Feat/mentoring-topics-revamp #496
Conversation
![semgrep-app[bot]](https://avatars.githubusercontent.com/in/60555?s=60&v=4){kind=small}
| <Checkbox.Form | ||
| name={`mentoringTopics-${groupItem.id}`} | ||
| key={groupItem.id} | ||
| value={groupItem.id} | ||
| checked={selectedMentoringTopics.includes(groupItem.id)} | ||
| customOnChange={onChange} | ||
| {...formik} | ||
| > | ||
| {groupItem.label} | ||
| </Checkbox.Form> |
There was a problem hiding this comment.
It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.
⚪️ This finding does not block your pull request.🙈 From typescript.react.best-practice.react-props-spreading.react-props-spreading.
| <Checkbox.Form | ||
| name={`professionalExperienceFields-${id}`} | ||
| key={id} | ||
| value={id} | ||
| checked={selectedProfessionalExperienceFields.includes(id)} | ||
| customOnChange={onChange} | ||
| {...formik} | ||
| > | ||
| {label} | ||
| </Checkbox.Form> |
There was a problem hiding this comment.
It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.
⚪️ This finding does not block your pull request.🙈 From typescript.react.best-practice.react-props-spreading.react-props-spreading.
| <Checkbox.Form | ||
| name={`mentoringGoals-${id}`} | ||
| key={id} | ||
| value={id} | ||
| checked={selectedMentoringGoals.includes(id)} | ||
| customOnChange={onChange} | ||
| {...formik} | ||
| > | ||
| {label} | ||
| </Checkbox.Form> |
There was a problem hiding this comment.
It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.
⚪️ This finding does not block your pull request.🙈 From typescript.react.best-practice.react-props-spreading.react-props-spreading.
|
Semgrep found 7
Injecting props into a new React Element may introduce an XSS vulnerability if the props contains a user-controllable object (such as a
⚪️ This finding does not block your pull request.
🙈 From typescript.react.security.audit.react-props-injection.react-props-injection. |
This reverts commit d2d1194.
…ired information to display list of mentors
|
| GitGuardian id | Secret | Commit | Filename | |
|---|---|---|---|---|
| 753993 | Generic High Entropy Secret | b3e7f20 | nx.json | View secret |
| 753993 | Generic High Entropy Secret | ad5445b | nx.json | View secret |
| 753993 | Generic High Entropy Secret | 863d333 | nx.json | View secret |
| 753993 | Generic High Entropy Secret | e7ef109 | nx.json | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Our GitHub checks need improvements? Share your feedbacks!
What Github issue does this PR relate to? Insert link.
What should the reviewer know?
We're revamping the mentoring topics, replacing them with four data lists: fields of expertise; mentoring goals; mentoring topics; skills.
This change will be a large one, and will affect the editing, browsing and filtering experience of mentors and mentees.