Conversation
WalkthroughReplaced direct W3C VC QR code URIs with decodeURIComponent(...) for all relevant DocumentStatus entries in DocumentsData.ts. OA (Legacy) entries continue using decodeOAString(...). Data structures, exports, and function signatures are unchanged. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
✅ Deploy Preview for tradetrust-gallery ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
rongquan1
approved these changes
Aug 15, 2025
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (1)
src/data/DocumentsData.ts(5 hunks)
🔇 Additional comments (1)
src/data/DocumentsData.ts (1)
95-95: Good fix — decoding the W3C VC QR code URI here addresses the redirect bugDecoding the QR code’s encoded URI before use is the right move and aligns with the PR objective. This should resolve the redirection issue.
| label: 'Default', | ||
| url: { | ||
| 'W3C VC': docs.coo_default.qrCode.uri, | ||
| 'W3C VC': decodeURIComponent(docs.coo_default.qrCode.uri), |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Harden URI decoding: wrap decodeURIComponent in a safe helper and reuse it across all W3C entries
decodeURIComponent throws on malformed percent-escapes (e.g., stray "%"), which would crash rendering if any JSON has an unexpected value. OA uses a guarded decoder already; mirror that for W3C to be robust and DRY.
Apply this diff to replace direct calls with a safe helper:
- 'W3C VC': decodeURIComponent(docs.coo_default.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.coo_default.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.coo_redacted.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.coo_redacted.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.coo_revoked.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.coo_revoked.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.coo_expired.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.coo_expired.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.epn_operative.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.epn_operative.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.epn_inoperative.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.epn_inoperative.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.bol_operative.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.bol_operative.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.bol_inoperative.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.bol_inoperative.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.inv_default.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.inv_default.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.inv_redacted.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.inv_redacted.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.inv_revoked.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.inv_revoked.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.inv_expired.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.inv_expired.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.whr_operative.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.whr_operative.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.whr_inoperative.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.whr_inoperative.qrCode.uri),Add this helper near decodeOAString:
const decodeUriSafe = (value: string) => {
try {
return decodeURIComponent(value);
} catch {
return value;
}
};Optional verification script to quickly sanity-check repository JSONs for risky percent-escapes that could throw in decodeURIComponent:
Also applies to: 102-102, 109-109, 116-116, 136-136, 143-143, 162-162, 169-169, 189-189, 196-196, 203-203, 210-210, 229-229, 236-236
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Heuristic scan for the JSON payloads referenced in this file and inspect qrCode.uri values.
python - << 'PY'
import os, re, json
# Filenames referenced by DocumentsData.ts (W3C ones only)
names = {
'certificate-of-origin-default.json',
'certificate-of-origin-redacted.json',
'certificate-of-origin-revoked.json',
'certificate-of-origin-expired.json',
'electronic-promissory-note-operative.json',
'electronic-promissory-note-inoperative.json',
'bill-of-lading-operative.json',
'bill-of-lading-inoperative.json',
'invoice-default.json',
'invoice-redacted.json',
'invoice-revoked.json',
'invoice-expired.json',
'warehouse-receipt-operative.json',
'warehouse-receipt-inoperative.json',
}
def find_files(root='.'):
for dirpath, _, filenames in os.walk(root):
for f in filenames:
if f in names:
yield os.path.join(dirpath, f)
def find_qr_uris(obj):
# Recursively find any obj like {"qrCode": {"uri": "<...>"}}
if isinstance(obj, dict):
if 'qrCode' in obj and isinstance(obj['qrCode'], dict) and 'uri' in obj['qrCode']:
val = obj['qrCode']['uri']
if isinstance(val, str):
yield val
for v in obj.values():
yield from find_qr_uris(v)
elif isinstance(obj, list):
for it in obj:
yield from find_qr_uris(it)
files = list(find_files('.'))
if not files:
print('No referenced W3C JSON files found. If they’re stored under public/static, ensure they exist on this branch.')
else:
for p in sorted(files):
try:
with open(p, 'r', encoding='utf-8') as fh:
data = json.load(fh)
except Exception as e:
print(f'[PARSE-ERROR] {p}: {e}')
continue
uris = list(find_qr_uris(data))
if not uris:
print(f'[NO-URI] {p}')
continue
for u in uris:
has_pct = bool(re.search(r'%[0-9A-Fa-f]{2}', u))
has_bad = bool(re.search(r'%(?![0-9A-Fa-f]{2})', u))
print(f'[OK] {p} | encoded={has_pct} | potentially_malformed={has_bad} | sample="{u[:120]}"')
PYLength of output: 4078
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Search for decodeURIComponent occurrences ==="
rg -n --hidden -S "decodeURIComponent" || true
echo
echo "=== Show src/data/DocumentsData.ts with line numbers (if present) ==="
if [ -f src/data/DocumentsData.ts ]; then
nl -ba src/data/DocumentsData.ts | sed -n '1,320p'
else
echo "File src/data/DocumentsData.ts not found"
fi
echo
echo "=== Search for decodeOAString helper ==="
rg -n --hidden -S "decodeOAString" || true
echo
echo "=== Search for existing decodeUriSafe helper (to avoid duplicate) ==="
rg -n --hidden -S "decodeUriSafe" || trueLength of output: 2014
Harden URI decoding: add a guarded decodeUriSafe and use it for all W3C VC entries
decodeURIComponent can throw on malformed percent-escapes (e.g. stray "%") — add a small safe wrapper and replace direct calls to avoid runtime crashes.
- File: src/data/DocumentsData.ts
- add the helper near the existing decodeOAString (decodeOAString found at ~line 72)
- replace direct calls at these lines: 95, 102, 109, 116, 136, 143, 162, 169, 189, 196, 203, 210, 229, 236
- consider updating decodeOAString's internal decodeURIComponent to use decodeUriSafe as well
Apply this diff to replace direct calls:
- 'W3C VC': decodeURIComponent(docs.coo_default.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.coo_default.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.coo_redacted.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.coo_redacted.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.coo_revoked.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.coo_revoked.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.coo_expired.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.coo_expired.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.epn_operative.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.epn_operative.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.epn_inoperative.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.epn_inoperative.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.bol_operative.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.bol_operative.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.bol_inoperative.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.bol_inoperative.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.inv_default.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.inv_default.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.inv_redacted.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.inv_redacted.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.inv_revoked.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.inv_revoked.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.inv_expired.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.inv_expired.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.whr_operative.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.whr_operative.qrCode.uri),
- 'W3C VC': decodeURIComponent(docs.whr_inoperative.qrCode.uri),
+ 'W3C VC': decodeUriSafe(docs.whr_inoperative.qrCode.uri),Add this helper near decodeOAString:
const decodeUriSafe = (value: string) => {
try {
return decodeURIComponent(value);
} catch {
return value;
}
};Note: I scanned the repo — decodeURIComponent occurrences exist at the lines above, and the public/static W3C JSONs in this branch show percent-encoded URIs (no malformed percent-escapes found), but runtime protection is still recommended.
🤖 Prompt for AI Agents
In src/data/DocumentsData.ts around line ~72 and affecting lines
95,102,109,116,136,143,162,169,189,196,203,210,229,236: decodeURIComponent is
used directly for W3C VC URIs and can throw on malformed percent-escapes; add a
small safe wrapper function (named decodeUriSafe) near the existing
decodeOAString (around line 72) that returns the original string on decode
errors, replace all direct decodeURIComponent calls at the listed lines with
decodeUriSafe, and update decodeOAString to call decodeUriSafe instead of
decodeURIComponent so all URI decoding is guarded against exceptions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
W3C document's uri is not decoded thus having a redirection issue.
Changes
Issues
redirection not working
Releases
Channels: latest
ETA: Any target release date
Summary by CodeRabbit