fix: SSRF vulnerability and error handling bugs in wakatime and stats fetchers

src/common/error.js

@@ -17,6 +17,7 @@ const SECONDARY_ERROR_MESSAGES = {
   GRAPHQL_ERROR: TRY_AGAIN_LATER,
   GITHUB_REST_API_ERROR: TRY_AGAIN_LATER,
   WAKATIME_USER_NOT_FOUND: "Make sure you have a public WakaTime profile",
+  WAKATIME_ERROR: "Check your WakaTime configuration",
 };
 
 /**

src/fetchers/stats.js

@@ -199,7 +199,7 @@ const totalCommitsFetcher = async (username) => {
     res = await retryer(fetchTotalCommits, { login: username });
   } catch (err) {
     logger.log(err);
-    throw new Error(err);
+    throw err;
   }
 
   const totalCount = res.data.total_count;

src/fetchers/wakatime.js

@@ -3,6 +3,8 @@
 import axios from "axios";
 import { CustomError, MissingParamError } from "../common/error.js";
 
+const ALLOWED_WAKATIME_DOMAINS = ["wakatime.com", "wakapi.dev"];
+
 /**
  * WakaTime data fetcher.
  *
@@ -14,16 +16,25 @@ const fetchWakatimeStats = async ({ username, api_domain }) => {
     throw new MissingParamError(["username"]);
   }
 
+  const sanitizedDomain = api_domain
+    ? api_domain.replace(/\/$/gi, "").toLowerCase()
+    : "wakatime.com";
+
+  if (!ALLOWED_WAKATIME_DOMAINS.includes(sanitizedDomain)) {
+    throw new CustomError(
+      `Invalid api_domain. Allowed domains: ${ALLOWED_WAKATIME_DOMAINS.join(", ")}`,
+      CustomError.WAKATIME_ERROR,
+    );
+  }
+
   try {
     const { data } = await axios.get(
-      `https://${
-        api_domain ? api_domain.replace(/\/$/gi, "") : "wakatime.com"
-      }/api/v1/users/${username}/stats?is_including_today=true`,
+      `https://${sanitizedDomain}/api/v1/users/${username}/stats?is_including_today=true`,
     );
 
     return data.data;
   } catch (err) {
-    if (err.response.status < 200 || err.response.status > 299) {
+    if (err.response?.status < 200 || err.response?.status > 299) {
       throw new CustomError(
         `Could not resolve to a User with the login of '${username}'`,
         "WAKATIME_USER_NOT_FOUND",

tests/calculateRank.test.js

@@ -30,7 +30,7 @@ describe("Test calculateRank", () => {
         stars: 25,
         followers: 5,
       }),
-    ).toStrictEqual({ level: "B-", percentile: 65.02918514848255 });
+    ).toStrictEqual({ level: "B-", percentile: 65.02918514848257 });
   });
 
   it("median user gets B+ rank", () => {