ブックマーク編集・削除機能を追加#9
Conversation
📝 WalkthroughWalkthroughこのプルリクエストはブックマークの編集・削除機能を実装します。Repository に findById/update/delete メソッドを追加し、Controller に対応するエンドポイントを実装し、edit.html テンプレートと UI スタイルを追加します。バリデーション(タイトル空欄・100文字超、説明300文字超)とエラーメッセージ表示を含みます。 Changesブックマーク編集・削除機能
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/main/resources/templates/index.html (1)
44-46: ⚡ Quick win
th:hrefのjavascript:スキーム懸念は上流で抑止されています
src/main/resources/templates/index.htmlの該当リンクはth:href="${bookmark.url()}"ですが、BookmarkMetadataFetcher.normalizeUrl()でURLスキームをhttp/https以外の場合にIllegalArgumentExceptionとして拒否しており、BookmarkController側でもその例外はキャッチしてエラーフラッシュ&トップへリダイレクトしています。これによりbookmark.url()がjavascript:になる経路は現状ありません。関連スキーム検証(BookmarkMetadataFetcher)
String scheme = uri.getScheme(); if (!"http".equalsIgnoreCase(scheme) && !"https".equalsIgnoreCase(scheme)) { throw new IllegalArgumentException("URL scheme must be http or https"); }(防御的に)保存前/表示時の二重チェックとして
bookmark.url()再検証を行うのは任意の改善です。🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/main/resources/templates/index.html` around lines 44 - 46, Although upstream code rejects non-http/https schemes in BookmarkMetadataFetcher.normalizeUrl() and BookmarkController handles that, add a defensive re-check before rendering to ensure bookmark.url() cannot be a javascript: scheme: in the controller action that prepares the model (the method in BookmarkController that adds Bookmark objects to the view) validate the bookmark.url() again (reusing the same scheme check logic from BookmarkMetadataFetcher.normalizeUrl() or a small helper) and if invalid replace it with a safe fallback (null or "#") or remove the href attribute from the model so the template anchor (th:href="${bookmark.url()}") never outputs a javascript: URL; ensure any exception is caught and a safe value is supplied to the view.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/main/resources/templates/index.html`:
- Around line 44-46: Although upstream code rejects non-http/https schemes in
BookmarkMetadataFetcher.normalizeUrl() and BookmarkController handles that, add
a defensive re-check before rendering to ensure bookmark.url() cannot be a
javascript: scheme: in the controller action that prepares the model (the method
in BookmarkController that adds Bookmark objects to the view) validate the
bookmark.url() again (reusing the same scheme check logic from
BookmarkMetadataFetcher.normalizeUrl() or a small helper) and if invalid replace
it with a safe fallback (null or "#") or remove the href attribute from the
model so the template anchor (th:href="${bookmark.url()}") never outputs a
javascript: URL; ensure any exception is caught and a safe value is supplied to
the view.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 2f08d2cc-f18e-4825-822c-c143ed17147f
📒 Files selected for processing (5)
src/main/java/com/example/bookmark/BookmarkController.javasrc/main/java/com/example/bookmark/BookmarkRepository.javasrc/main/resources/static/styles.csssrc/main/resources/templates/edit.htmlsrc/main/resources/templates/index.html
fixes #3
Summary by CodeRabbit
リリースノート
新機能
スタイル