api/schemas/treasury.ts Outdated

ECWireless requested a review from rickstaa March 31, 2026 13:15

vercel Bot deployed to Preview March 31, 2026 13:18

View deployment

rickstaa force-pushed the feat/add-zod-validation-to-internal-and-external-endpoints branch from 5496d80 to b1af7db Compare April 30, 2026 12:18

vercel Bot deployed to Preview April 30, 2026 12:20

View deployment

ECWireless and others added 6 commits May 6, 2026 12:59

temp: add dummy total token supply endpoint

7744b5f

fix: remove redundant validation

3745786

fix: remove unused files

0649437

fix: address copilot comments

9ca3540

fix: use AddressSchema rather than regex

eb365e9

rickstaa force-pushed the feat/add-zod-validation-to-internal-and-external-endpoints branch from b1af7db to eb365e9 Compare May 6, 2026 10:59

vercel Bot deployed to Preview May 6, 2026 11:02

View deployment

rickstaa linked an issue Jun 16, 2026 that may be closed by this pull request

Add zod validation in more places #434

Open

Merge main and resolve API validation conflicts

95ea295

Copilot AI balanced review requested due to automatic review settings October 6, 2026 22:38

Copilot started reviewing on behalf of ECWireless October 6, 2026 22:39

View session

vercel Bot deployed to Preview October 6, 2026 22:39

View deployment

Copilot AI reviewed Oct 6, 2026

View reviewed changes

Comment thread pages/api/pipelines/index.tsx Outdated

Comment thread pages/api/score/index.tsx Outdated

Comment thread lib/api/errors.ts Outdated

Comment thread lib/api/schemas/performance.ts

Comment thread lib/api/schemas/upload-ipfs.ts Outdated

fix: address API validation review findings

ea9088d

Copilot AI balanced review requested due to automatic review settings October 6, 2026 22:54

Copilot started reviewing on behalf of ECWireless October 6, 2026 22:55

View session

vercel Bot deployed to Preview October 6, 2026 22:55

View deployment

Copilot AI reviewed Oct 6, 2026

View reviewed changes

rickstaa reviewed Oct 15, 2026

View reviewed changes

rickstaa requested changes Oct 15, 2026

View reviewed changes

rickstaa reviewed Oct 15, 2026

View reviewed changes

		@@ -0,0 +1,31 @@
		import { z } from "zod";

		const ChangeSchema = z.object({

Conversation

ECWireless commented Mar 31, 2026

Uh oh!

vercel Bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

rickstaa Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

rickstaa Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

rickstaa Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

rickstaa Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

rickstaa left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rickstaa Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

rickstaa Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

rickstaa Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

vercel Bot commented Mar 31, 2026 •

edited

Loading

rickstaa left a comment •

edited

Loading