Repository navigation
fix(security): resolve SonarCloud quality gate failures - #429
Merged
Merged
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughWalkthroughThis pull request updates random ID generation mechanisms across multiple packages from Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Size Change: 0 B Total Size: 318 kB ℹ️ View Unchanged
|
|
- Fix ReDoS: replace [^]*? with [^\n]* in errorSanitizer, negated char classes in LyricsService, non-backtracking alternation in lastFmApi - Replace Math.random() with crypto.randomUUID() in download service, Toast, MusicControlService - Fix http://x test fixture to https://x - Add NOSONAR on intentional HTTP/FTP test cases - Pin compressed-size-action to commit SHA - Add NOSONAR on nginx Dockerfiles (root required for port 80) - Add USER node in frontend dev Dockerfile
LucasSantana-Dev
force-pushed
the
fix/sonar-quality-gate
branch
from
April 1, 2026 00:02
bf134f0 to
91659e1
Compare
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes all 33 SonarCloud security hotspots blocking the quality gate.
ReDoS (regex denial-of-service)
errorSanitizer.ts(bot + shared):[^]*?(?=\n|$)→[^\n]*— eliminates backtracking with the lookaheadLyricsService.ts:.*?in parentheses/bracket patterns → negated character classes[^)]*/[^\]]*(no backtracking needed)lastFmApi.ts: replaced nested\s*inTITLE_NOISE_PARENSwith\s+, rewroteFEAT_CLAUSEto eliminate optional-boundary ambiguityWeak cryptography
downloadVideo/service.ts:Math.random()→randomUUID()fromcryptoToast.tsx:Math.random()→globalThis.crypto.randomUUID()MusicControlService.ts:Math.random()→randomUUID()fromcryptoInsecure protocol
reactionHandler.spec.ts:http://x→https://xin mock fixtureguards.spec.ts: add// NOSONAR— HTTP YouTube URL is intentionally testing HTTP scheme supportlastfm.spec.ts: add// NOSONAR— FTP URL is intentionally testing FTP rejection pathGitHub Actions unpinned SHA
bundle-size.yml:compressed-size-action@v3→ pinned to66325aad(HEAD of v3)Docker root user
Dockerfile.nginx/Dockerfile.frontend: add# NOSONAR— nginx must bind port 80 as rootdeploy/Dockerfile: add# NOSONAR— root needed forapkand Docker socketpackages/frontend/Dockerfile.dev: addUSER nodebeforeCOPYto drop privileges in dev containerTest plan
Summary by CodeRabbit
Bug Fixes
Chores