Conversation
Summary of ChangesHello @hdg0116, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! 이 PR은 사용자가 특정 영상에 달린 모든 댓글과 답글을 한 번에 조회할 수 있는 기능을 도입합니다. 기존에는 타임스탬프 기반의 댓글만 조회할 수 있었으나, 이제는 영상의 전체 댓글 목록을 포괄적으로 제공하여 사용자 경험을 향상시킵니다. 이는 영상 콘텐츠에 대한 전반적인 피드백을 쉽게 파악할 수 있도록 돕습니다. Highlights
Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request implements an API to retrieve all comments for a video. While the overall changes look good, the implementation currently lacks proper authorization checks, leading to a Broken Access Control (IDOR) vulnerability where any authenticated user can access comments for any video by knowing its ID. It is recommended to implement ownership or access permission checks in the service layer, consistent with other comment-related endpoints in the application. Additionally, I've provided some specific review comments to enhance code clarity and maintainability.
| export const getAllVideoComments = async ({ videoId }) => { | ||
| let vid; | ||
| try { | ||
| vid = BigInt(videoId); | ||
| } catch { | ||
| throw new InvalidParameterError({ videoId }, "videoId가 올바르지 않습니다."); | ||
| } | ||
|
|
||
| if (vid <= 0n) { | ||
| throw new InvalidParameterError({ videoId }, "videoId가 올바르지 않습니다."); | ||
| } | ||
|
|
||
| const videoExists = await findVideoByIdWithProject(vid); | ||
| if (!videoExists) { | ||
| throw new VideoNotFoundError({ videoId: String(videoId) }); | ||
| } | ||
|
|
||
| return findAllVideoComments({ videoId: vid }); | ||
| }; |
There was a problem hiding this comment.
The getAllVideoComments service does not perform any authorization checks, only verifying the existence of the video. To prevent unauthorized data access, it should be updated to accept a userId and verify that the user has the necessary permissions (e.g., project ownership) to view the comments, similar to the implementation in getSlideComments. Additionally, the validation logic for videoId is currently split between a try-catch block and an if statement; combining these checks would improve code conciseness and readability.
let vid;
try {
vid = BigInt(videoId);
if (vid <= 0n) {
throw new Error("videoId must be a positive BigInt");
}
} catch {
throw new InvalidParameterError({ videoId }, "videoId가 올바르지 않습니다.");
}| try { | ||
| const { videoId } = req.params; | ||
|
|
||
| const comments = await getAllVideoComments({ videoId }); |
There was a problem hiding this comment.
The getAllVideoCommentsController endpoint lacks an authorization check to verify if the authenticated user has permission to view the comments for the specified videoId. While the route is protected by the isLogin middleware, it does not ensure that the user owns the project or has been granted access to it. This allows any authenticated user to retrieve all comments for any video by providing its ID, which is a Broken Access Control (IDOR) vulnerability.
const comments = await getAllVideoComments({
videoId,
userId: req.user.id,
});| error: null, | ||
| success: getShareCommentsResponseDTO({ | ||
| comments, | ||
| currentUserId: req.user?.id ?? null, |
There was a problem hiding this comment.
이 라우트는 isLogin 미들웨어를 사용하고 있으므로, 컨트롤러에 도달했을 때 req.user는 항상 존재한다고 가정할 수 있습니다. 따라서 req.user?.id ?? null 대신 req.user.id로 코드를 단순화하여 명확성과 일관성을 높일 수 있습니다.
currentUserId: req.user.id,
hdg0116
changed the title
hdg0116
changed the title
1 participant
🔗 관련 이슈
✨ 변경 내용
✅ 체크리스트