qa: fix /limits tokenDisplay import for #461 pre-sign chain label #1000

Merged

PlasticDigits merged 1 commit from qa/461-verify-limit-presign-import-fix into main

2026-07-01 01:11:42 +00:00

PlasticDigits commented

2026-07-01 01:03:54 +00:00

(Migrated from gitlab.com)

Summary

Verification of #461 found the core LimitOrderPreSubmitSummary chain row already merged (!989, 16d19e71), but /limits crashed at runtime because commit 16d19e71 accidentally replaced the tokenDisplay import with tradeDirectionSideLabels only. Restores fetchCW20TokenInfo, getTokenDisplaySymbol, and shortenAddress and adds a Vitest regression on /limits.

Verification checklist (#461)

Acceptance item	Result	How verified
Limit order pre-sign card shows chain label, action, pair, side, amount	PASS	`LimitOrderPreSubmitSummary.tsx` rows; Playwright on `/trade` + `/limits` after fix
Chain label from `getNetworkBadgeCopy().fullLabel`	PASS	Default prop in `LimitOrderPreSubmitSummary.tsx`; Vitest + page tests assert `LocalTerra`
Unit test asserts chain label in limit pre-sign summary	PASS	`npm run test:run -- src/components/trade/__tests__/LimitOrderPreSubmitSummary.test.tsx` (5/5)
Keplr not first chain identification	PASS	Pre-submit card visible before Place CTA on `/trade` and `/limits` (Playwright + `TradePage.test.tsx` / new `LimitOrdersPage` test)

Commands

# Component + page tests
bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- \
  src/components/trade/__tests__/LimitOrderPreSubmitSummary.test.tsx \
  src/pages/TradePage.test.tsx -t "461|pre-submit" \
  src/pages/LimitOrdersPage.test.tsx -t "461|pre-submit"

# Full /limits suite (import regression)
bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- src/pages/LimitOrdersPage.test.tsx

# Browser (LocalTerra + make dev): chain row visible before wallet
# /trade → trade-limit-pre-submit-summary-chain → LocalTerra
# /limits → select pair → limits-page-pre-submit-summary-chain → LocalTerra

Follow-ups

Consider a lightweight Playwright smoke for /limits pre-submit chain row (parity with TradePage.test.tsx) so the import regression is caught in CI browser tests too.

## Summary Verification of #461 found the core `LimitOrderPreSubmitSummary` chain row already merged (!989, 16d19e71), but `/limits` crashed at runtime because commit `16d19e71` accidentally replaced the `tokenDisplay` import with `tradeDirectionSideLabels` only. Restores `fetchCW20TokenInfo`, `getTokenDisplaySymbol`, and `shortenAddress` and adds a Vitest regression on `/limits`. ## Verification checklist (#461) | Acceptance item | Result | How verified | |-----------------|--------|--------------| | Limit order pre-sign card shows chain label, action, pair, side, amount | **PASS** | `LimitOrderPreSubmitSummary.tsx` rows; Playwright on `/trade` + `/limits` after fix | | Chain label from `getNetworkBadgeCopy().fullLabel` | **PASS** | Default prop in `LimitOrderPreSubmitSummary.tsx`; Vitest + page tests assert `LocalTerra` | | Unit test asserts chain label in limit pre-sign summary | **PASS** | `npm run test:run -- src/components/trade/__tests__/LimitOrderPreSubmitSummary.test.tsx` (5/5) | | Keplr not first chain identification | **PASS** | Pre-submit card visible before Place CTA on `/trade` and `/limits` (Playwright + `TradePage.test.tsx` / new `LimitOrdersPage` test) | ### Commands ```bash # Component + page tests bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- \ src/components/trade/__tests__/LimitOrderPreSubmitSummary.test.tsx \ src/pages/TradePage.test.tsx -t "461|pre-submit" \ src/pages/LimitOrdersPage.test.tsx -t "461|pre-submit" # Full /limits suite (import regression) bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- src/pages/LimitOrdersPage.test.tsx # Browser (LocalTerra + make dev): chain row visible before wallet # /trade → trade-limit-pre-submit-summary-chain → LocalTerra # /limits → select pair → limits-page-pre-submit-summary-chain → LocalTerra ``` ## Follow-ups - Consider a lightweight Playwright smoke for `/limits` pre-submit chain row (parity with `TradePage.test.tsx`) so the import regression is caught in CI browser tests too.

PlasticDigits commented

2026-07-01 01:05:28 +00:00

(Migrated from gitlab.com)

Security review — MR !1000

Commit reviewed: ee5f71d8ba6526f06f0ff113491ac8ec3349ba1d

Scope: Restores missing tokenDisplay import on /limits (LimitOrdersPage.tsx) and adds Vitest regression for #461 pre-submit chain label (LimitOrdersPage.test.tsx).

Method: Diff review; traced attacker-controlled inputs on re-enabled paths (fetchCW20TokenInfo, getTokenDisplaySymbol, shortenAddress) to sinks (LCD queryContract, React text rendering in LimitOrderPreSubmitSummary and related UI). Checked prior MR discussion threads (none).

Outcome: FINDINGS: 0 medium+

Summary

This MR is a runtime fix only: it re-attaches imports that were accidentally dropped in 16d19e71, which had caused /limits to crash before the pre-submit summary could render. No new logic, dependencies, or data flows are introduced.

Area	Assessment
Injection / XSS	Token labels flow through React text nodes (`SummaryRow` `{value}`, template strings). No `dangerouslySetInnerHTML`. React escaping applies.
SSRF / LCD abuse	`fetchCW20TokenInfo` → `queryContract` hits only configured `TERRA_LCD_URL` with bech32 `terra1…` addresses from factory pair metadata (not free-form user URLs). Pre-existing pattern; unchanged by this diff.
Authn / authz	Display-only import restore; no wallet, signing, or contract-mutation paths touched.
Secrets / logging	No new logging or secret handling.
Supply chain	No dependency changes.

Inline threads: None (no medium+ findings to anchor).

Prior security comments: None on this MR; nothing to re-report.

Security review: no medium+ findings on this diff.

## Security review — MR !1000 **Commit reviewed:** `ee5f71d8ba6526f06f0ff113491ac8ec3349ba1d` **Scope:** Restores missing `tokenDisplay` import on `/limits` (`LimitOrdersPage.tsx`) and adds Vitest regression for #461 pre-submit chain label (`LimitOrdersPage.test.tsx`). **Method:** Diff review; traced attacker-controlled inputs on re-enabled paths (`fetchCW20TokenInfo`, `getTokenDisplaySymbol`, `shortenAddress`) to sinks (LCD `queryContract`, React text rendering in `LimitOrderPreSubmitSummary` and related UI). Checked prior MR discussion threads (none). **Outcome:** `FINDINGS: 0` medium+ ### Summary This MR is a runtime fix only: it re-attaches imports that were accidentally dropped in `16d19e71`, which had caused `/limits` to crash before the pre-submit summary could render. No new logic, dependencies, or data flows are introduced. | Area | Assessment | |------|------------| | **Injection / XSS** | Token labels flow through React text nodes (`SummaryRow` `{value}`, template strings). No `dangerouslySetInnerHTML`. React escaping applies. | | **SSRF / LCD abuse** | `fetchCW20TokenInfo` → `queryContract` hits only configured `TERRA_LCD_URL` with bech32 `terra1…` addresses from factory pair metadata (not free-form user URLs). Pre-existing pattern; unchanged by this diff. | | **Authn / authz** | Display-only import restore; no wallet, signing, or contract-mutation paths touched. | | **Secrets / logging** | No new logging or secret handling. | | **Supply chain** | No dependency changes. | **Inline threads:** None (no medium+ findings to anchor). **Prior security comments:** None on this MR; nothing to re-report. Security review: **no medium+ findings** on this diff.

PlasticDigits commented

2026-07-01 01:11:42 +00:00

(Migrated from gitlab.com)

mentioned in commit 4f4f4de102

mentioned in commit 4f4f4de1023295e1b3fb1ed518c08e6b95ed1bad