fix: sanitize svg colors and secure track-user ip rate limiting

Author: riddhima25bet10005-a11y

app/api/streak/route.ts

@@ -16,6 +16,7 @@ import { getSecondsUntilUTCMidnight, getSecondsUntilMidnightInTimezone } from '@
 import type { BadgeParams } from '@/types';
 import { themes } from '@/lib/svg/themes';
 import { streakParamsSchema } from '@/lib/validations';
+import { sanitizeHexColor } from '@/lib/svg/sanitizer';
 
 const SVG_CSP_HEADER =
   "default-src 'none'; style-src 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; connect-src https://fonts.gstatic.com;";
@@ -255,15 +256,15 @@ function buildErrorResponse(error: unknown, parseResult: ParseResult): NextRespo
     message.toLowerCase().includes('validation') ||
     message.toLowerCase().includes('strictly for organizations');
 
-  const errBg = `#${(parseResult.success && parseResult.data.bg) || '0d1117'}`;
-  const errAccent = `#${
+  const errBg = `#${sanitizeHexColor((parseResult.success && parseResult.data.bg) || '0d1117')}`;
+  const errAccentRaw =
     (parseResult.success &&
       (Array.isArray(parseResult.data.accent)
         ? parseResult.data.accent[parseResult.data.accent.length - 1]
         : parseResult.data.accent)) ||
-    '58a6ff'
-  }`;
-  const errText = `#${(parseResult.success && parseResult.data.text) || 'c9d1d9'}`;
+    '58a6ff';
+  const errAccent = `#${sanitizeHexColor(errAccentRaw)}`;
+  const errText = `#${sanitizeHexColor((parseResult.success && parseResult.data.text) || 'c9d1d9')}`;
   const errRadius = parseResult.success
     ? (() => {
         const r = Number(parseResult.data.radius);

app/api/track-user/route.ts

@@ -4,8 +4,12 @@ import { User } from '@/models/User';
 import { trackUserRateLimiter } from '@/lib/rate-limit';
 
 export async function POST(req: Request) {
-  // Get IP for rate limiting
-  const ip = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip') || 'unknown';
+  // Get IP for rate limiting.
+  // x-real-ip is provided by Vercel/Nginx as the true client IP.
+  // We fall back to the LAST IP in the x-forwarded-for chain, which is appended by the Vercel proxy.
+  const forwardedFor = req.headers.get('x-forwarded-for');
+  const fallbackIp = forwardedFor ? forwardedFor.split(',').pop()?.trim() : 'unknown';
+  const ip = req.headers.get('x-real-ip') || fallbackIp || 'unknown';
 
   if (ip !== 'unknown' && !(await trackUserRateLimiter.check(ip))) {
     return NextResponse.json(