Resolve Open Proxy, XSS Vectors, and Implement API Rate Limiting in onchainsummer.xyz

[Sahveli01]

Description

This pull request addresses findings F-05, F-06, and F-11 from the workspace security audit targeting the onchainsummer.xyz reservoir API proxy. The route previously functioned as an open proxy exposing the deployment's API keys when unconfigured, allowed XSS payloads through improper content-type handling, and suffered from missing rate limits. These vectors have been comprehensively closed.

Key Changes & Remediations

1. Open Proxy & Origin Validation (F-05) (src/app/api/reservoir/[...slug]/route.ts)

• Strict Origin Matching: Removed the flawed Regex host parser that could be easily bypassed by domain manipulations. The logic now strictly extracts and matches origins using the WHATWG URL parser.
• Fail-Closed Configuration: If ALLOWED_API_DOMAINS is not defined, the proxy now gracefully defaults to same-origin behavior instead of failing open to the entire internet.

2. XSS & Binary Corruption Mitigation (F-06) (src/app/api/reservoir/[...slug]/route.ts)

• Strict MIME Handling: The proxy previously served all image/* upstream responses with a text/html header, effectively turning any upstream binary payload into a stored XSS vector on the local origin. It now correctly passes through upstream MIME types strictly checked against a safe PASSTHROUGH_MEDIA_TYPES allowlist while enforcing the nosniff header.
• Binary Integrity: Switched response.text() resolution to response.arrayBuffer() to ensure binary image bodies are no longer corrupted by UTF-8 string conversions during transit.
• Error Masking: Suppressed verbatim upstream error messages. Instead of returning raw upstream exception strings to the client, the proxy now securely logs details server-side and responds with a generic 502 Bad Gateway to prevent intelligence leakage.

3. API Rate Limiting (F-11) (src/utils/apiRateLimit.ts)

• Abuse Protection: Introduced an in-memory sliding-window rate limiter for the proxy bridge, capping requests to 120 per minute per client key.
• Memory Exhaustion Safeguard: Capped the underlying tracking Map to 5,000 clients, safely deferring key pruning logic into an independent step that adheres strictly to ES5 non-mutative Map iteration constraints.

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1