From 8eb3fbc86ee99bfcc4a5f0ace91afda42fc068e3 Mon Sep 17 00:00:00 2001
From: mononaut <mononaut@mempool.space>
Date: Thu, 28 May 2026 05:23:08 +0000
Subject: [PATCH] add missing validation to transaction-times route

---
 backend/src/api/bitcoin/bitcoin.routes.ts | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/backend/src/api/bitcoin/bitcoin.routes.ts b/backend/src/api/bitcoin/bitcoin.routes.ts
index 9d9b5f262..b608615a8 100644
--- a/backend/src/api/bitcoin/bitcoin.routes.ts
+++ b/backend/src/api/bitcoin/bitcoin.routes.ts
@@ -28,6 +28,7 @@ const TXID_REGEX = /^[a-f0-9]{64}$/i;
 const BLOCK_HASH_REGEX = /^[a-f0-9]{64}$/i;
 const ADDRESS_REGEX = /^[a-z0-9]{2,120}$/i;
 const SCRIPT_HASH_REGEX = /^([a-f0-9]{2})+$/i;
+const MAX_TRANSACTION_TIMES = 100;
 
 class BitcoinRoutes {
   public initRoutes(app: Application) {
@@ -147,8 +148,15 @@ class BitcoinRoutes {
       handleError(req, res, 500, 'invalid txId format');
       return;
     }
+
+    const requestedTxIds = Object.values(req.query.txId);
+    if (requestedTxIds.length > MAX_TRANSACTION_TIMES) {
+      handleError(req, res, 400, 'Too many txids requested');
+      return;
+    }
+
     const txIds: string[] = [];
-    for (const txid of Object.values(req.query.txId)) {
+    for (const txid of requestedTxIds) {
       if (typeof txid === 'string' && TXID_REGEX.test(txid)) {
         txIds.push(txid);
       }