From c15250280f9f270f6d2882a4cb21ff07081c1c34 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 1 Oct 2026 16:49:19 +0000 Subject: [PATCH 1/2] fix: encode the paybutton id used in its detail fetch The button page built a fetch URL from the route id. Encoding that id keeps it a single path segment, so a crafted id cannot change the request target. Co-authored-by: David --- pages/button/[id].tsx | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/pages/button/[id].tsx b/pages/button/[id].tsx index d6de1c40..3dca12d6 100644 --- a/pages/button/[id].tsx +++ b/pages/button/[id].tsx @@ -38,10 +38,13 @@ export const getServerSideProps: GetServerSideProps = async (context) => { removeUnserializableFields(userProfile) + const routeId = context.params?.id + const paybuttonId = Array.isArray(routeId) ? routeId[0] ?? '' : routeId ?? '' + return { props: { userProfile, - paybuttonId: context.params?.id + paybuttonId } } } @@ -71,7 +74,8 @@ export default function PayButton (props: PaybuttonProps): React.ReactElement { } const fetchPaybutton = async (): Promise => { - const res = await fetch(`/api/paybutton/${props.paybuttonId}`, { + const paybuttonId = typeof props.paybuttonId === 'string' ? props.paybuttonId : '' + const res = await fetch(`/api/paybutton/${encodeURIComponent(paybuttonId)}`, { method: 'GET' }) let resData = await res.json() as PaybuttonWithAddresses | ResponseMessage From 332330a459e6bb0d2c30f2c9b853d0d31d6d2c3a Mon Sep 17 00:00:00 2001 From: David Date: Thu, 1 Oct 2026 10:55:14 -0700 Subject: [PATCH 2/2] Potential fix for pull request finding 'Empty paybutton ID triggers a hanging GET request' Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- pages/button/[id].tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/button/[id].tsx b/pages/button/[id].tsx index 3dca12d6..1c28853d 100644 --- a/pages/button/[id].tsx +++ b/pages/button/[id].tsx @@ -74,7 +74,7 @@ export default function PayButton (props: PaybuttonProps): React.ReactElement { } const fetchPaybutton = async (): Promise => { - const paybuttonId = typeof props.paybuttonId === 'string' ? props.paybuttonId : '' + const paybuttonId = String(props.paybuttonId) const res = await fetch(`/api/paybutton/${encodeURIComponent(paybuttonId)}`, { method: 'GET' })