fix(frontend): resolve all security and code quality issues

Author: caramel222

frontend/src/components/claims/__tests__/claims-board.property.test.ts

@@ -247,11 +247,8 @@ describe("Property 9: No authentication-dependent UI rendered without JWT", () =
             }),
           );
           const text = container.textContent ?? "";
-          const html = container.innerHTML;
           // "Needs my vote" text must be completely absent from the DOM
-          return (
-            !text.includes("Needs my vote") && !html.includes("Needs my vote")
-          );
+          return !text.includes("Needs my vote");
         },
       ),
       { numRuns: 100 },

frontend/src/lib/api/claim.ts

@@ -1,6 +1,7 @@
 import { IpfsUploadResponse } from '../types/claim';
+import { getConfig } from '@/config/env';
 
-const API_BASE_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:3001';
+const { apiUrl: API_BASE_URL } = getConfig();
 
 export interface Claim {
   id: number;
@@ -49,13 +50,13 @@ export class ClaimAPI {
     return this.handleResponse<BuildClaimTransactionResponse>(response);
   }
 
-  static async submitTransaction(transactionXdr: string): Promise<any> {
+  static async submitTransaction(transactionXdr: string): Promise<{ claimId: number; transactionHash: string }> {
     const response = await fetch(`${API_BASE_URL}/api/claims/submit`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ transactionXdr }),
     });
-    return this.handleResponse<any>(response);
+    return this.handleResponse<{ claimId: number; transactionHash: string }>(response);
   }
 
   static async getClaim(claimId: number): Promise<Claim> {

frontend/src/lib/api/support.ts

@@ -1,4 +1,6 @@
-const API_BASE_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:3000';
+import { getConfig } from '@/config/env';
+
+const { apiUrl: API_BASE_URL } = getConfig();
 
 export interface TicketPayload {
   email: string;

frontend/src/lib/hooks/useRealtimeTallies.ts

@@ -1,8 +1,23 @@
 "use client";
 
-import { useEffect, useRef, useCallback } from "react";
+import { useEffect, useRef } from "react";
+import { z } from "zod";
 import type { TallyUpdate } from "@/components/claims/types";
 
+// Schema to validate untrusted SSE / polling payloads before use
+const TallyUpdateSchema = z.object({
+  claimId: z.string(),
+  approveVotes: z.number().int().nonnegative(),
+  rejectVotes: z.number().int().nonnegative(),
+  quorumThreshold: z.number().int().positive(),
+  deadlineTimestamp: z.string(),
+})
+
+function parseTallyUpdate(raw: unknown): TallyUpdate | null {
+  const result = TallyUpdateSchema.safeParse(raw)
+  return result.success ? (result.data as TallyUpdate) : null
+}
+
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -125,9 +140,12 @@ export function useRealtimeTallies(
           throw new Error(`Polling failed: ${response.status}`);
         }
 
-        const updates: TallyUpdate[] = await response.json();
+        const updates = (await response.json() as unknown[]);
         if (!unmounted) {
-          updates.forEach((u) => onUpdateRef.current(u));
+          updates.forEach((raw) => {
+            const u = parseTallyUpdate(raw);
+            if (u) onUpdateRef.current(u);
+          });
           failureCount = 0; // reset on success
           scheduleNextPoll(false);
         }
@@ -182,8 +200,9 @@ export function useRealtimeTallies(
         eventSource.onmessage = (event: MessageEvent) => {
           if (unmounted) return;
           try {
-            const update: TallyUpdate = JSON.parse(event.data as string);
-            onUpdateRef.current(update);
+            const raw: unknown = JSON.parse(event.data as string);
+            const update = parseTallyUpdate(raw);
+            if (update) onUpdateRef.current(update);
           } catch {
             // Ignore malformed messages.
           }