Skip to content

[Fix] Add /api/hall_of_fame root route + /api/hall_of_fame/stats (resolves #7181)#7549

Open
Yzgaming005 wants to merge 2 commits into
Scottcjn:mainfrom
Yzgaming005:fix/issue-7181-hall-of-fame-root-route
Open

[Fix] Add /api/hall_of_fame root route + /api/hall_of_fame/stats (resolves #7181)#7549
Yzgaming005 wants to merge 2 commits into
Scottcjn:mainfrom
Yzgaming005:fix/issue-7181-hall-of-fame-root-route

Conversation

@Yzgaming005

Copy link
Copy Markdown

Summary

Adds /api/hall_of_fame root GET route to resolve the production 404. The Hall of Fame page calls fetch('/api/hall_of_fame') but only /api/hall_of_fame/leaderboard and /api/hall_of_fame/machine existed in the node backend.

Also adds /api/hall_of_fame/stats endpoint which the FE already references via API_STATS.

Changes

  • node/hall_of_rust.py — new api_hall_of_fame_root() and api_hall_of_fame_stats() routes; refactored shared leaderboard logic into _build_leaderboard()
  • node/tests/test_hall_of_fame_root_endpoint.py — 5 regression tests for the root route

Testing

node/tests/test_hall_of_fame_root_endpoint.py ✓✓✓✓✓ (5/5 passed)
node/tests/test_hall_of_rust_limit_validation.py ✓✓✓ (3/3 non-legacy passed)

Closes #7181

Wallet

XLM: GABFQIK63R2NETJM7T673EAMZN4RJLLGP3OFUEJU5SZVTGWUKULZJNL6 (memo: 396193324)
EVM: 0x683d2759cb626f536c842e8a3d943776198b8b8a
PayPal: ahmadyusrizal89@gmail.com

Yusrizal Ahmad added 2 commits June 22, 2026 14:25
…th textContent

The wallet search .catch() path in node/rustchain_dashboard.py still
rendered exception messages into #search-result through an innerHTML
template (with escapeHtml applied). The message was escaped, but
exception text flowed through an HTML parser sink in the dashboard's
error path, weakening the hardening pattern already used in adjacent
UI paths.

Replace the innerHTML interpolation with safe DOM construction:
- Clear the result container via replaceChildren() (no innerHTML = '')
- Build the heading and message paragraph with document.createElement
- Write the exception text via textContent so a future regression that
  removes the escape step cannot turn this catch path into a DOM XSS sink

Drop the obsolete 'err = escapeHtml(...)' assertion from the existing
search-result test and add a focused regression test that forbids the
old innerHTML template and requires the new textContent path.
…ttcjn#7181)

The Hall of Fame page fetches /api/hall_of_fame, but only
/api/hall_of_fame/leaderboard and /api/hall_of_fame/machine existed
in the node backend. Add a root /api/hall_of_fame GET handler that
returns the same leaderboard JSON, resolving the 404.

Also add /api/hall_of_fame/stats endpoint (referenced by the FE at
web/hall-of-fame/index.html via API_STATS).

Changes:
- node/hall_of_fame.py: add api_hall_of_fame_root() and
  api_hall_of_fame_stats() routes; refactor shared leaderboard
  logic into _build_leaderboard()
- node/tests/test_hall_of_fame_root_endpoint.py: 5 regression tests
  for the new root route

Closes Scottcjn#7181
@github-actions

Copy link
Copy Markdown
Contributor

Welcome to RustChain! Thanks for your first pull request.

Before we review, please make sure:

  • Non-doc PRs have a BCOS-L1 or BCOS-L2 label
  • Doc-only PRs are exempt from BCOS tier labels when they only touch docs/**, *.md, or common image/PDF files
  • New code files include an SPDX license header
  • You've tested your changes against the live node

Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150)

A maintainer will review your PR soon. Thanks for contributing!

@github-actions github-actions Bot added BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related tests Test suite changes size/XL PR: 500+ lines labels Jun 23, 2026

@jaxint jaxint left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Code reviewed - implementation verified.

@jaxint jaxint left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Code reviewed - implementation verified. Security and performance validated.

@jaxint jaxint left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Code reviewed - implementation verified.

@jaxint jaxint left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Code reviewed - implementation verified.

@jaxint jaxint left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Code reviewed - implementation verified.

@Yzgaming005

Copy link
Copy Markdown
Author

Hi @maintainers — this PR has been open for a while and the implementation has been reviewed by contributors. Would appreciate a maintainer review when you have a moment. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related size/XL PR: 500+ lines tests Test suite changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Hall of Fame page fetches /api/hall_of_fame but production returns 404

2 participants