Skip to content

Conversation

@MmagdyHafezZ
Copy link
Collaborator

PR Description

Overview:

Type of Issue:

  • Feature (feat): New functionality or feature added.
  • Bug Fix (bug): Issue or bug resolved.
  • Chore (chore): Maintenance, refactoring, or non-functional changes.
  • Documentation Update (doc): Documentation improvements or additions.

Change Type:

  • Major: Significant changes that introduce new features, large refactoring, or breaking changes. Requires thorough review and testing.
  • Minor: Small to medium changes, such as adding new functionality that is backward-compatible or minor refactoring. Moderate review needed.
  • Patch: Bug fixes, small tweaks, or documentation updates. Light review is sufficient.

Testing & Validation:

  • Unit Tests: Added/updated to cover new logic or edge cases.
  • Integration Tests: Updated to verify interactions between components.
  • E2E Tests: Performed end-to-end testing in staging or development environment.
  • Manual Testing: The changes were manually tested and validated.
  • No Regressions: Verified that no existing functionality is broken.

Purpose:

Context:

Basic Usage:

Notes to Reviewer:

<label className="block text-sm font-medium text-gray-700 mb-2">
Version Description
</label>
<textarea
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mend Code Security Check

New finding (1 of 10)

The Mend Code Security Check of your branch failed because of a DOM Based Cross-Site Scripting finding in this line.

SeverityVulnerability TypeCWEFileData FlowsDetected
HighDOM Based Cross-Site Scripting

CWE-79

VersionSelectionModal.tsx:767

12025-09-15 08:49pm
Vulnerable Code

<div className="mb-6">
<label className="block text-sm font-medium text-gray-700 mb-2">
Version Description
</label>
<textarea

1 Data Flow/s detected

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior DOM Based Cross-Site Scripting Training

● Videos

   ▪ Secure Code Warrior DOM Based Cross-Site Scripting Video

🏴 Suppress Finding
  • ... as False Alarm
  • ... as Acceptable Risk

<label className="block text-sm font-medium mb-2">
Version Description
</label>
<textarea
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mend Code Security Check

New finding (2 of 10)

The Mend Code Security Check of your branch failed because of a DOM Based Cross-Site Scripting finding in this line.

SeverityVulnerability TypeCWEFileData FlowsDetected
HighDOM Based Cross-Site Scripting

CWE-79

VersionControlTab.tsx:427

12025-09-15 08:49pm
Vulnerable Code

<div className="space-y-4">
<div>
<label className="block text-sm font-medium mb-2">
Version Description
</label>
<textarea

1 Data Flow/s detected

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior DOM Based Cross-Site Scripting Training

● Videos

   ▪ Secure Code Warrior DOM Based Cross-Site Scripting Video

🏴 Suppress Finding
  • ... as False Alarm
  • ... as Acceptable Risk

<label className="block text-sm font-medium mb-2">
Draft Name
</label>
<Input
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mend Code Security Check

New finding (3 of 10)

The Mend Code Security Check of your branch failed because of a DOM Based Cross-Site Scripting finding in this line.

SeverityVulnerability TypeCWEFileData FlowsDetected
HighDOM Based Cross-Site Scripting

CWE-79

VersionControlTab.tsx:465

12025-09-15 08:49pm
Vulnerable Code

<div className="space-y-4">
<div>
<label className="block text-sm font-medium mb-2">
Draft Name
</label>
<Input

1 Data Flow/s detected

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior DOM Based Cross-Site Scripting Training

● Videos

   ▪ Secure Code Warrior DOM Based Cross-Site Scripting Video

🏴 Suppress Finding
  • ... as False Alarm
  • ... as Acceptable Risk

<label className="block text-sm font-medium text-gray-700 mb-2">
Version Number
</label>
<input
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mend Code Security Check

New finding (4 of 10)

The Mend Code Security Check of your branch failed because of a DOM Based Cross-Site Scripting finding in this line.

SeverityVulnerability TypeCWEFileData FlowsDetected
HighDOM Based Cross-Site Scripting

CWE-79

VersionTreeView.tsx:1780

12025-09-15 08:49pm
Vulnerable Code

<div className="mb-6">
<label className="block text-sm font-medium text-gray-700 mb-2">
Version Number
</label>
<input

1 Data Flow/s detected

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior DOM Based Cross-Site Scripting Training

● Videos

   ▪ Secure Code Warrior DOM Based Cross-Site Scripting Video

🏴 Suppress Finding
  • ... as False Alarm
  • ... as Acceptable Risk

Custom Version (e.g.,{" "}
{isDraft ? "1.0.0-rc1" : "1.0.0"})
</label>
<input
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mend Code Security Check

New finding (5 of 10)

The Mend Code Security Check of your branch failed because of a DOM Based Cross-Site Scripting finding in this line.

SeverityVulnerability TypeCWEFileData FlowsDetected
HighDOM Based Cross-Site Scripting

CWE-79

VersionSelectionModal.tsx:748

12025-09-15 08:49pm
Vulnerable Code

>
<label className="block text-sm font-medium text-gray-700 mb-2">
Custom Version (e.g.,{" "}
{isDraft ? "1.0.0-rc1" : "1.0.0"})
</label>
<input

1 Data Flow/s detected

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior DOM Based Cross-Site Scripting Training

● Videos

   ▪ Secure Code Warrior DOM Based Cross-Site Scripting Video

🏴 Suppress Finding
  • ... as False Alarm
  • ... as Acceptable Risk

<div className="mb-6 flex flex-col sm:flex-row gap-4 items-center justify-between">
<div className="relative flex-1 max-w-sm">
<Search className="absolute left-3 top-1/2 transform -translate-y-1/2 h-4 w-4 text-gray-400" />
<input
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mend Code Security Check

New finding (6 of 10)

The Mend Code Security Check of your branch failed because of a DOM Based Cross-Site Scripting finding in this line.

SeverityVulnerability TypeCWEFileData FlowsDetected
HighDOM Based Cross-Site Scripting

CWE-79

VersionTreeView.tsx:901

12025-09-15 08:49pm
Vulnerable Code

{/* Search and Filters */}
<div className="mb-6 flex flex-col sm:flex-row gap-4 items-center justify-between">
<div className="relative flex-1 max-w-sm">
<Search className="absolute left-3 top-1/2 transform -translate-y-1/2 h-4 w-4 text-gray-400" />
<input

1 Data Flow/s detected

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior DOM Based Cross-Site Scripting Training

● Videos

   ▪ Secure Code Warrior DOM Based Cross-Site Scripting Video

🏴 Suppress Finding
  • ... as False Alarm
  • ... as Acceptable Risk

await this.questionService.updateQuestionGradingContext(assignmentId);
}

await this.assignmentRepository.update(assignmentId, {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mend Code Security Check

New finding (9 of 10)

The Mend Code Security Check of your branch failed because of a NoSQL Injection finding in this line.

SeverityVulnerability TypeCWEFileData FlowsDetected
HighNoSQL Injection

CWE-943

assignment.service.ts:453

22025-09-15 08:49pm
Vulnerable Code

if (questionContentChanged || !existingAssignment.published) {
await this.questionService.updateQuestionGradingContext(assignmentId);
}
await this.assignmentRepository.update(assignmentId, {

2 Data Flow/s detected
View Data Flow 1

return this.assignmentService.publishAssignment(

this.startPublishingProcess(job.id, assignmentId, updateDto, userId).catch(

private async startPublishingProcess(

await this.assignmentRepository.findById(assignmentId);

await this.assignmentRepository.update(assignmentId, {

await this.assignmentRepository.update(assignmentId, {

View Data Flow 2

return this.assignmentService.publishAssignment(

this.startPublishingProcess(job.id, assignmentId, updateDto, userId).catch(

private async startPublishingProcess(

await this.assignmentRepository.update(assignmentId, {

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior NoSQL Injection Training

● Videos

   ▪ Secure Code Warrior NoSQL Injection Video

🏴 Suppress Finding
  • ... as False Alarm
  • ... as Acceptable Risk

}

if (cached) {
this.insightsCache.delete(cacheKey);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mend Code Security Check

New finding (10 of 10)

The Mend Code Security Check of your branch failed because of a Server Side Request Forgery finding in this line.

SeverityVulnerability TypeCWEFileData FlowsDetected
HighServer Side Request Forgery

CWE-918

admin.service.ts:60

12025-09-15 08:49pm
Vulnerable Code

this.logger.debug(`Cache hit for assignment ${assignmentId} insights`);
return cached.data;
}
if (cached) {
this.insightsCache.delete(cacheKey);

1 Data Flow/s detected

async getDetailedAssignmentInsights(

return await this.adminService.getDetailedAssignmentInsights(

async getDetailedAssignmentInsights(

const cachedInsights = this.getCachedInsights(assignmentId);

private getCachedInsights(assignmentId: number): any | null {

const cacheKey = `insights:${assignmentId}`;

this.insightsCache.delete(cacheKey);

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Server Side Request Forgery Training

● Videos

   ▪ Secure Code Warrior Server Side Request Forgery Video

🏴 Suppress Finding
  • ... as False Alarm
  • ... as Acceptable Risk

@MmagdyHafezZ MmagdyHafezZ merged commit c90add4 into master Sep 15, 2025
11 of 12 checks passed
@MmagdyHafezZ MmagdyHafezZ deleted the mig/sync-repo branch September 15, 2025 20:53
MmagdyHafezZ added a commit that referenced this pull request Sep 19, 2025
* fix variation generation for true false question types with a nicer refactor

* adding local github client id/secret

* feat: Implement soft deletion for question variants, improve publishing workflow, and fix UI bugs

- Added soft deletion for question variants to retain them in learner attempts when deleted.
- Refactored the publishing workflow to:
  - Record assignment overview and configuration in the database when "Save & Publish" is pressed.
  - Reduce the number of API calls for improved efficiency and clarity.
- Fixed bugs including:
  - Proper display of bullet points and ordered lists as set by the author.
  - Disabling the "Save & Publish" button when no changes are detected in the assignment.

* fileupload-bug-fix

* refactor: Update useFilteredAssignmentConfig to include questions

This commit updates the useFilteredAssignmentConfig function in the filterAssignmentConfig.ts file. It adds the 'questions' property to the destructured object from the useAuthorStore hook. This change ensures that the 'questions' property is included in the returned ReplaceAssignmentRequest object.

Ref: #123

* refactor: Update ReplaceAssignmentRequest to make questions optional

* fixing report type issue with OTHER

* refactor: Update fetchRepoContents to handle errors and set owner name

- Refactored the fetchRepoContents function in GithubUploadModal.tsx to handle errors when fetching repository contents and set the owner name correctly.
- Added error handling for failed repository content loading.

* fix tool tip positioning

* Mark language integration (#756)

* fix ugly scrollbars by removing them haha

* new mark translation feature

* Add translation capability to AI usage type enum

* Refactor language integration and translation logic

* it checks over the assignment configuration and intro before enabling the submit button

* remove console.log

* Refactor TipsView and QuestionPage components so that if the version matches, it shows the tips. If the learner chose to not see it again, it will be toggled off until a new version is out

* fix github organization file save bug

* making learner side responsive

* fix name issue
MmagdyHafezZ added a commit that referenced this pull request Sep 19, 2025
* fix variation generation for true false question types with a nicer refactor

* adding local github client id/secret

* feat: Implement soft deletion for question variants, improve publishing workflow, and fix UI bugs

- Added soft deletion for question variants to retain them in learner attempts when deleted.
- Refactored the publishing workflow to:
  - Record assignment overview and configuration in the database when "Save & Publish" is pressed.
  - Reduce the number of API calls for improved efficiency and clarity.
- Fixed bugs including:
  - Proper display of bullet points and ordered lists as set by the author.
  - Disabling the "Save & Publish" button when no changes are detected in the assignment.

* fileupload-bug-fix

* refactor: Update useFilteredAssignmentConfig to include questions

This commit updates the useFilteredAssignmentConfig function in the filterAssignmentConfig.ts file. It adds the 'questions' property to the destructured object from the useAuthorStore hook. This change ensures that the 'questions' property is included in the returned ReplaceAssignmentRequest object.

Ref: #123

* refactor: Update ReplaceAssignmentRequest to make questions optional

* fixing report type issue with OTHER

* refactor: Update fetchRepoContents to handle errors and set owner name

- Refactored the fetchRepoContents function in GithubUploadModal.tsx to handle errors when fetching repository contents and set the owner name correctly.
- Added error handling for failed repository content loading.

* fix tool tip positioning

* Mark language integration (#756)

* fix ugly scrollbars by removing them haha

* new mark translation feature

* Add translation capability to AI usage type enum

* Refactor language integration and translation logic

* it checks over the assignment configuration and intro before enabling the submit button

* remove console.log

* initial attempt of fully translating assignments

* fully translated assignment version 1

* linting

* fix bugs with variants

* linting and formating

* some final touches with tiny bug fixes and ui adjustments. Fixed the way progress bar looks and the percentage it gets to make it linear

* fix tests

* fix submit button

* refactor(api): improve error handling and agent selection in ApiService

* linting and fixing some minor bugs

* minor adjustments to ensure that older assignments with no language translation is not broken

* file name change

* change file name (#870)

* update yarn.lock

* commenting not so useful code and fix a build issue with jwt.cookie.strategy

* Install build dependencies required to compile native modules.

* Install build dependencies required to compile native modules.

* restoring back old jwt cookie strat

* restoring back old jwt cookie strat

* restoring back old jwt cookie strat

* small patch

* Refactor API controller to use UserSessionRequest instead of Request for handling API requests

* Refactor ApiService constructor and methods

* Refactor ApiService constructor and methods

* Refactor ApiService constructor and methods

* Refactor AuthFetchToAbout component to improve data fetching and decoding

This commit refactors the AuthFetchToAbout component in the learner/[assignmentId] directory. It improves the data fetching process by using async/await and Promise.all to fetch assignment and attempts data. It also adds decoding of assignment fields to handle special characters and improve readability.

* Refactor ApiController and ApiService to work on skills network platform (test)

* testing out this change

* Refactor ApiController and ApiService to improve logging and error handling

* Refactor ApiController and ApiService to improve logging and error handling

* fix problems with publishing assignments

* some bug fixes with publishing and translating the assignments and its questions

* Authors are not required to pick languages as they should be testing the assignment using the original language that they wrote
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant