Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions bun.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 6 additions & 4 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
"i18next": "^25.8.0",
"i18next-browser-languagedetector": "^8.2.0",
"jszip": "^3.10.1",
"prismjs": "^1.30.0",
"react": "^19.1.0",
"react-dom": "^19.1.0",
"react-i18next": "^16.5.4",
Expand Down Expand Up @@ -68,16 +69,17 @@
"devDependencies": {
"@biomejs/biome": "^2.3.11",
"@playwright/test": "^1.57.0",
"@testing-library/dom": "^10.4.0",
"@testing-library/jest-dom": "^6.6.3",
"@testing-library/react": "^16.2.0",
"@testing-library/user-event": "^13.5.0",
"@types/prismjs": "^1.26.6",
"@types/react": "^19.1.8",
"@types/react-dom": "^19.1.6",
"@vitejs/plugin-react": "^5.1.2",
"dotenv": "^17.2.3",
"happy-dom": "^20.1.0",
"vite": "^7.3.1",
"@testing-library/dom": "^10.4.0",
"@testing-library/jest-dom": "^6.6.3",
"@testing-library/react": "^16.2.0",
"@testing-library/user-event": "^13.5.0",
"vitest": "^4.0.14"
}
}
1 change: 1 addition & 0 deletions src/App.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ import "./styles/rainbowkit.css";
import "./styles/responsive.css";
import "./styles/ai-analysis.css";
import "./styles/rpcs.css";
import "./styles/code-highlight.css";
import "./styles/helper-tooltip.css";

import Loading from "./components/common/Loading";
Expand Down
46 changes: 46 additions & 0 deletions src/components/common/CodeBlock.tsx
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
import { useMemo } from "react";
import Prism from "prismjs";
import "prismjs/components/prism-python";
import "prismjs/components/prism-solidity";

function detectLanguage(fileName?: string): string | undefined {
if (!fileName) return undefined;
const ext = fileName.split(".").pop()?.toLowerCase();
if (ext === "sol") return "solidity";
if (ext === "vy") return "python";
if (ext === "json") return "json";
return undefined;
}

interface CodeBlockProps {
code: string;
fileName?: string;
language?: string;
}

const CodeBlock: React.FC<CodeBlockProps> = ({ code, fileName, language }) => {
const lang = language ?? detectLanguage(fileName);
const grammar = lang ? Prism.languages[lang] : undefined;

const highlighted = useMemo(() => {
if (!grammar || !lang) return null;
return Prism.highlight(code, grammar, lang);
}, [code, grammar, lang]);

if (highlighted) {
return (
<pre className="source-file-code">
{/* biome-ignore lint/security/noDangerouslySetInnerHtml: Prism.highlight output is safe — it only tokenizes source code we control */}
<code className={`language-${lang}`} dangerouslySetInnerHTML={{ __html: highlighted }} />
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Who are we trusting here?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We're trusting Prism.js (the syntax highlighter library). Prism.highlight() takes plain text, tokenizes it using grammar rules, and
returns HTML with wrappers. It HTML-escapes the input text before wrapping — so even if the source code contains

<script>alert('xss')</script>, Prism outputs <script>alert('xss')</script> wrapped in token spans. The source code itself (from

Sourcify/Etherscan) is never injected as raw HTML — only Prism's deterministic markup is.

The XSS risk with dangerouslySetInnerHTML is when you inject untrusted HTML. Prism's output is deterministic markup based on its grammar
rules — even if the source code contained <script> tags, Prism would escape them into <script> tokens. So this is a safe and standard
pattern for syntax highlighting in React.

</pre>
);
}

return (
<pre className="source-file-code">
<code>{code}</code>
</pre>
);
};

export default CodeBlock;
3 changes: 2 additions & 1 deletion src/components/pages/evm/address/shared/ContractDetails.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ import type React from "react";
import { useState } from "react";
import type { ABI } from "../../../../../types";
import { useTranslation } from "react-i18next";
import CodeBlock from "../../../../common/CodeBlock";
import FieldLabel from "../../../../common/FieldLabel";
import ContractInteraction from "./ContractInteraction";

Expand Down Expand Up @@ -201,7 +202,7 @@ const ContractDetails: React.FC<ContractDetailsProps> = ({
{sourceFiles.map((file) => (
<div key={file.path} className="source-file-container">
<div className="source-file-header">📄 {file.name || file.path}</div>
<pre className="source-file-code">{file.content}</pre>
<CodeBlock code={file.content} fileName={file.name || file.path} />
</div>
))}
</div>
Expand Down
3 changes: 2 additions & 1 deletion src/components/pages/evm/address/shared/ContractInfoCard.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ import { useState } from "react";
import { Link } from "react-router-dom";
import type { Address, ABI } from "../../../../../types";
import { useTranslation } from "react-i18next";
import CodeBlock from "../../../../common/CodeBlock";
import FieldLabel from "../../../../common/FieldLabel";
import ContractInteraction from "./ContractInteraction";
import type { VerificationSource } from "../../../../../hooks/useContractVerification";
Expand Down Expand Up @@ -357,7 +358,7 @@ const ContractInfoCard: React.FC<ContractInfoCardProps> = ({
{sourceFiles.map((file) => (
<div key={file.path} className="source-file-container">
<div className="source-file-header">📄 {file.name || file.path}</div>
<pre className="source-file-code">{file.content}</pre>
<CodeBlock code={file.content} fileName={file.name || file.path} />
</div>
))}
</div>
Expand Down
14 changes: 11 additions & 3 deletions src/hooks/useEtherscan.ts
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ interface StandardJsonSources {
function parseSourceFiles(
sourceCode: string,
contractName: string,
compilerVersion?: string,
): { name: string; path: string; content: string }[] {
if (!sourceCode) return [];

Expand All @@ -62,8 +63,9 @@ function parseSourceFiles(
}
}

// Plain Solidity source
const fileName = `${contractName || "Contract"}.sol`;
// Detect language from compiler version — Vyper compilers start with "vyper:"
const ext = compilerVersion?.toLowerCase().startsWith("vyper:") ? ".vy" : ".sol";
const fileName = `${contractName || "Contract"}${ext}`;
return [{ name: fileName, path: fileName, content: sourceCode }];
}

Expand Down Expand Up @@ -159,14 +161,20 @@ export function useEtherscan(
abi = undefined;
}

const files = parseSourceFiles(result.SourceCode, result.ContractName);
const files = parseSourceFiles(
result.SourceCode,
result.ContractName,
result.CompilerVersion,
);
const evmVersion =
result.EVMVersion && result.EVMVersion !== "Default" ? result.EVMVersion : undefined;

const isVyper = result.CompilerVersion?.toLowerCase().startsWith("vyper:");
const contractDetails: SourcifyContractDetails = {
name: result.ContractName || undefined,
compilerVersion: result.CompilerVersion || undefined,
evmVersion,
language: isVyper ? "Vyper" : "Solidity",
abi,
files,
match: "perfect",
Expand Down
59 changes: 59 additions & 0 deletions src/styles/code-highlight.css
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
/* Prism.js syntax highlighting theme for OpenScan */
.source-file-code code[class*="language-"] {
text-shadow: none;
}

.source-file-code .token.comment,
.source-file-code .token.prolog,
.source-file-code .token.doctype,
.source-file-code .token.cdata {
color: #6a9955;
}

.source-file-code .token.punctuation {
color: #d4d4d4;
}

.source-file-code .token.property,
.source-file-code .token.tag,
.source-file-code .token.boolean,
.source-file-code .token.number,
.source-file-code .token.constant,
.source-file-code .token.symbol {
color: #b5cea8;
}

.source-file-code .token.selector,
.source-file-code .token.attr-name,
.source-file-code .token.string,
.source-file-code .token.char,
.source-file-code .token.builtin {
color: #ce9178;
}

.source-file-code .token.operator,
.source-file-code .token.entity,
.source-file-code .token.url {
color: #d4d4d4;
}

.source-file-code .token.atrule,
.source-file-code .token.attr-value,
.source-file-code .token.keyword {
color: #569cd6;
}

.source-file-code .token.function,
.source-file-code .token.class-name {
color: #dcdcaa;
}

.source-file-code .token.regex,
.source-file-code .token.important,
.source-file-code .token.variable {
color: #d16969;
}

.source-file-code .token.decorator {
color: #dcdcaa;
}
Loading