Skip to content

fix: resolve semgrep findings across codebase#98

Merged
harshtandiya merged 3 commits intodevelopfrom
fix/semgrep-findings
Apr 22, 2026
Merged

fix: resolve semgrep findings across codebase#98
harshtandiya merged 3 commits intodevelopfrom
fix/semgrep-findings

Conversation

@harshtandiya
Copy link
Copy Markdown
Collaborator

@harshtandiya harshtandiya commented Apr 22, 2026

Summary

  • Add # nosemgrep comments for reviewed guest-whitelisted API endpoints
  • Fix format string injection vulnerability by converting exceptions to str(e)
  • Remove redundant db.commit() in test teardown (DocType DDL auto-commits)
  • Add explanation comment for required CSRF token commit in www/forms.py

Test plan

  • Run semgrep --config=semgrep-rules/rules . — 0 findings
  • Run backend tests to verify test_form.py still works

🤖 Generated with Claude Code

@harshtandiya
fix: resolve semgrep findings across codebase
e241d72 
- Add nosemgrep comments for reviewed guest-whitelisted endpoints
- Fix format string injection by converting exceptions to str()
- Remove redundant db.commit() in test teardown (DDL auto-commits)
- Add explanation comment for required CSRF token commit
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Apr 22, 2026 •
edited
Loading

Warning

Rate limit exceeded

@harshtandiya has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 15 minutes and 45 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 15 minutes and 45 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: eb4588e7-c0bf-494d-a8bc-0edaf3d42018

📥 Commits

Reviewing files that changed from the base of the PR and between 26e2a74 and db4faf4.

📒 Files selected for processing (6)
  • .github/workflows/typecheck.yml
  • forms_pro/api/form.py
  • forms_pro/api/settings.py
  • forms_pro/forms_pro/doctype/form/test_form.py
  • forms_pro/utils/form_generator.py
  • forms_pro/www/forms.py
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/semgrep-findings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@harshtandiya harshtandiya enabled auto-merge April 22, 2026 13:39
@harshtandiya
ci: remove paths from pull_request trigger in typecheck workflow
60ad12a 
- Simplified the typecheck workflow by removing specific paths from the pull_request trigger, allowing for broader checks on all changes.
@harshtandiya harshtandiya added this pull request to the merge queue Apr 22, 2026
@github-merge-queue github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Apr 22, 2026
@harshtandiya harshtandiya enabled auto-merge April 22, 2026 13:50
@harshtandiya harshtandiya added this pull request to the merge queue Apr 22, 2026
Merged via the queue into develop with commit d5cde23 Apr 22, 2026
7 checks passed
@harshtandiya harshtandiya deleted the fix/semgrep-findings branch April 22, 2026 13:57
@harshtandiya harshtandiya mentioned this pull request Apr 29, 2026
Merged
7 tasks
harshtandiya added a commit that referenced this pull request Apr 29, 2026
@harshtandiya @dependabot
chore(backport): backport develop features to version-15 (Apr 2026) (#…
b886aad 
…114)

* fix(multiselect): reset option input and error message on startAddingOption

(cherry picked from commit 96a0f94)

* chore: better ui to remove options in multiselect (#87)

* chore: make labels w-full in builder

* chore(multiselect): better ui for removing options

- Introduced `inEditMode` prop to `RenderField.vue` to control edit state.
- Updated `FieldRenderer.vue` to pass `inEditMode` to `RenderField`.
- Enhanced `Multiselect.vue` to utilize `inEditMode` for conditional rendering and option removal functionality.

(cherry picked from commit 55c4fc0)

* chore(deps-dev): bump postcss from 8.5.8 to 8.5.10 in /frontend (#95)

Bumps [postcss](https://github.com/postcss/postcss) from 8.5.8 to 8.5.10.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.8...8.5.10)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 7a3aa8c)

* chore(deps): bump dayjs from 1.11.19 to 1.11.20 in /frontend (#84)

Bumps [dayjs](https://github.com/iamkun/dayjs) from 1.11.19 to 1.11.20.
- [Release notes](https://github.com/iamkun/dayjs/releases)
- [Changelog](https://github.com/iamkun/dayjs/blob/dev/CHANGELOG.md)
- [Commits](iamkun/dayjs@v1.11.19...v1.11.20)

---
updated-dependencies:
- dependency-name: dayjs
  dependency-version: 1.11.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 222c73d)

* chore(deps): bump @lottiefiles/dotlottie-vue in /frontend (#93)

Bumps [@lottiefiles/dotlottie-vue](https://github.com/LottieFiles/dotlottie-web/tree/HEAD/packages/vue) from 0.10.4 to 0.11.11.
- [Release notes](https://github.com/LottieFiles/dotlottie-web/releases)
- [Changelog](https://github.com/LottieFiles/dotlottie-web/blob/main/packages/vue/CHANGELOG.md)
- [Commits](https://github.com/LottieFiles/dotlottie-web/commits/@lottiefiles/dotlottie-vue@0.11.11/packages/vue)

---
updated-dependencies:
- dependency-name: "@lottiefiles/dotlottie-vue"
  dependency-version: 0.11.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 092d2e8)

* chore(deps): bump actions/setup-node from 4 to 6 (#88)

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 9aa693f)

* chore(deps): bump actions/checkout from 4 to 6 (#90)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit d147e0d)

* chore(deps): bump actions/setup-python from 5 to 6 (#91)

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 6.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 00a219c)

* chore(deps): bump actions/upload-artifact from 4 to 7 (#89)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit e95b934)

* ci: add merge_group trigger to enable GitHub merge queue (#97)

(cherry picked from commit cd63fa7)

* fix(e2e): auto-fill form title in FormBuilderPage.goto() to prevent MandatoryError (#96)

Forms created via e2e fixtures have title "Untitled Form" which the frontend
transforms to "" on load. When tests modify the form and save, the blank title
causes a MandatoryError. This was causing CI failures in multiselect-field.spec.ts.

Changes:
- FormBuilderPage.goto() now auto-fills a unique title and saves
- Added skipTitleFill option for forms that already have a title set
- createPublishedForm fixture now sets title alongside is_published
- Removed manual title fill from multiselect-field.spec.ts

(cherry picked from commit 26e2a74)

* chore: update gitignore to ignore semgrep folder

(cherry picked from commit a6f6b2a)

* fix: resolve semgrep findings across codebase (#98)

* fix: resolve semgrep findings across codebase

- Add nosemgrep comments for reviewed guest-whitelisted endpoints
- Fix format string injection by converting exceptions to str()
- Remove redundant db.commit() in test teardown (DDL auto-commits)
- Add explanation comment for required CSRF token commit

* ci: remove paths from pull_request trigger in typecheck workflow

- Simplified the typecheck workflow by removing specific paths from the pull_request trigger, allowing for broader checks on all changes.

* fix: use correct semgrep rule ID prefix (frappe-semgrep-rules)

(cherry picked from commit d5cde23)

* feat: add Heading 1/2/3 field types (#103)

* feat(form-field): add Heading 1/2/3 fieldtypes to doctype and backend mapping

Maps heading fieldtypes to Frappe HTML, generates h1/h2/h3 options content
for the CustomField, and skips heading fields in server-side required validation.

* feat(heading): wire up Heading 1/2/3 field types across the frontend

Adds heading layout type, Heading component with h2/h3/h4 tag rendering,
FieldRenderer branch for edit/view modes, isHeading util, and submission
display handling.

* test(heading): add backend and E2E tests for heading field types

- Unit tests for heading fields skipped in validation
- Integration tests for get_options() and to_frappe_field
- E2E tests for builder, public form rendering, and submission
- Fix missing Heading imports in FieldRenderer and SubmissionFieldValue

* fix(form-field): escape HTML in heading labels for get_options method

- Updated get_options method to use escape_html for heading labels to prevent potential HTML injection.
- Adjusted return type annotation to allow for None in addition to str.

* chore: minor styling

(cherry picked from commit 16989b1)

* refactor: redesign the form builder layout (#105)

* refactor: redesign the form builder layout

- Introduced a new FieldActions component to handle field removal and drag functionality.
- Integrated FieldActions into FormBuilderContent for improved user interaction with form fields.
- Updated styles for better visibility and interaction feedback.

* feat: enhance FieldActions component for improved drag-and-drop functionality

- Updated FieldActions to include drag state handling, allowing for better user feedback during field manipulation.
- Integrated the new FieldActions component into FormBuilderContent, enhancing the interaction experience with form fields.
- Adjusted styles for visibility based on selection and drag state.

(cherry picked from commit 4e9b9d1)

* enhance(FieldActions): add tooltips for field actions buttons

- Added tooltip text for the remove and drag buttons in the FieldActions component to improve user experience and accessibility.
- Updated button structure for better readability and maintainability.

(cherry picked from commit 66e04de)

* fix(Form): correct initial route generation string (#106)

- Updated the initial route generation method to remove the unnecessary 's/' prefix, ensuring the route is generated correctly as 'forms_pro_' followed by a random string.

(cherry picked from commit 72f63f8)

* fix: prevent duplicate fieldnames on form save (#107)

* feat(frontend): add global dialog component for imperative dialogs

Adds dialog utility with confirm/alert/show methods callable from
anywhere via TypeScript, similar to vue-sonner pattern.

* feat(dialog): add html support for rich message content

* fix(editForm): prevent save when duplicate fieldnames detected

Shows dialog listing conflicting Label(fieldname) pairs before save.

(cherry picked from commit 9e7849d)

* chore(deps): bump vue from 3.5.32 to 3.5.33 in /frontend (#110)

Bumps [vue](https://github.com/vuejs/core) from 3.5.32 to 3.5.33.
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.32...v3.5.33)

---
updated-dependencies:
- dependency-name: vue
  dependency-version: 3.5.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 0ffdad3)

* chore(deps-dev): bump @vitejs/plugin-vue in /frontend (#109)

Bumps [@vitejs/plugin-vue](https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue) from 6.0.5 to 6.0.6.
- [Release notes](https://github.com/vitejs/vite-plugin-vue/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-vue/blob/main/packages/plugin-vue/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-vue/commits/plugin-vue@6.0.6/packages/plugin-vue)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-vue"
  dependency-version: 6.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 9035fdb)

* fix(backport): adapt cherry-picked code to v15 lucide + dual-enum types

- FieldActions.vue: use lucide-vue-next (v15 hasn't migrated to @lucide/vue)
- SubmissionFieldValue.vue: cast FormFieldTypes prop to Fieldtype where the
  Heading helper / component expect the doctype-generated enum (refactor #75
  consolidated these enums on develop; v15 still has both)

* fix(test): use v15-compatible FrappeTestCase import in test_form_field

frappe.tests.IntegrationTestCase doesn't exist on Frappe v15. Match the
import pattern used by the other v15 tests (test_roles, test_invitations).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@harshtandiya