-
Notifications
You must be signed in to change notification settings - Fork 40
fix(auth): update error handling to use react-hot-toast #134
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. Weβll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,6 +2,7 @@ import React, { useState } from "react"; | |
| import { useNavigate } from "react-router-dom"; | ||
| import { User, Lock, UserPlus, LogIn, Mail, Shield } from "lucide-react"; | ||
| import { login, signup, sendOTP } from "../../utils/api"; | ||
| import toast from "react-hot-toast"; | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [HIGH] The AuthForm React component lacks JSDoc documentation describing its purpose, props, and behavior. Suggestion: Add a JSDoc comment block for the AuthForm component explaining its purpose, props, and behavior. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add a JSDoc comment block above the AuthForm component describing its purpose, props (onAuthChange), and behavior. documentation There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add a JSDoc comment block above the AuthForm component describing its functionality, props, and usage. documentation |
||
|
|
||
| interface AuthFormProps { | ||
| onAuthChange: () => void; | ||
|
|
@@ -18,27 +19,23 @@ const AuthForm: React.FC<AuthFormProps> = ({ onAuthChange }) => { | |
| const [otpSent, setOtpSent] = useState(false); | ||
| const [loading, setLoading] = useState(false); | ||
| const [otpLoading, setOtpLoading] = useState(false); | ||
| const [error, setError] = useState(""); | ||
| const [success, setSuccess] = useState(""); | ||
| const navigate = useNavigate(); | ||
|
|
||
| const handleSendOTP = async () => { | ||
| if (!email) { | ||
| setError("Please enter your email first"); | ||
| toast.error("Please enter your email first"); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts. Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use a safe toast or alert component that escapes HTML content. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error and success state with toast notifications for better UX and consistency. Remove unused error and success state variables to clean up the component state. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error and success state with toast notifications. Improves UX but removes inline feedback, potentially affecting accessibility. Consider combining toast notifications with inline messages. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities in the UI. Ensure that error messages are properly sanitized or escaped before rendering in the UI to prevent XSS. Alternatively, avoid displaying raw error messages from the server or user input directly. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages. Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Email presence validation uses toast.error but no email format validation before sending OTP. Add email format validation before sending OTP to reduce server load and improve UX. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error and success state with react-hot-toast for notifications but did not remove all references to these states. Remove all references to the removed error and success state variables to keep code clean and consistent. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if the messages contain user-controlled content. Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error state with react-hot-toast for error display, improving UX but removing inline error messages. Consider accessibility and fallback UI for error messages. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π‘ Suggestion β Replaced local error state with react-hot-toast for error notifications, improving user feedback consistency. No action needed; this is an improvement. bugs There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed using toast.error include err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities. Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use generic error messages if necessary. security |
||
| return; | ||
| } | ||
|
|
||
| setOtpLoading(true); | ||
| setError(""); | ||
| setSuccess(""); | ||
|
|
||
| try { | ||
| const response = await sendOTP(email, "signup"); | ||
| setSuccess(response.message); | ||
| toast.success(response.message); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts. Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use a safe toast or alert component that escapes HTML content. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities in the UI. Ensure that error messages are properly sanitized or escaped before rendering in the UI to prevent XSS. Alternatively, avoid displaying raw error messages from the server or user input directly. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages. Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if the messages contain user-controlled content. Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed using toast.error include err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities. Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use generic error messages if necessary. security |
||
| setOtpSent(true); | ||
| setShowOTPField(true); | ||
| } catch (err: any) { | ||
| setError(err.response?.data?.error || "Failed to send OTP"); | ||
| toast.error(err.userMessage || err.response?.data?.error || "Failed to send OTP"); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error state with toast.error for failure messages, improving UX consistency. Remove local error state and ensure all error messages use toast for consistency. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages. Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users use toast.error with err.userMessage or err.response.data.error without explicit sanitization. If these error messages contain user-controlled input, this could lead to reflected XSS vulnerabilities. Sanitize or escape error messages before displaying them to users. Consider using generic error messages to avoid leaking sensitive information or enabling XSS. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or encoding, which may lead to reflected XSS if the server sends malicious content in err.userMessage or err.response.data.error. Sanitize or encode error messages before displaying them in the UI to prevent XSS attacks. Alternatively, use a safe UI component that escapes HTML content. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error handling enhanced with 'err.userMessage' for better user messages. Ensure consistent error message setting in API layer. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if these messages contain malicious HTML or scripts. Sanitize or escape error messages before rendering them in the UI to prevent XSS vulnerabilities. security |
||
| } finally { | ||
| setOtpLoading(false); | ||
| } | ||
|
|
@@ -47,8 +44,6 @@ const AuthForm: React.FC<AuthFormProps> = ({ onAuthChange }) => { | |
| const handleSubmit = async (e: React.FormEvent) => { | ||
| e.preventDefault(); | ||
| setLoading(true); | ||
| setError(""); | ||
| setSuccess(""); | ||
|
|
||
| try { | ||
| const authResponse = isLogin | ||
|
|
@@ -59,7 +54,7 @@ const AuthForm: React.FC<AuthFormProps> = ({ onAuthChange }) => { | |
|
|
||
| // Set success message for signup | ||
| if (!isLogin) { | ||
| setSuccess("Account created successfully! Welcome to Edulume!"); | ||
| toast.success("Account created successfully! Welcome to Edulume!"); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local success state with toast.success for signup success message, improving UX consistency. Remove local success state and ensure all success messages use toast for consistency. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Success messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in messages. Sanitize or escape success messages before displaying them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Success messages are displayed using toast.success with dynamic content. Ensure that any dynamic content is sanitized to prevent injection of malicious scripts. Sanitize dynamic content before displaying in success messages to prevent XSS. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Success message replaced with toast for better UX. No action needed if toast is accessible. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed using toast.error include err.userMessage, err.response.data.error, and err.message without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities. Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use generic error messages if necessary. security |
||
| } | ||
|
|
||
| // Notify parent component to re-check auth status | ||
|
|
@@ -74,7 +69,7 @@ const AuthForm: React.FC<AuthFormProps> = ({ onAuthChange }) => { | |
| ); // Shorter delay for signup | ||
| } catch (err: any) { | ||
| console.error("β Authentication failed:", err); | ||
| setError(err.response?.data?.error || err.message || "An error occurred"); | ||
| toast.error(err.userMessage || err.response?.data?.error || err.message || "An error occurred"); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts. Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use a safe toast or alert component that escapes HTML content. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error state with toast.error for failure messages, improving UX consistency. Remove local error state and ensure all error messages use toast for consistency. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages. Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users use toast.error with err.userMessage or err.response.data.error or err.message without explicit sanitization. If these error messages contain user-controlled input, this could lead to reflected XSS vulnerabilities. Sanitize or escape error messages before displaying them to users. Consider using generic error messages to avoid leaking sensitive information or enabling XSS. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage, err.response.data.error, or err.message without sanitization. This could lead to reflected XSS if the messages contain user-controlled content. Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or encoding, which may lead to reflected XSS if the server sends malicious content in err.userMessage or err.response.data.error. Sanitize or encode error messages before displaying them in the UI to prevent XSS attacks. Alternatively, use a safe UI component that escapes HTML content. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error handling enhanced with 'err.userMessage' for better user messages. Ensure consistent error message setting in API layer. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage, err.response.data.error, or err.message without sanitization. This could lead to reflected XSS if these messages contain malicious HTML or scripts. Sanitize or escape error messages before rendering them in the UI to prevent XSS vulnerabilities. security |
||
| } finally { | ||
| setLoading(false); | ||
| } | ||
|
|
@@ -226,18 +221,6 @@ const AuthForm: React.FC<AuthFormProps> = ({ onAuthChange }) => { | |
| </div> | ||
| </div> | ||
|
|
||
| {error && ( | ||
| <div className="bg-red-900/50 border border-red-500 text-red-200 px-4 py-3 rounded-lg"> | ||
| {error} | ||
| </div> | ||
| )} | ||
|
|
||
| {success && ( | ||
| <div className="bg-green-900/50 border border-green-500 text-green-200 px-4 py-3 rounded-lg"> | ||
| {success} | ||
| </div> | ||
| )} | ||
|
|
||
| <button | ||
| type="submit" | ||
| disabled={loading} | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,29 +2,26 @@ import { useState } from "react"; | |
| import { useNavigate, Link } from "react-router-dom"; | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add a JSDoc comment above the ChangeUsernameForm component describing its role in changing the user's username and form submission. documentation |
||
| import { User, ArrowLeft } from "lucide-react"; | ||
| import { changeUsername } from "../../utils/api"; | ||
| import toast from "react-hot-toast"; | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [HIGH] The ChangeUsernameForm React component lacks JSDoc documentation describing its purpose, props, and behavior. Suggestion: Add a JSDoc comment block for the ChangeUsernameForm component explaining its purpose, props, and behavior. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add a JSDoc comment block above the ChangeUsernameForm component describing its purpose, props, and behavior. documentation There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add a JSDoc comment block above the ChangeUsernameForm component describing its functionality, props, and usage. documentation |
||
|
|
||
| export default function ChangeUsernameForm() { | ||
| const [username, setUsername] = useState(""); | ||
| const [loading, setLoading] = useState(false); | ||
| const [error, setError] = useState(""); | ||
| const [success, setSuccess] = useState(""); | ||
| const navigate = useNavigate(); | ||
|
|
||
| const handleSubmit = async (e: React.FormEvent) => { | ||
| e.preventDefault(); | ||
| setLoading(true); | ||
| setError(""); | ||
| setSuccess(""); | ||
|
|
||
| try { | ||
| await changeUsername(username); | ||
| setSuccess("Username changed successfully!"); | ||
| toast.success("Username changed successfully!"); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Success messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in messages. Sanitize or escape success messages before displaying them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Success messages are displayed using toast.success with dynamic content. Ensure that any dynamic content is sanitized to prevent injection of malicious scripts. Sanitize dynamic content before displaying in success messages to prevent XSS. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Success message replaced with toast for better UX. No action needed if toast is accessible. best-practices |
||
| setTimeout(() => { | ||
| navigate("/"); | ||
| window.location.reload(); // Refresh to update navbar | ||
| }, 1500); | ||
| } catch (err: any) { | ||
| setError(err.response?.data?.error || "Failed to change username"); | ||
| toast.error(err.userMessage || err.response?.data?.error || "Failed to change username"); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts. Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use a safe toast or alert component that escapes HTML content. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error and success state with toast notifications for better UX and consistency. Remove unused error and success state variables to clean up the component state. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error and success state with toast notifications. Improves UX but removes inline feedback, potentially affecting accessibility. Consider combining toast notifications with inline messages. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages. Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users use toast.error with err.userMessage or err.response.data.error without explicit sanitization. If these error messages contain user-controlled input, this could lead to reflected XSS vulnerabilities. Sanitize or escape error messages before displaying them to users. Consider using generic error messages to avoid leaking sensitive information or enabling XSS. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error and success state with react-hot-toast for notifications but did not remove all references to these states. Remove all references to the removed error and success state variables to keep code clean and consistent. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if the messages contain user-controlled content. Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or encoding, which may lead to reflected XSS if the server sends malicious content in err.userMessage or err.response.data.error. Sanitize or encode error messages before displaying them in the UI to prevent XSS attacks. Alternatively, use a safe UI component that escapes HTML content. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error handling enhanced with 'err.userMessage' for better user messages. Ensure consistent error message setting in API layer. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if these messages contain malicious HTML or scripts. Sanitize or escape error messages before rendering them in the UI to prevent XSS vulnerabilities. security |
||
| } finally { | ||
| setLoading(false); | ||
| } | ||
|
|
@@ -79,18 +76,6 @@ export default function ChangeUsernameForm() { | |
| </p> | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Removed local error and success message rendering in JSX in favor of toast notifications, improving UI consistency and reducing clutter. Remove unused error and success JSX blocks to clean up the component. best-practices |
||
| </div> | ||
|
|
||
| {error && ( | ||
| <div className="bg-red-900/50 border border-red-500 text-red-200 px-4 py-3 rounded-lg"> | ||
| {error} | ||
| </div> | ||
| )} | ||
|
|
||
| {success && ( | ||
| <div className="bg-green-900/50 border border-green-500 text-green-200 px-4 py-3 rounded-lg"> | ||
| {success} | ||
| </div> | ||
| )} | ||
|
|
||
| <button | ||
| type="submit" | ||
| disabled={loading} | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,6 +2,7 @@ import React, { useState } from "react"; | |
| import { useNavigate, Link } from "react-router-dom"; | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add a JSDoc comment above the ForgotPasswordForm component describing its multi-step password reset process and form handling. documentation |
||
| import { Mail, Shield, Lock, ArrowLeft } from "lucide-react"; | ||
| import { forgotPassword, resetPassword } from "../../utils/api"; | ||
| import toast from "react-hot-toast"; | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [HIGH] The ForgotPasswordForm React component lacks JSDoc documentation describing its purpose, props, and behavior. Suggestion: Add a JSDoc comment block for the ForgotPasswordForm component explaining its purpose, props (if any), and behavior. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add a JSDoc comment block above the ForgotPasswordForm component describing its purpose, props (if any), and behavior. documentation There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add a JSDoc comment block above the ForgotPasswordForm component describing its functionality, props, and usage. documentation |
||
|
|
||
| const ForgotPasswordForm: React.FC = () => { | ||
| const [step, setStep] = useState<"email" | "otp" | "password">("email"); | ||
|
|
@@ -10,22 +11,18 @@ const ForgotPasswordForm: React.FC = () => { | |
| const [newPassword, setNewPassword] = useState(""); | ||
| const [confirmPassword, setConfirmPassword] = useState(""); | ||
| const [loading, setLoading] = useState(false); | ||
| const [error, setError] = useState(""); | ||
| const [success, setSuccess] = useState(""); | ||
| const navigate = useNavigate(); | ||
|
|
||
| const handleSendOTP = async (e: React.FormEvent) => { | ||
| e.preventDefault(); | ||
| setLoading(true); | ||
| setError(""); | ||
| setSuccess(""); | ||
|
|
||
| try { | ||
| const response = await forgotPassword(email); | ||
| setSuccess(response.message); | ||
| toast.success(response.message); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error and success state with toast notifications for better UX and consistency. Remove unused error and success state variables to clean up the component state. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities in the UI. Ensure that error messages are properly sanitized or escaped before rendering in the UI to prevent XSS. Alternatively, avoid displaying raw error messages from the server or user input directly. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages. Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error and success state with react-hot-toast for notifications, improving UX but removing inline error display. Consider accessibility implications and fallback UI for error messages. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π‘ Suggestion β Replaced local success state with react-hot-toast for success notifications, improving user feedback consistency. No action needed; this is an improvement. bugs |
||
| setStep("otp"); | ||
| } catch (err: any) { | ||
| setError(err.response?.data?.error || "Failed to send reset code"); | ||
| toast.error(err.userMessage || err.response?.data?.error || "Failed to send reset code"); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts. Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use a safe toast or alert component that escapes HTML content. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error state with toast.error for failure messages, improving UX consistency. Remove local error state and ensure all error messages use toast for consistency. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error and success state with toast notifications. This improves UX but removes inline error/success messages, which may affect accessibility or user experience. Consider keeping inline messages in addition to toast notifications for better feedback. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities in the UI. Ensure that error messages are properly sanitized or escaped before rendering in the UI to prevent XSS. Alternatively, avoid displaying raw error messages from the server or user input directly. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages. Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users use toast.error with err.userMessage or err.response.data.error without explicit sanitization. If these error messages contain user-controlled input, this could lead to reflected XSS vulnerabilities. Sanitize or escape error messages before displaying them to users. Consider using generic error messages to avoid leaking sensitive information or enabling XSS. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error and success state with react-hot-toast for notifications but did not remove all references to these states. Remove all references to the removed error and success state variables to keep code clean and consistent. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π‘ Suggestion β Password length and confirmation validation is performed client-side before submission. Ensure server-side validation enforces password strength and confirmation to prevent weak passwords. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if the messages contain user-controlled content. Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or encoding, which may lead to reflected XSS if the server sends malicious content in err.userMessage or err.response.data.error. Sanitize or encode error messages before displaying them in the UI to prevent XSS attacks. Alternatively, use a safe UI component that escapes HTML content. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error handling enhanced with 'err.userMessage' for better user messages. Ensure consistent error message setting in API layer. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if these messages contain malicious HTML or scripts. Sanitize or escape error messages before rendering them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Replaced local error state with react-hot-toast for error messages, improving UX but removed inline error display which may reduce accessibility and visibility for some users. Consider retaining inline error display alongside toast notifications for better accessibility and user feedback. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π‘ Suggestion β Replaced local error state with react-hot-toast for error notifications, improving user feedback consistency. No action needed; this is an improvement. bugs There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed using toast.error include err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities. Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use generic error messages if necessary. security |
||
| } finally { | ||
| setLoading(false); | ||
| } | ||
|
|
@@ -35,27 +32,25 @@ const ForgotPasswordForm: React.FC = () => { | |
| e.preventDefault(); | ||
|
|
||
| if (newPassword !== confirmPassword) { | ||
| setError("Passwords do not match"); | ||
| toast.error("Passwords do not match"); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Client-side password validation is minimal (only length and equality). There is no enforcement of password complexity or strength, which may lead to weak passwords. Implement stronger password complexity requirements (e.g., mix of uppercase, lowercase, digits, special characters) and consider server-side validation as well. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Password confirmation mismatch is handled via toast error but no further validation or sanitization of password inputs. Consider adding stronger password validation and sanitization before submission. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Client-side validation checks password length and matching but does not enforce strong password policies or sanitize inputs. This may allow weak passwords. Implement stronger password policies (e.g., complexity requirements) and sanitize inputs to enhance security. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π‘ Suggestion β Replaced local error state with react-hot-toast for error notifications, improving user feedback consistency. No action needed; this is an improvement. bugs There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β User input for newPassword and confirmPassword is validated for equality and minimum length, but no further validation or sanitization is applied. This may allow weak passwords or unexpected input. Implement stronger password validation rules (e.g., complexity requirements) and sanitize inputs before processing. security |
||
| return; | ||
| } | ||
|
|
||
| if (newPassword.length < 6) { | ||
| setError("Password must be at least 6 characters long"); | ||
| toast.error("Password must be at least 6 characters long"); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Client-side password validation is minimal (only length and equality). There is no enforcement of password complexity or strength, which may lead to weak passwords. Implement stronger password complexity requirements (e.g., mix of uppercase, lowercase, digits, special characters) and consider server-side validation as well. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Password length validation is done with toast error but no complexity checks (e.g., uppercase, symbols). Consider adding password complexity validation for better security. best-practices There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Client-side validation checks password length and matching but does not enforce strong password policies or sanitize inputs. This may allow weak passwords. Implement stronger password policies (e.g., complexity requirements) and sanitize inputs to enhance security. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π‘ Suggestion β Replaced local error state with react-hot-toast for error notifications, improving user feedback consistency. No action needed; this is an improvement. bugs |
||
| return; | ||
| } | ||
|
|
||
| setLoading(true); | ||
| setError(""); | ||
| setSuccess(""); | ||
|
|
||
| try { | ||
| const response = await resetPassword(email, otp, newPassword); | ||
| setSuccess(response.message); | ||
| toast.success(response.message); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π‘ Suggestion β Replaced local success state with react-hot-toast for success notifications, improving user feedback consistency. No action needed; this is an improvement. bugs |
||
| setTimeout(() => { | ||
| navigate("/auth"); | ||
| }, 2000); | ||
| } catch (err: any) { | ||
| setError(err.response?.data?.error || "Failed to reset password"); | ||
| toast.error(err.userMessage || err.response?.data?.error || "Failed to reset password"); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts. Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use a safe toast or alert component that escapes HTML content. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities in the UI. Ensure that error messages are properly sanitized or escaped before rendering in the UI to prevent XSS. Alternatively, avoid displaying raw error messages from the server or user input directly. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages. Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users use toast.error with err.userMessage or err.response.data.error without explicit sanitization. If these error messages contain user-controlled input, this could lead to reflected XSS vulnerabilities. Sanitize or escape error messages before displaying them to users. Consider using generic error messages to avoid leaking sensitive information or enabling XSS. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if the messages contain user-controlled content. Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or encoding, which may lead to reflected XSS if the server sends malicious content in err.userMessage or err.response.data.error. Sanitize or encode error messages before displaying them in the UI to prevent XSS attacks. Alternatively, use a safe UI component that escapes HTML content. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if these messages contain malicious HTML or scripts. Sanitize or escape error messages before rendering them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π‘ Suggestion β Replaced local error state with react-hot-toast for error notifications, improving user feedback consistency. No action needed; this is an improvement. bugs There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed using toast.error include err.userMessage and err.response.data.error without sanitization. If these messages contain user-controlled input, this could lead to reflected XSS vulnerabilities. Sanitize or escape error messages before displaying them in the UI to prevent XSS. Use generic error messages if necessary. security |
||
| } finally { | ||
| setLoading(false); | ||
| } | ||
|
|
@@ -136,7 +131,7 @@ const ForgotPasswordForm: React.FC = () => { | |
| <button | ||
| type="button" | ||
| onClick={() => | ||
| handleSendOTP({ preventDefault: () => {} } as React.FormEvent) | ||
| handleSendOTP({ preventDefault: () => { } } as React.FormEvent) | ||
| } | ||
| disabled={loading} | ||
| className="w-full text-sm text-gray-400 hover:text-alien-green transition-colors duration-300" | ||
|
|
@@ -242,18 +237,6 @@ const ForgotPasswordForm: React.FC = () => { | |
| {step === "otp" && renderOTPStep()} | ||
| {step === "password" && renderPasswordStep()} | ||
|
|
||
| {error && ( | ||
| <div className="bg-red-900/50 border border-red-500 text-red-200 px-4 py-3 rounded-lg mt-6"> | ||
| {error} | ||
| </div> | ||
| )} | ||
|
|
||
| {success && ( | ||
| <div className="bg-green-900/50 border border-green-500 text-green-200 px-4 py-3 rounded-lg mt-6"> | ||
| {success} | ||
| </div> | ||
| )} | ||
|
|
||
| <div className="mt-6 text-center"> | ||
| <Link | ||
| to="/auth" | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -45,7 +45,7 @@ const CreateDiscussionPage: React.FC = () => { | |
| const result = await uploadImage(file, `discussion-${Date.now()}`); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add a JSDoc comment above the CreateDiscussionPage component describing its role in creating new discussions, form fields, and submission logic. documentation |
||
| setImages([...images, result.url]); | ||
| } catch (err: any) { | ||
| setError(err.response?.data?.error || "Failed to upload image"); | ||
| setError(err.userMessage || err.response?.data?.error || "Failed to upload image"); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts. Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Avoid displaying raw error messages from the server or error objects directly to users. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages. Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage or err.response.data.error without explicit sanitization. If these error messages contain user-controlled input, this could lead to reflected XSS vulnerabilities. Ensure that error messages displayed in the UI are properly sanitized or escaped to prevent XSS. Prefer generic error messages or sanitize any user-controlled content before rendering. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if the messages contain user-controlled content. Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π‘ Suggestion β Error handling updated to use err.userMessage if available, falling back to err.response?.data?.error. This improves user feedback by showing more specific error messages if provided by the API or middleware. No change needed; this is an improvement. bugs There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if these messages contain malicious HTML or scripts. Sanitize or escape error messages before rendering them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π‘ Suggestion β Error handling updated to include err.userMessage for better user-friendly messages. No action needed; this is an improvement. bugs There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π‘ Suggestion β Error handling updated to include err.userMessage before err.response?.data?.error. This is a positive change to improve error message clarity. No change needed; this is an improvement. bugs |
||
| } finally { | ||
| setImageUploading(false); | ||
| } | ||
|
|
@@ -112,7 +112,7 @@ const CreateDiscussionPage: React.FC = () => { | |
| navigate(`/discussions/${result.id}`); | ||
| }, 500); | ||
| } catch (err: any) { | ||
| setError(err.response?.data?.error || "Failed to create discussion"); | ||
| setError(err.userMessage || err.response?.data?.error || "Failed to create discussion"); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [MEDIUM] Error messages displayed to users include potentially untrusted error.userMessage content without sanitization, which could lead to reflected XSS if error.userMessage contains malicious HTML or scripts. Suggestion: Sanitize or escape error messages before displaying them in the UI to prevent XSS. Avoid displaying raw error messages from the server or error objects directly to users. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages from server responses are displayed directly without sanitization or escaping, which could lead to reflected XSS if the server sends malicious content in error messages. Sanitize or escape error messages before displaying them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage or err.response.data.error without explicit sanitization. If these error messages contain user-controlled input, this could lead to reflected XSS vulnerabilities. Ensure that error messages displayed in the UI are properly sanitized or escaped to prevent XSS. Prefer generic error messages or sanitize any user-controlled content before rendering. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if the messages contain user-controlled content. Sanitize or escape error messages before displaying them in the UI to prevent XSS. Prefer generic error messages. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π‘ Suggestion β Error handling updated to use err.userMessage if available, falling back to err.response?.data?.error. This improves user feedback by showing more specific error messages if provided by the API or middleware. No change needed; this is an improvement. bugs There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π Medium β Error messages displayed to users include content from err.userMessage and err.response.data.error without sanitization. This could lead to reflected XSS if these messages contain malicious HTML or scripts. Sanitize or escape error messages before rendering them in the UI to prevent XSS vulnerabilities. security There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π‘ Suggestion β Error handling updated to include err.userMessage before err.response?.data?.error. This is a positive change to improve error message clarity. No change needed; this is an improvement. bugs |
||
| } finally { | ||
| setLoading(false); | ||
| } | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Add a JSDoc comment above the AuthForm component describing its login/signup functionality, OTP handling, and form validation.
documentation