From c9a50b2ba85e7fc90a7d6bca614644874b1e34f3 Mon Sep 17 00:00:00 2001
From: Dialpuri <dialpuri.jordan@gmail.com>
Date: Wed, 5 Jun 2024 11:17:45 +0100
Subject: [PATCH 1/2] Add "rel=noreferrer" to external links

The update modifies all external anchor tags to include "rel=noreferrer". This change mitigates potential security risks related to the opening of external sites, such as reverse tabnabbing, and maintains the integrity and safety of the web application.
---
 webapp/src/layouts/Footer.tsx                 | 11 +++++-
 webapp/src/layouts/NavBar.tsx                 |  7 +++-
 webapp/src/modals/Citations/Citations.tsx     | 37 ++++++++++++++++---
 webapp/src/shared/Information/Information.tsx | 12 +++++-
 4 files changed, 57 insertions(+), 10 deletions(-)

diff --git a/webapp/src/layouts/Footer.tsx b/webapp/src/layouts/Footer.tsx
index a932c369..515905dd 100644
--- a/webapp/src/layouts/Footer.tsx
+++ b/webapp/src/layouts/Footer.tsx
@@ -4,7 +4,16 @@ export default function Footer(): ReactElement {
         <footer className="bg-gray w-full mt-auto">
             <div className="w-full mx-auto max-w-screen-xl p-4 flex items-center justify-center">
                 <span className="text-sm text-primary text-center justify-center dark:text-gray-400">
-                    <p>Spotted an issue? Please email us or <a href="https://github.com/glycojones/privateer/issues/new/choose" target='_blank' > submit a GitHub issue </a>
+                    <p>
+                        Spotted an issue? Please email us or{' '}
+                        <a
+                            href="https://github.com/glycojones/privateer/issues/new/choose"
+                            target="_blank"
+                            rel="noreferrer"
+                        >
+                            {' '}
+                            submit a GitHub issue{' '}
+                        </a>
                     </p>
                     York Structural Biology Laboratory
                     <br />
diff --git a/webapp/src/layouts/NavBar.tsx b/webapp/src/layouts/NavBar.tsx
index 2eff71f4..afa7b9b6 100644
--- a/webapp/src/layouts/NavBar.tsx
+++ b/webapp/src/layouts/NavBar.tsx
@@ -92,7 +92,12 @@ export default function NavBar(): ReactElement {
                     </a>
                 </div>
                 <div className="h-12 w-12 mx-auto my-4 sm:w-12 sm:mt-12 sm:mr-12 flex items-center ">
-                    <a id="github" href={GITHUB_REPO} target="_blank">
+                    <a
+                        id="github"
+                        href={GITHUB_REPO}
+                        target="_blank"
+                        rel="noreferrer"
+                    >
                         <img
                             className="w-full hover:scale-125 transition-all hidden dark:block"
                             src="/github-mark.png"
diff --git a/webapp/src/modals/Citations/Citations.tsx b/webapp/src/modals/Citations/Citations.tsx
index f916eb0e..74959f9d 100644
--- a/webapp/src/modals/Citations/Citations.tsx
+++ b/webapp/src/modals/Citations/Citations.tsx
@@ -72,17 +72,42 @@ export default function CitationModal(props: {
                         McNicholas, S. J. & Agirre, J. (2024). Online
                         carbohydrate 3D structure validation with the Privateer
                         web app. Acta Cryst. F80.
-                        <p><a href="https://doi.org/10.1107/S2053230X24000359" target="_blank">https://doi.org/10.1107/S2053230X24000359</a></p>
+                        <p>
+                            <a
+                                href="https://doi.org/10.1107/S2053230X24000359"
+                                target="_blank"
+                                rel="noreferrer"
+                            >
+                                https://doi.org/10.1107/S2053230X24000359
+                            </a>
+                        </p>
                     </strong>
                 </div>
 
-                 <div className="mt-4 flex flex-col space-y-2">
-                    <h3>If you have used the <b><i>Privateer Database</i></b>, please cite: </h3>
+                <div className="mt-4 flex flex-col space-y-2">
+                    <h3>
+                        If you have used the{' '}
+                        <b>
+                            <i>Privateer Database</i>
+                        </b>
+                        , please cite:{' '}
+                    </h3>
 
-                    <strong>Dialpuri, J. S.; Bagdonas, H.; Schofield, L. C.; Pham, P. T.; Holland, L.; Agirre, J. Beilstein J. Org. Chem. 2024, 20, 931–939.
-                        <p><a href="https://doi.org/10.3762/bjoc.20.83" target="_blank">https://doi.org/10.3762/bjoc.20.83</a></p>
+                    <strong>
+                        Dialpuri, J. S.; Bagdonas, H.; Schofield, L. C.; Pham,
+                        P. T.; Holland, L.; Agirre, J. Beilstein J. Org. Chem.
+                        2024, 20, 931–939.
+                        <p>
+                            <a
+                                href="https://doi.org/10.3762/bjoc.20.83"
+                                target="_blank"
+                                rel="noreferrer"
+                            >
+                                https://doi.org/10.3762/bjoc.20.83
+                            </a>
+                        </p>
                     </strong>
-                 </div>
+                </div>
 
                 <div className="mt-4 flex flex-col space-y-2 font text-sm sm:text-base">
                     <h3>
diff --git a/webapp/src/shared/Information/Information.tsx b/webapp/src/shared/Information/Information.tsx
index 9e070279..41552c7d 100644
--- a/webapp/src/shared/Information/Information.tsx
+++ b/webapp/src/shared/Information/Information.tsx
@@ -89,7 +89,11 @@ export function Information() {
                         <div className="flex flex-col gap-6 justify-center">
                             <span className="text-xl font-body">
                                 <b>Glycomics-Powered Validation</b>
-                                <a href={GLYCOMICS_CITATION} target="_blank">
+                                <a
+                                    href={GLYCOMICS_CITATION}
+                                    target="_blank"
+                                    rel="noreferrer"
+                                >
                                     <svg
                                         className="inline pl-2 h-4 transition-all hover:h-5 fill-secondary"
                                         xmlns="http://www.w3.org/2000/svg"
@@ -119,7 +123,11 @@ export function Information() {
                         <div className="flex flex-col gap-6 justify-center">
                             <span className="text-xl font-body">
                                 <b>Linkage Torsion Validation</b>
-                                <a href={TORSIONS_CITATION} target="_blank">
+                                <a
+                                    href={TORSIONS_CITATION}
+                                    target="_blank"
+                                    rel="noreferrer"
+                                >
                                     <svg
                                         className="inline pl-2 h-4 transition-all hover:h-5 fill-secondary"
                                         xmlns="http://www.w3.org/2000/svg"

From c011fdc8ae5c19a061868e9579236f34917e6ff1 Mon Sep 17 00:00:00 2001
From: Dialpuri <dialpuri.jordan@gmail.com>
Date: Wed, 5 Jun 2024 11:17:53 +0100
Subject: [PATCH 2/2] Add function to fetch PDB file if CIF file fails

Introduced a fallback function, fetchPDBFile, that attempts to fetch a PDB file in case fetching the CIF file fails. This function catches networking errors and provides clearer logging to facilitate troubleshooting. It also improves the error handling for existing fetchPDB function.
---
 webapp/src/utils/fetch_from_pdb.ts | 34 +++++++++++++++++++++++++++---
 1 file changed, 31 insertions(+), 3 deletions(-)

diff --git a/webapp/src/utils/fetch_from_pdb.ts b/webapp/src/utils/fetch_from_pdb.ts
index 98a3ccfa..ed25082f 100644
--- a/webapp/src/utils/fetch_from_pdb.ts
+++ b/webapp/src/utils/fetch_from_pdb.ts
@@ -1,9 +1,32 @@
+async function fetchPDBFile(PDBCode: string): Promise<string | void> {
+    console.warn(
+        'The CIF file for this PDB could not be found, trying for the PDB'
+    );
+    const pdbURL = `https://files.rcsb.org/download/${PDBCode.toUpperCase()}.pdb`;
+
+    const file = fetch(pdbURL)
+        .then(async (response) => {
+            if (!response.ok) {
+                throw new Error('Network error');
+            }
+            return await response.text();
+        })
+        .then(async (file) => {
+            return file;
+        })
+        .catch(async (error) => {
+            return await Promise.reject(error);
+        });
+    return await file;
+}
+
 export async function fetchPDB(PDBCode: string): Promise<string | void> {
     if (PDBCode == null) {
         return;
     }
+    // first try fetching the cif
     console.log('Fetching PDB ', PDBCode);
-    const pdbURL = `https://files.rcsb.org/download/${PDBCode.toUpperCase()}.pdb`;
+    const pdbURL = `https://files.rcsb.org/download/${PDBCode.toUpperCase()}.cif`;
 
     const file = fetch(pdbURL)
         .then(async (response) => {
@@ -15,8 +38,13 @@ export async function fetchPDB(PDBCode: string): Promise<string | void> {
         .then(async (file) => {
             return file;
         })
-        .catch(() => {
-            throw new Error('PDB Not Found');
+        .catch(async () => {
+            // if we can't find the cif, try the PDB, if that fails, then report the failure.
+            try {
+                return await fetchPDBFile(PDBCode);
+            } catch (e) {
+                return await Promise.reject(e);
+            }
         });
     return await file;
 }