Repository navigation
fix: validate ?tab= before trusting it in ContributorDashboardClient - #735
Open
smartcalsystems-sketch wants to merge 1 commit into
Open
smartcalsystems-sketch wants to merge 1 commit into
smartcalsystems-sketch wants to merge 1 commit into
Conversation
…loses MergeFi#692) `(searchParams.get("tab") as "active" | "completed") || "active"` casts whatever string is in the URL without checking it. /dashboard/contributor ?tab=foo (or a stale/mistyped bookmark) set tab to the literal string "foo", which is neither "active" nor "completed" -- no Tabs entry matched it, so no tab was aria-selected, no tab had tabIndex=0 (unreachable by keyboard), and neither tabpanel rendered. Now only the literal value "completed" selects the completed tab; every other value, including garbage, falls back to "active".
|
@smartcalsystems-sketch is attempting to deploy a commit to the chonilius' projects Team on Vercel. A member of the Team first needs to authorize it. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
(searchParams.get("tab") as "active" | "completed") || "active"casts whatever string is in the URL without validating it./dashboard/contributor?tab=foo(or a stale/mistyped bookmark) setstab = "foo". Since neitherTabsentry's key matches"foo", no tab isaria-selected, no tab hastabIndex=0(the tablist becomes unreachable by keyboard), and neithertabpanelrenders.Fix
Replace the unchecked cast with an explicit check: only the literal value
"completed"selects the completed tab; every other value (including garbage) falls back to"active".Testing
?tab=foofalls back to the Active tab beingaria-selected.?tab=completedis still honored correctly.ContributorDashboardClient.test.tsxsuite: 7/7 passing (5 pre-existing + 2 new), zero regressions.tsc --noEmitandeslintclean on both changed files.Closes #692