fix: test html #125
Merged
fix: test html #125
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
thezz9
requested review from
Kimminu7,
NCookies,
chat26666,
minjee2758 and
pokerbearkr
Walkthrough코드 제출 테스트 페이지의 HTML 템플릿이 들여쓰기와 공백을 일관되게 정리하였으며, JavaScript에서 WebSocket 연결 초기화와 코드 제출 프로세스를 분리하였습니다. 이제 WebSocket은 페이지 로드 시 한 번만 연결되고, 코드 제출 시 연결 상태를 확인하여 세션별 토픽에 구독합니다. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant Browser
participant REST_API
participant WebSocket_Server
User->>Browser: 페이지 로드
Browser->>WebSocket_Server: WebSocket 연결 (초기 1회)
WebSocket_Server-->>Browser: 연결 완료
User->>Browser: 코드 제출 클릭
Browser->>REST_API: 세션 키 요청
REST_API-->>Browser: sessionKey 반환
Browser->>WebSocket_Server: 세션별 토픽 구독 (init, case, final)
WebSocket_Server-->>Browser: 메시지(push)
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
pokerbearkr
approved these changes
Jul 1, 2025
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
src/main/resources/templates/submit-test.html(7 hunks)
🧰 Additional context used
🧠 Learnings (2)
📓 Common learnings
Learnt from: thezz9
PR: ezcode-my/backend#73
File: src/main/resources/templates/submit-test.html:135-135
Timestamp: 2025-06-18T11:41:58.457Z
Learning: src/main/resources/templates/submit-test.html 파일은 테스트용 파일로, isCorrect 값의 하드코딩은 의도적이며 사용자가 UI 요소를 통해 정답/오답 상태를 선택할 수 있도록 개선 예정입니다.
Learnt from: thezz9
PR: ezcode-my/backend#75
File: src/main/java/org/ezcode/codetest/application/submission/aop/CodeReviewLockAspect.java:25-41
Timestamp: 2025-06-19T06:37:57.845Z
Learning: User thezz9 tends to skip validation for scenarios they consider unlikely to occur, but is willing to implement defensive programming practices when suggested for code robustness.
Learnt from: thezz9
PR: ezcode-my/backend#114
File: src/main/java/org/ezcode/codetest/infrastructure/github/GitHubApiClient.java:93-96
Timestamp: 2025-06-28T02:04:24.910Z
Learning: User thezz9 sometimes temporarily uses less secure or inconsistent exception handling (like RuntimeException with raw error bodies) for debugging purposes when error messages are being hidden in the normal application flow, but acknowledges this as technical debt and fixes it once debugging is complete.
Learnt from: thezz9
PR: ezcode-my/backend#114
File: src/main/java/org/ezcode/codetest/infrastructure/github/GitHubApiClient.java:159-165
Timestamp: 2025-06-28T02:03:38.654Z
Learning: User thezz9's service (ezcode) targets Korean users exclusively ("찐 한국인밖에 안 옴"), so Korean language hardcoding in commit messages and UI elements is intentional and appropriate for their use case.
src/main/resources/templates/submit-test.html (2)
Learnt from: thezz9
PR: ezcode-my/backend#73
File: src/main/resources/templates/submit-test.html:135-135
Timestamp: 2025-06-18T11:41:58.457Z
Learning: src/main/resources/templates/submit-test.html 파일은 테스트용 파일로, isCorrect 값의 하드코딩은 의도적이며 사용자가 UI 요소를 통해 정답/오답 상태를 선택할 수 있도록 개선 예정입니다.
Learnt from: thezz9
PR: ezcode-my/backend#30
File: src/main/java/org/ezcode/codetest/application/submission/service/SubmissionService.java:44-46
Timestamp: 2025-06-04T13:12:17.636Z
Learning: SubmissionService에서 "2 10" 입력값과 "12" 기대출력이 하드코딩되어 있는 것은 테스트 단계의 의도적인 구현이며, 추후 Problem 엔티티의 실제 테스트케이스로 대체 예정입니다.
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build
🔇 Additional comments (2)
src/main/resources/templates/submit-test.html (2)
245-255:setInterval폴링은 연결 실패 시 무한 대기합니다
connected플래그가 영영true로 바뀌지 않으면submitCode()가 영구 블록됩니다.
STOMP 의connect메서드는 Promise 로 래핑하거나,stompClient.onConnect/onStompError콜백에서resolve/reject해 타임아웃을 둘 것을 권장합니다.-if (!connected) { - await new Promise(r => { - const iv = setInterval(() => { - if (connected) { - clearInterval(iv); - r() - } - }, 50); - }); -} +await waitUntil(() => connected, 5000); // 5초 제한 + +function waitUntil(cond, timeoutMs) { + return new Promise((resolve, reject) => { + const started = Date.now(); + const iv = setInterval(() => { + if (cond()) { clearInterval(iv); resolve(); } + else if (Date.now() - started > timeoutMs) { + clearInterval(iv); reject(new Error('STOMP 연결 타임아웃')); + } + }, 50); + }); +}[ suggest_essential_refactor ]
257-262: 매 제출마다 구독을 추가만 하고 해제하지 않아 핸들러가 중복 실행됩니다
페이지를 새로고침하지 않고 여러 번 제출하면 같은sessionKey에 대해 중복 구독→중복 메시지 처리·메모리 누수 위험이 있습니다.
stompClient.unsubscribe()로 이전 구독을 정리하거나, 제출 시마다 새 클라이언트를 열고 이전 클라이언트를disconnect()하는 방식을 고려해주세요.
[ suggest_optional_refactor ]
Comment on lines
+204
to
+210
| function initWebSocket() { | ||
| const tokenOnly = (jwtInput.value.trim().startsWith('Bearer ') | ||
| ? jwtInput.value.trim().slice(7) | ||
| : jwtInput.value.trim()); | ||
| const socket = new SockJS(`/ws?token=${encodeURIComponent(tokenOnly)}`); | ||
| stompClient = Stomp.over(socket); | ||
| stompClient.debug = msg => console.log('[STOMP]', msg); |
There was a problem hiding this comment.
🛠️ Refactor suggestion
JWT 토큰을 URL 파라미터로 노출하는 방식은 보안 리스크가 큽니다
URL(쿼리스트링)에 토큰이 포함되면 브라우저 히스토리·서버 액세스 로그·프락시 등 여러 경로로 유출될 수 있습니다.
STOMP connect(headers, …) 인자로 Authorization 헤더를 전달하면 동일 기능을 쿠키·URL 로그에 노출하지 않고 구현할 수 있습니다.
-const socket = new SockJS(`/ws?token=${encodeURIComponent(tokenOnly)}`);
-stompClient = Stomp.over(socket);
-stompClient.debug = msg => console.log('[STOMP]', msg);
-stompClient.connect({}, () => {
+const socket = new SockJS('/ws');
+stompClient = Stomp.over(socket);
+stompClient.debug = msg => console.log('[STOMP]', msg); // 배포 시 끄는 것도 고려
+stompClient.connect({ Authorization: getTokenValue() }, () => {Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In src/main/resources/templates/submit-test.html around lines 204 to 210, the
JWT token is currently passed as a URL query parameter, which poses a security
risk due to potential exposure in browser history and logs. To fix this, remove
the token from the URL and instead pass it as an Authorization header in the
STOMP client's connect method by adding a headers object with the Authorization
field set to 'Bearer ' plus the token. This change keeps the token out of URLs
and logs while maintaining the same authentication functionality.
chat26666
approved these changes
Jul 1, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Refactor
Style