Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 55 additions & 18 deletions Readme.md
Original file line number Diff line number Diff line change
Expand Up @@ -62,24 +62,61 @@ We're excited to be part of **Social Winter of Code 2026**! This is a great oppo

## πŸ—οΈ Architecture

```
β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
β”‚ Frontend (Client) β”‚
β”‚ React 19 + TypeScript + Tailwind CSS + Vite β”‚
β”‚ Deployed on Vercel β”‚
β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
↓
β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
β”‚ Backend (Node.js Server) β”‚
β”‚ Express.js + Prisma + MongoDB + Socket.io β”‚
β”‚ Deployed on Fly.io β”‚
β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
↓
β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
β”‚ AI Backend (Python FastAPI) β”‚
β”‚ FastAPI + LangChain + Pinecone + Groq β”‚
β”‚ Deployed on Fly.io β”‚
β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
```mermaid
flowchart TD
%% Define Styles
classDef frontend fill:#e1f5fe,stroke:#01579b,stroke-width:2px;
classDef backend fill:#fff3e0,stroke:#e65100,stroke-width:2px;
classDef aibackend fill:#f3e5f5,stroke:#4a148c,stroke-width:2px;
classDef db fill:#e8f5e9,stroke:#1b5e20,stroke-width:2px;
classDef external fill:#eee,stroke:#333,stroke-width:2px;

subgraph Client ["πŸ–₯️ Frontend (Vercel)"]
direction TB
React["React 19 + Vite + Tailwind CSS"]:::frontend
end

subgraph Server ["βš™οΈ Node.js Backend (Fly.io)"]
direction TB
API["Express.js + Socket.io"]:::backend
Prisma["Prisma ORM"]:::backend
end

subgraph AI ["πŸ€– AI Python Backend (Fly.io)"]
direction TB
FastAPI["FastAPI Server + LangChain"]:::aibackend
PyPDF["PDF Processor"]:::aibackend
end

subgraph Data ["πŸ’Ύ Databases & Storage"]
direction LR
Mongo[("MongoDB Atlas")]:::db
Redis[("Redis Cloud")]:::db
Pinecone[("Pinecone Vector DB")]:::db
Blob["Cloud Storage (R2/Blob)"]:::db
end

subgraph Ext ["☁️ External APIs"]
direction LB
Groq["Groq LLM API"]:::external
SMTP["SMTP (Emails)"]:::external
end

%% Core Connections
Client <-->|REST & WebSockets| API
Client -.->|Direct Uploads| Blob

API --- Prisma
Prisma <-->|CRUD Operations| Mongo
API <-->|Session/Cache| Redis
API -->|Dispatch| SMTP

API <-->|HTTP Queries| FastAPI

FastAPI --- PyPDF
FastAPI <-->|Store/Search Vectors| Pinecone
PyPDF -.->|Process Docs| Blob
FastAPI <-->|LLM Context/Prompts| Groq
```

---
Expand Down
3 changes: 2 additions & 1 deletion client/src/App.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -223,11 +223,12 @@ const App: React.FC<AppProps> = () => {
gutter={12}
containerStyle={{ top: 40 }}
toastOptions={{
duration: 4000,
style: {
fontSize: "14px",
maxWidth: "500px",
padding: "12px 20px",
backgroundColor: "#1e1e1e",
backgroundColor: "#1e1e1e",
color: "#fff",
border: "2px solid #00cc33",
borderRadius: "12px",
Expand Down
29 changes: 6 additions & 23 deletions client/src/components/auth/AuthForm.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ import React, { useState } from "react";
import { useNavigate } from "react-router-dom";

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ High β€” The exported React functional component AuthForm lacks a JSDoc comment describing its purpose, props, and behavior.

Add a JSDoc comment above the AuthForm component describing its login/signup functionality, OTP handling, and form validation.

documentation

import { User, Lock, UserPlus, LogIn, Mail, Shield } from "lucide-react";
import { login, signup, sendOTP } from "../../utils/api";
import toast from "react-hot-toast";

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] The AuthForm React component lacks JSDoc documentation describing its purpose, props, and behavior.

Suggestion: Add a JSDoc comment block for the AuthForm component explaining its purpose, props, and behavior.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ High β€” The AuthForm React functional component is exported without any JSDoc or docstring explaining its purpose, props, or behavior.

Add a JSDoc comment block above the AuthForm component describing its purpose, props (onAuthChange), and behavior.

documentation

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ High β€” Exported React component AuthForm lacks JSDoc documentation describing its purpose and props.

Add a JSDoc comment block above the AuthForm component describing its functionality, props, and usage.

documentation


interface AuthFormProps {
onAuthChange: () => void;
Expand All @@ -18,27 +19,23 @@ const AuthForm: React.FC<AuthFormProps> = ({ onAuthChange }) => {
const [otpSent, setOtpSent] = useState(false);
const [loading, setLoading] = useState(false);
const [otpLoading, setOtpLoading] = useState(false);
const [error, setError] = useState("");
const [success, setSuccess] = useState("");
const navigate = useNavigate();

const handleSendOTP = async () => {
if (!email) {
setError("Please enter your email first");
toast.error("Please enter your email first");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts.

Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use a safe toast or alert component that escapes HTML content.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error and success state with toast notifications for better UX and consistency.

Remove unused error and success state variables to clean up the component state.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error and success state with toast notifications. Improves UX but removes inline feedback, potentially affecting accessibility.

Consider combining toast notifications with inline messages.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities in the UI.

Ensure that error messages are properly sanitized or escaped before rendering in the UI to prevent XSS. Alternatively, avoid displaying raw error messages from the server or user input directly.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages.

Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Email presence validation uses toast.error but no email format validation before sending OTP.

Add email format validation before sending OTP to reduce server load and improve UX.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error and success state with react-hot-toast for notifications but did not remove all references to these states.

Remove all references to the removed error and success state variables to keep code clean and consistent.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if the messages contain user-controlled content.

Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error state with react-hot-toast for error display, improving UX but removing inline error messages.

Consider accessibility and fallback UI for error messages.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Suggestion β€” Replaced local error state with react-hot-toast for error notifications, improving user feedback consistency.

No action needed; this is an improvement.

bugs

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed using toast.error include err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities.

Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use generic error messages if necessary.

security

return;
}

setOtpLoading(true);
setError("");
setSuccess("");

try {
const response = await sendOTP(email, "signup");
setSuccess(response.message);
toast.success(response.message);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts.

Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use a safe toast or alert component that escapes HTML content.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities in the UI.

Ensure that error messages are properly sanitized or escaped before rendering in the UI to prevent XSS. Alternatively, avoid displaying raw error messages from the server or user input directly.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages.

Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if the messages contain user-controlled content.

Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed using toast.error include err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities.

Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use generic error messages if necessary.

security

setOtpSent(true);
setShowOTPField(true);
} catch (err: any) {
setError(err.response?.data?.error || "Failed to send OTP");
toast.error(err.userMessage || err.response?.data?.error || "Failed to send OTP");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error state with toast.error for failure messages, improving UX consistency.

Remove local error state and ensure all error messages use toast for consistency.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages.

Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users use toast.error with err.userMessage or err.response.data.error without explicit sanitization. If these error messages contain user-controlled input, this could lead to reflected XSS vulnerabilities.

Sanitize or escape error messages before displaying them to users. Consider using generic error messages to avoid leaking sensitive information or enabling XSS.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or encoding, which may lead to reflected XSS if the server sends malicious content in err.userMessage or err.response.data.error.

Sanitize or encode error messages before displaying them in the UI to prevent XSS attacks. Alternatively, use a safe UI component that escapes HTML content.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error handling enhanced with 'err.userMessage' for better user messages.

Ensure consistent error message setting in API layer.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if these messages contain malicious HTML or scripts.

Sanitize or escape error messages before rendering them in the UI to prevent XSS vulnerabilities.

security

} finally {
setOtpLoading(false);
}
Expand All @@ -47,8 +44,6 @@ const AuthForm: React.FC<AuthFormProps> = ({ onAuthChange }) => {
const handleSubmit = async (e: React.FormEvent) => {
e.preventDefault();
setLoading(true);
setError("");
setSuccess("");

try {
const authResponse = isLogin
Expand All @@ -59,7 +54,7 @@ const AuthForm: React.FC<AuthFormProps> = ({ onAuthChange }) => {

// Set success message for signup
if (!isLogin) {
setSuccess("Account created successfully! Welcome to Edulume!");
toast.success("Account created successfully! Welcome to Edulume!");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local success state with toast.success for signup success message, improving UX consistency.

Remove local success state and ensure all success messages use toast for consistency.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Success messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in messages.

Sanitize or escape success messages before displaying them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Success messages are displayed using toast.success with dynamic content. Ensure that any dynamic content is sanitized to prevent injection of malicious scripts.

Sanitize dynamic content before displaying in success messages to prevent XSS.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Success message replaced with toast for better UX.

No action needed if toast is accessible.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed using toast.error include err.userMessage, err.response.data.error, and err.message without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities.

Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use generic error messages if necessary.

security

}

// Notify parent component to re-check auth status
Expand All @@ -74,7 +69,7 @@ const AuthForm: React.FC<AuthFormProps> = ({ onAuthChange }) => {
); // Shorter delay for signup
} catch (err: any) {
console.error("❌ Authentication failed:", err);
setError(err.response?.data?.error || err.message || "An error occurred");
toast.error(err.userMessage || err.response?.data?.error || err.message || "An error occurred");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts.

Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use a safe toast or alert component that escapes HTML content.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error state with toast.error for failure messages, improving UX consistency.

Remove local error state and ensure all error messages use toast for consistency.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages.

Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users use toast.error with err.userMessage or err.response.data.error or err.message without explicit sanitization. If these error messages contain user-controlled input, this could lead to reflected XSS vulnerabilities.

Sanitize or escape error messages before displaying them to users. Consider using generic error messages to avoid leaking sensitive information or enabling XSS.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage, err.response.data.error, or err.message without sanitization. This could lead to reflected XSS if the messages contain user-controlled content.

Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or encoding, which may lead to reflected XSS if the server sends malicious content in err.userMessage or err.response.data.error.

Sanitize or encode error messages before displaying them in the UI to prevent XSS attacks. Alternatively, use a safe UI component that escapes HTML content.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error handling enhanced with 'err.userMessage' for better user messages.

Ensure consistent error message setting in API layer.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage, err.response.data.error, or err.message without sanitization. This could lead to reflected XSS if these messages contain malicious HTML or scripts.

Sanitize or escape error messages before rendering them in the UI to prevent XSS vulnerabilities.

security

} finally {
setLoading(false);
}
Expand Down Expand Up @@ -226,18 +221,6 @@ const AuthForm: React.FC<AuthFormProps> = ({ onAuthChange }) => {
</div>
</div>

{error && (
<div className="bg-red-900/50 border border-red-500 text-red-200 px-4 py-3 rounded-lg">
{error}
</div>
)}

{success && (
<div className="bg-green-900/50 border border-green-500 text-green-200 px-4 py-3 rounded-lg">
{success}
</div>
)}

<button
type="submit"
disabled={loading}
Expand Down
21 changes: 3 additions & 18 deletions client/src/components/auth/ChangeUsernameForm.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -2,29 +2,26 @@ import { useState } from "react";
import { useNavigate, Link } from "react-router-dom";

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ High β€” The exported React functional component ChangeUsernameForm lacks a JSDoc comment describing its purpose, props, and behavior.

Add a JSDoc comment above the ChangeUsernameForm component describing its role in changing the user's username and form submission.

documentation

import { User, ArrowLeft } from "lucide-react";
import { changeUsername } from "../../utils/api";
import toast from "react-hot-toast";

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] The ChangeUsernameForm React component lacks JSDoc documentation describing its purpose, props, and behavior.

Suggestion: Add a JSDoc comment block for the ChangeUsernameForm component explaining its purpose, props, and behavior.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ High β€” The ChangeUsernameForm React functional component is exported without any JSDoc or docstring explaining its purpose, props, or behavior.

Add a JSDoc comment block above the ChangeUsernameForm component describing its purpose, props, and behavior.

documentation

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ High β€” Exported React component ChangeUsernameForm lacks JSDoc documentation describing its purpose and props.

Add a JSDoc comment block above the ChangeUsernameForm component describing its functionality, props, and usage.

documentation


export default function ChangeUsernameForm() {
const [username, setUsername] = useState("");
const [loading, setLoading] = useState(false);
const [error, setError] = useState("");
const [success, setSuccess] = useState("");
const navigate = useNavigate();

const handleSubmit = async (e: React.FormEvent) => {
e.preventDefault();
setLoading(true);
setError("");
setSuccess("");

try {
await changeUsername(username);
setSuccess("Username changed successfully!");
toast.success("Username changed successfully!");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Success messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in messages.

Sanitize or escape success messages before displaying them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Success messages are displayed using toast.success with dynamic content. Ensure that any dynamic content is sanitized to prevent injection of malicious scripts.

Sanitize dynamic content before displaying in success messages to prevent XSS.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Success message replaced with toast for better UX.

No action needed if toast is accessible.

best-practices

setTimeout(() => {
navigate("/");
window.location.reload(); // Refresh to update navbar
}, 1500);
} catch (err: any) {
setError(err.response?.data?.error || "Failed to change username");
toast.error(err.userMessage || err.response?.data?.error || "Failed to change username");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts.

Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use a safe toast or alert component that escapes HTML content.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error and success state with toast notifications for better UX and consistency.

Remove unused error and success state variables to clean up the component state.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error and success state with toast notifications. Improves UX but removes inline feedback, potentially affecting accessibility.

Consider combining toast notifications with inline messages.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages.

Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users use toast.error with err.userMessage or err.response.data.error without explicit sanitization. If these error messages contain user-controlled input, this could lead to reflected XSS vulnerabilities.

Sanitize or escape error messages before displaying them to users. Consider using generic error messages to avoid leaking sensitive information or enabling XSS.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error and success state with react-hot-toast for notifications but did not remove all references to these states.

Remove all references to the removed error and success state variables to keep code clean and consistent.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if the messages contain user-controlled content.

Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or encoding, which may lead to reflected XSS if the server sends malicious content in err.userMessage or err.response.data.error.

Sanitize or encode error messages before displaying them in the UI to prevent XSS attacks. Alternatively, use a safe UI component that escapes HTML content.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error handling enhanced with 'err.userMessage' for better user messages.

Ensure consistent error message setting in API layer.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if these messages contain malicious HTML or scripts.

Sanitize or escape error messages before rendering them in the UI to prevent XSS vulnerabilities.

security

} finally {
setLoading(false);
}
Expand Down Expand Up @@ -79,18 +76,6 @@ export default function ChangeUsernameForm() {
</p>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Removed local error and success message rendering in JSX in favor of toast notifications, improving UI consistency and reducing clutter.

Remove unused error and success JSX blocks to clean up the component.

best-practices

</div>

{error && (
<div className="bg-red-900/50 border border-red-500 text-red-200 px-4 py-3 rounded-lg">
{error}
</div>
)}

{success && (
<div className="bg-green-900/50 border border-green-500 text-green-200 px-4 py-3 rounded-lg">
{success}
</div>
)}

<button
type="submit"
disabled={loading}
Expand Down
33 changes: 8 additions & 25 deletions client/src/components/auth/ForgotPasswordForm.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ import React, { useState } from "react";
import { useNavigate, Link } from "react-router-dom";

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ High β€” The exported React functional component ForgotPasswordForm lacks a JSDoc comment describing its purpose, props, and behavior.

Add a JSDoc comment above the ForgotPasswordForm component describing its multi-step password reset process and form handling.

documentation

import { Mail, Shield, Lock, ArrowLeft } from "lucide-react";
import { forgotPassword, resetPassword } from "../../utils/api";
import toast from "react-hot-toast";

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] The ForgotPasswordForm React component lacks JSDoc documentation describing its purpose, props, and behavior.

Suggestion: Add a JSDoc comment block for the ForgotPasswordForm component explaining its purpose, props (if any), and behavior.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ High β€” The ForgotPasswordForm React functional component is exported without any JSDoc or docstring explaining its purpose, props, or behavior.

Add a JSDoc comment block above the ForgotPasswordForm component describing its purpose, props (if any), and behavior.

documentation

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ High β€” Exported React component ForgotPasswordForm lacks JSDoc documentation describing its purpose and props (if any).

Add a JSDoc comment block above the ForgotPasswordForm component describing its functionality, props, and usage.

documentation


const ForgotPasswordForm: React.FC = () => {
const [step, setStep] = useState<"email" | "otp" | "password">("email");
Expand All @@ -10,22 +11,18 @@ const ForgotPasswordForm: React.FC = () => {
const [newPassword, setNewPassword] = useState("");
const [confirmPassword, setConfirmPassword] = useState("");
const [loading, setLoading] = useState(false);
const [error, setError] = useState("");
const [success, setSuccess] = useState("");
const navigate = useNavigate();

const handleSendOTP = async (e: React.FormEvent) => {
e.preventDefault();
setLoading(true);
setError("");
setSuccess("");

try {
const response = await forgotPassword(email);
setSuccess(response.message);
toast.success(response.message);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error and success state with toast notifications for better UX and consistency.

Remove unused error and success state variables to clean up the component state.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities in the UI.

Ensure that error messages are properly sanitized or escaped before rendering in the UI to prevent XSS. Alternatively, avoid displaying raw error messages from the server or user input directly.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages.

Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error and success state with react-hot-toast for notifications, improving UX but removing inline error display.

Consider accessibility implications and fallback UI for error messages.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Suggestion β€” Replaced local success state with react-hot-toast for success notifications, improving user feedback consistency.

No action needed; this is an improvement.

bugs

setStep("otp");
} catch (err: any) {
setError(err.response?.data?.error || "Failed to send reset code");
toast.error(err.userMessage || err.response?.data?.error || "Failed to send reset code");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts.

Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use a safe toast or alert component that escapes HTML content.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error state with toast.error for failure messages, improving UX consistency.

Remove local error state and ensure all error messages use toast for consistency.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error and success state with toast notifications. This improves UX but removes inline error/success messages, which may affect accessibility or user experience.

Consider keeping inline messages in addition to toast notifications for better feedback.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities in the UI.

Ensure that error messages are properly sanitized or escaped before rendering in the UI to prevent XSS. Alternatively, avoid displaying raw error messages from the server or user input directly.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages.

Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users use toast.error with err.userMessage or err.response.data.error without explicit sanitization. If these error messages contain user-controlled input, this could lead to reflected XSS vulnerabilities.

Sanitize or escape error messages before displaying them to users. Consider using generic error messages to avoid leaking sensitive information or enabling XSS.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error and success state with react-hot-toast for notifications but did not remove all references to these states.

Remove all references to the removed error and success state variables to keep code clean and consistent.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Suggestion β€” Password length and confirmation validation is performed client-side before submission.

Ensure server-side validation enforces password strength and confirmation to prevent weak passwords.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if the messages contain user-controlled content.

Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or encoding, which may lead to reflected XSS if the server sends malicious content in err.userMessage or err.response.data.error.

Sanitize or encode error messages before displaying them in the UI to prevent XSS attacks. Alternatively, use a safe UI component that escapes HTML content.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error handling enhanced with 'err.userMessage' for better user messages.

Ensure consistent error message setting in API layer.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if these messages contain malicious HTML or scripts.

Sanitize or escape error messages before rendering them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Replaced local error state with react-hot-toast for error messages, improving UX but removed inline error display which may reduce accessibility and visibility for some users.

Consider retaining inline error display alongside toast notifications for better accessibility and user feedback.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Suggestion β€” Replaced local error state with react-hot-toast for error notifications, improving user feedback consistency.

No action needed; this is an improvement.

bugs

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed using toast.error include err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities.

Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use generic error messages if necessary.

security

} finally {
setLoading(false);
}
Expand All @@ -35,27 +32,25 @@ const ForgotPasswordForm: React.FC = () => {
e.preventDefault();

if (newPassword !== confirmPassword) {
setError("Passwords do not match");
toast.error("Passwords do not match");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Client-side password validation is minimal (only length and equality). There is no enforcement of password complexity or strength, which may lead to weak passwords.

Implement stronger password complexity requirements (e.g., mix of uppercase, lowercase, digits, special characters) and consider server-side validation as well.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Password confirmation mismatch is handled via toast error but no further validation or sanitization of password inputs.

Consider adding stronger password validation and sanitization before submission.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Client-side validation checks password length and matching but does not enforce strong password policies or sanitize inputs. This may allow weak passwords.

Implement stronger password policies (e.g., complexity requirements) and sanitize inputs to enhance security.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Suggestion β€” Replaced local error state with react-hot-toast for error notifications, improving user feedback consistency.

No action needed; this is an improvement.

bugs

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” User input for newPassword and confirmPassword is validated for equality and minimum length, but no further validation or sanitization is applied. This may allow weak passwords or unexpected input.

Implement stronger password validation rules (e.g., complexity requirements) and sanitize inputs before processing.

security

return;
}

if (newPassword.length < 6) {
setError("Password must be at least 6 characters long");
toast.error("Password must be at least 6 characters long");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Client-side password validation is minimal (only length and equality). There is no enforcement of password complexity or strength, which may lead to weak passwords.

Implement stronger password complexity requirements (e.g., mix of uppercase, lowercase, digits, special characters) and consider server-side validation as well.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Password length validation is done with toast error but no complexity checks (e.g., uppercase, symbols).

Consider adding password complexity validation for better security.

best-practices

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Client-side validation checks password length and matching but does not enforce strong password policies or sanitize inputs. This may allow weak passwords.

Implement stronger password policies (e.g., complexity requirements) and sanitize inputs to enhance security.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Suggestion β€” Replaced local error state with react-hot-toast for error notifications, improving user feedback consistency.

No action needed; this is an improvement.

bugs

return;
}

setLoading(true);
setError("");
setSuccess("");

try {
const response = await resetPassword(email, otp, newPassword);
setSuccess(response.message);
toast.success(response.message);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Suggestion β€” Replaced local success state with react-hot-toast for success notifications, improving user feedback consistency.

No action needed; this is an improvement.

bugs

setTimeout(() => {
navigate("/auth");
}, 2000);
} catch (err: any) {
setError(err.response?.data?.error || "Failed to reset password");
toast.error(err.userMessage || err.response?.data?.error || "Failed to reset password");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts.

Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use a safe toast or alert component that escapes HTML content.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities in the UI.

Ensure that error messages are properly sanitized or escaped before rendering in the UI to prevent XSS. Alternatively, avoid displaying raw error messages from the server or user input directly.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages.

Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users use toast.error with err.userMessage or err.response.data.error without explicit sanitization. If these error messages contain user-controlled input, this could lead to reflected XSS vulnerabilities.

Sanitize or escape error messages before displaying them to users. Consider using generic error messages to avoid leaking sensitive information or enabling XSS.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if the messages contain user-controlled content.

Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or encoding, which may lead to reflected XSS if the server sends malicious content in err.userMessage or err.response.data.error.

Sanitize or encode error messages before displaying them in the UI to prevent XSS attacks. Alternatively, use a safe UI component that escapes HTML content.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if these messages contain malicious HTML or scripts.

Sanitize or escape error messages before rendering them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Suggestion β€” Replaced local error state with react-hot-toast for error notifications, improving user feedback consistency.

No action needed; this is an improvement.

bugs

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed using toast.error include err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities.

Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use generic error messages if necessary.

security

} finally {
setLoading(false);
}
Expand Down Expand Up @@ -136,7 +131,7 @@ const ForgotPasswordForm: React.FC = () => {
<button
type="button"
onClick={() =>
handleSendOTP({ preventDefault: () => {} } as React.FormEvent)
handleSendOTP({ preventDefault: () => { } } as React.FormEvent)
}
disabled={loading}
className="w-full text-sm text-gray-400 hover:text-alien-green transition-colors duration-300"
Expand Down Expand Up @@ -242,18 +237,6 @@ const ForgotPasswordForm: React.FC = () => {
{step === "otp" && renderOTPStep()}
{step === "password" && renderPasswordStep()}

{error && (
<div className="bg-red-900/50 border border-red-500 text-red-200 px-4 py-3 rounded-lg mt-6">
{error}
</div>
)}

{success && (
<div className="bg-green-900/50 border border-green-500 text-green-200 px-4 py-3 rounded-lg mt-6">
{success}
</div>
)}

<div className="mt-6 text-center">
<Link
to="/auth"
Expand Down
4 changes: 2 additions & 2 deletions client/src/components/discussions/CreateDiscussionPage.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ const CreateDiscussionPage: React.FC = () => {
const result = await uploadImage(file, `discussion-${Date.now()}`);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ High β€” The exported React functional component CreateDiscussionPage lacks a JSDoc comment describing its purpose, props, and behavior.

Add a JSDoc comment above the CreateDiscussionPage component describing its role in creating new discussions, form fields, and submission logic.

documentation

setImages([...images, result.url]);
} catch (err: any) {
setError(err.response?.data?.error || "Failed to upload image");
setError(err.userMessage || err.response?.data?.error || "Failed to upload image");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts.

Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Avoid displaying raw error messages from the server or error objects directly to users.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages.

Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage or err.response.data.error without explicit sanitization. If these error messages contain user-controlled input, this could lead to reflected XSS vulnerabilities.

Ensure that error messages displayed in the UI are properly sanitized or escaped to prevent XSS. Prefer generic error messages or sanitize any user-controlled content before rendering.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if the messages contain user-controlled content.

Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Suggestion β€” Error handling updated to use err.userMessage if available, falling back to err.response?.data?.error. This improves user feedback by showing more specific error messages if provided by the API or middleware.

No change needed; this is an improvement.

bugs

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if these messages contain malicious HTML or scripts.

Sanitize or escape error messages before rendering them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Suggestion β€” Error handling updated to include err.userMessage for better user-friendly messages.

No action needed; this is an improvement.

bugs

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Suggestion β€” Error handling updated to include err.userMessage before err.response?.data?.error. This is a positive change to improve error message clarity.

No change needed; this is an improvement.

bugs

} finally {
setImageUploading(false);
}
Expand Down Expand Up @@ -112,7 +112,7 @@ const CreateDiscussionPage: React.FC = () => {
navigate(`/discussions/${result.id}`);
}, 500);
} catch (err: any) {
setError(err.response?.data?.error || "Failed to create discussion");
setError(err.userMessage || err.response?.data?.error || "Failed to create discussion");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts.

Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Avoid displaying raw error messages from the server or error objects directly to users.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages.

Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage or err.response.data.error without explicit sanitization. If these error messages contain user-controlled input, this could lead to reflected XSS vulnerabilities.

Ensure that error messages displayed in the UI are properly sanitized or escaped to prevent XSS. Prefer generic error messages or sanitize any user-controlled content before rendering.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if the messages contain user-controlled content.

Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Suggestion β€” Error handling updated to use err.userMessage if available, falling back to err.response?.data?.error. This improves user feedback by showing more specific error messages if provided by the API or middleware.

No change needed; this is an improvement.

bugs

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ” Medium β€” Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if these messages contain malicious HTML or scripts.

Sanitize or escape error messages before rendering them in the UI to prevent XSS vulnerabilities.

security

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Suggestion β€” Error handling updated to include err.userMessage before err.response?.data?.error. This is a positive change to improve error message clarity.

No change needed; this is an improvement.

bugs

} finally {
setLoading(false);
}
Expand Down
Loading