Repository navigation
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
[refactor] add Sign In pages for multiple OAuth platforms #36
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Uh oh!
There was an error while loading. Please reload this page.
[refactor] add Sign In pages for multiple OAuth platforms #36
Changes from 2 commits
28c643c6239405d29291562be8eec82a7000dca77bea3060dab2b4a6ea6e668c9192b082aab6239f00619fb830f9997ad8e3d15904b994e0d3508e03e04487File filter
Filter by extension
Conversations
Uh oh!
There was an error while loading. Please reload this page.
Jump to
Uh oh!
There was an error while loading. Please reload this page.
There are no files selected for viewing
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done in commit 0dca77b:
export { Award, AwardAssignment, AwardTarget }frommodels/Activity/Award.ts— all consumers now import directly from@freecodecamp-chengdu/hop-servicemodels/Activity/Question.tshop-servicechanged toimport typesince the package is type-onlyAwardTarget.Teamreplaced with the concrete string'team'inevaluation.tsxQuestionType.Text/QuestionType.URLreplaced with'text' as QuestionType/'url' as QuestionTypeThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 5175
🏁 Script executed:
# Check the register.tsx file to see if enrollmentOf is called before signOne head -100 pages/activity/[name]/register.tsxRepository: FreeCodeCamp-Chengdu/HOP
Length of output: 2698
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 1936
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 1242
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 924
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 1622
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 50
The POST enrollment response is discarded and may return
undefinedin some call paths.signOnediscards the POST response and callscurrentEnrollment?.getSessionOne()instead. Two issues:Silent failure in register.tsx: The page's server-side
getOne()is called on a localActivityModelinstance, not the globalactivityStore. When the client callssignOne(),currentEnrollmentisundefinedon the global store, so the return silently fails. TheenrollmentOf()method only creates a new model without fetching data.Wasteful redundant fetch: The POST response is discarded and a separate GET request is made via
getSessionOne(). This is wasteful and potentially racy depending on backend semantics.The
index.tsxpage is safer (callsenrollmentOf()beforesignOne()), but still depends ongetSessionOne()being called elsewhere to populatesessionOne. Confirm the POST enrollment endpoint already returns the new enrollment data, and either return it directly or defer the GET until actually needed.🤖 Prompt for AI Agents
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
UserActivityModelinheritsrestore(this, 'Activity')— all instances share the same localStorage key as the singletonActivityModelline 37 definesrestored = !isServer() && restore(this, 'Activity')as a class field initializer. BecauseUserActivityModelcallssuper(), that initializer runs for every instance, binding each one to the same'Activity'localStorage key used by theexport default new ActivityModel()singleton (line 185).Consequences:
UserActivityModel.loadPagestores its paginated result,mobx-restful'srestorereaction writes to'Activity', overwriting the singleton's cache.restorereload (e.g., navigation back to the main activity list) may re-hydrate with the stale user-filtered list.UserActivityModelinstances (enrollee / creator / staff) overwrite each other on the same key.Override
restoredin the subclass to opt out of persistence:🛡️ Proposed fix
export class UserActivityModel extends ActivityModel { + override restored = false as const; + constructor( public userId: number, public role: 'creator' | 'staff' | 'enrollee', ) {🤖 Prompt for AI Agents
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sanitize
detailHTML before rendering to prevent XSS.detailis injected verbatim into the DOM viadangerouslySetInnerHTML. If this field is admin- or user-authored (rich-text editor output from the API), any embedded<script>, inline event handlers, orjavascript:URIs will execute in the viewer's browser. The static analysis tool (CWE-79) flagged this as an unsanitized injection.Additionally,
detailmay beundefinedfor hackathons that haven't populated this field, which should be guarded against.The recommended fix is to sanitize on the client with DOMPurify:
🛡️ Proposed fix
Install DOMPurify:
Apply at the callsite:
Note: DOMPurify requires a DOM environment, so you must guard with
isServer()(already imported) or use theSSRbuild (dompurify/dist/purify.cjswith a JSDOMwindowshim). Alternatively, sanitize the HTML on the server before returning it fromgetServerSidePropsusingsanitize-htmlorDOMPurifywith JSDOM.🧰 Tools
🪛 ast-grep (0.42.1)
[warning] 280-280: Usage of dangerouslySetInnerHTML detected. This bypasses React's built-in XSS protection. Always sanitize HTML content using libraries like DOMPurify before injecting it into the DOM to prevent XSS attacks.
Context: dangerouslySetInnerHTML
Note: [CWE-79] Improper Neutralization of Input During Web Page Generation [REFERENCES]
- https://reactjs.org/docs/dom-elements.html#dangerouslysetinnerhtml
- https://cwe.mitre.org/data/definitions/79.html
(react-unsafe-html-injection)
🤖 Prompt for AI Agents
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 804
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 408
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 152
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 96
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 142
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 50
🏁 Script executed:
# Read pages/user/[id].tsx to verify the problematic code cat -n pages/user/[id].tsxRepository: FreeCodeCamp-Chengdu/HOP
Length of output: 7780
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 5468
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 6694
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 50
🏁 Script executed:
Repository: FreeCodeCamp-Chengdu/HOP
Length of output: 904
new UserActivityModel(...)inline in JSX creates new instances on every re-renderUserDetailPageis wrapped withobserver(), so it re-renders whenever any MobX observable it reads changes (e.g.,sessionStore.userloading after login). Each render creates three newUserActivityModelinstances. Because each instance inheritsrestore(this, 'Activity'), every re-render triggers three redundant localStorage operations.Additionally,
ActivityList(aPureComponent) stores thestoreprop in a class field at construction time, so anyActivityListthat has already mounted will silently ignore replacement instances passed on subsequent renders.Memoize the models keyed on
id:🛠️ Proposed fix
Also verify that
User.id(the type ofidinPublicUser) matches theuserId: numberconstructor parameter ofUserActivityModel.📝 Committable suggestion
🤖 Prompt for AI Agents