Skip to content

Conversation

@Andrew-Pohl
Copy link

@Andrew-Pohl Andrew-Pohl commented Jan 6, 2026

Summary

Fix issues with websocket URL creation.

If endpoint had an unterminated path it would strip the last element in the path and replace it with ws, it would also downgrade wss to ws if user specifies the endpoint as wss://

Rationale

Fix bug were path was overwritten if not terminated with a / . We use a url format {protocol}://{subdomain}.{domain}.{TLD}/api={key} if this is not terminated with a / it will rewrite it too {protocol}://{subdomain}.{domain}.{TLD}/ws which results in a 403 as we can't authenticate.

Also if the uses passes a websocket address wss:// it will downgrade it to unsecure ws:// which is a potential vulnerability risk

How has this been tested?

  • Current tests cover my changes
  • Added new tests
  • Manually tested the code

@vercel
Copy link

vercel bot commented Jan 6, 2026

@Andrew-Pohl is attempting to deploy a commit to the Pyth Network Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant