Merge Develop to Staging v24.51.0 #9380
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#9094) * Add update button in log details page * using translation for button text * fixed layout of button. * Using shadcn button in update-log-details. * Changed button color. * Added primary button variant. * Corrected implementation of link as child of button. * fix outline variant button having no text color applied * improve buttons * remove unrelated changes * use similar button in brief log update details page too * fix cypress --------- Co-authored-by: rithviknishad <mail@rithviknishad.dev>
Bumps [cypress](https://github.com/cypress-io/cypress) from 13.16.0 to 13.16.1. - [Release notes](https://github.com/cypress-io/cypress/releases) - [Changelog](https://github.com/cypress-io/cypress/blob/develop/CHANGELOG.md) - [Commits](cypress-io/cypress@v13.16.0...v13.16.1) --- updated-dependencies: - dependency-name: cypress dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [class-variance-authority](https://github.com/joe-bell/cva) from 0.7.0 to 0.7.1. - [Release notes](https://github.com/joe-bell/cva/releases) - [Commits](joe-bell/cva@v0.7.0...v0.7.1) --- updated-dependencies: - dependency-name: class-variance-authority dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [react-i18next](https://github.com/i18next/react-i18next) from 15.1.1 to 15.1.3. - [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md) - [Commits](i18next/react-i18next@v15.1.1...v15.1.3) --- updated-dependencies: - dependency-name: react-i18next dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [cross-spawn](https://github.com/moxystudio/node-cross-spawn) from 7.0.3 to 7.0.6. - [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md) - [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6) --- updated-dependencies: - dependency-name: cross-spawn dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [i18next-http-backend](https://github.com/i18next/i18next-http-backend) from 2.6.2 to 3.0.1. - [Changelog](https://github.com/i18next/i18next-http-backend/blob/master/CHANGELOG.md) - [Commits](i18next/i18next-http-backend@v2.6.2...v3.0.1) --- updated-dependencies: - dependency-name: i18next-http-backend dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [cmdk](https://github.com/pacocoursey/cmdk/tree/HEAD/cmdk) from 1.0.0 to 1.0.4. - [Release notes](https://github.com/pacocoursey/cmdk/releases) - [Commits](https://github.com/pacocoursey/cmdk/commits/v1.0.4/cmdk) --- updated-dependencies: - dependency-name: cmdk dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.7 to 3.3.8. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.7...3.3.8) --- updated-dependencies: - dependency-name: nanoid dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
| current = current[key]; | ||
| } | ||
|
|
||
| current[keys[keys.length - 1]] = value; |
Check warning
Code scanning / CodeQL
Prototype-polluting function Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 1 month ago
To fix the problem, we need to ensure that the deep assignment only occurs for own properties of the destination object. This can be achieved by adding a check to ensure that the current object has the property before assigning to it. Additionally, we should continue to block the __proto__, constructor, and prototype properties.
- Modify the
handleValueChangefunction to include a check that ensures only own properties of the destination object are assigned. - Add a check to ensure that the current object has the property before assigning to it.
- Ensure that the existing validation for dangerous keys remains in place.
Suggested changeset
1
src/components/Facility/Investigations/ShowInvestigation.tsx
| @@ -108,3 +108,3 @@ | ||
| const key = keys[i]; | ||
| if (!current[key]) current[key] = {}; | ||
| if (!current.hasOwnProperty(key)) current[key] = {}; | ||
| current = current[key]; |
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
| if (!current[key]) current[key] = {}; | ||
| current = current[key]; | ||
| } | ||
| current[keys[keys.length - 1]] = value; |
Check warning
Code scanning / CodeQL
Prototype-polluting function Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 1 month ago
To fix the problem, we need to ensure that each key in the chain is validated before it is used to assign a value to the object. This can be done by adding a check within the loop that iterates over the keys. Specifically, we should skip any key that matches __proto__, constructor, or prototype to prevent prototype pollution.
- Modify the loop that iterates over the keys to include a check for dangerous keys.
- If a dangerous key is encountered, skip the assignment for that key.
- This change should be made in the
handleValueChangefunction in the filesrc/components/Facility/Investigations/Table.tsx.
Suggested changeset
1
src/components/Facility/Investigations/Table.tsx
| @@ -75,2 +75,5 @@ | ||
| const key = keys[i]; | ||
| if (["__proto__", "constructor", "prototype"].includes(key)) { | ||
| return; | ||
| } | ||
| if (!current[key]) current[key] = {}; | ||
| @@ -78,3 +81,7 @@ | ||
| } | ||
| current[keys[keys.length - 1]] = value; | ||
| const lastKey = keys[keys.length - 1]; | ||
| if (["__proto__", "constructor", "prototype"].includes(lastKey)) { | ||
| return; | ||
| } | ||
| current[lastKey] = value; | ||
| dispatch({ type: "set_form", form }); |
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
✅ Deploy Preview for care-ohc ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
CARE
|
||||||||||||||||||||||||||||
| Project |
CARE
|
| Branch Review |
develop
|
| Run status |
|
| Run duration | 05m 18s |
| Commit |
|
| Committer | Mohammed Nihal |
| View all properties for this run ↗︎ | |
| Test results | |
|---|---|
Failures
|
0
|
Flaky
|
0
|
Pending
|
0
|
Skipped
|
0
|
Passing
|
153
|
| View all changes introduced in this branch ↗︎ | |
Deploying care-fe with
|
| Latest commit: |
f70b3ad
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://0f3f79d3.care-fe.pages.dev |
rithviknishad
approved these changes
Dec 11, 2024
|
@nihal467 Your efforts have helped advance digital healthcare and TeleICU systems. 🚀 Thank you for taking the time out to make CARE better. We hope you continue to innovate and contribute; your impact is immense! 🙌 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed Changes
@ohcnetwork/care-fe-code-reviewers
Merge Checklist