-
Notifications
You must be signed in to change notification settings - Fork 6
merge changes #123
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
merge changes #123
Conversation
| <label className="block text-sm font-medium text-gray-700 mb-2"> | ||
| Version Description | ||
| </label> | ||
| <textarea |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Mend Code Security Check
New finding (1 of 10)
The Mend Code Security Check of your branch failed because of a DOM Based Cross-Site Scripting finding in this line.
| Severity | Vulnerability Type | CWE | File | Data Flows | Detected | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DOM Based Cross-Site Scripting | 1 | 2025-09-15 08:49pm | |||||||||||||||||
| |||||||||||||||||||
| <div className="mb-6"> | |
| <label className="block text-sm font-medium text-gray-700 mb-2"> | |
| Version Description | |
| </label> | |
| <textarea |
1 Data Flow/s detected
| <textarea |
Secure Code Warrior Training Material
● Training
▪ Secure Code Warrior DOM Based Cross-Site Scripting Training
● Videos
🏴 Suppress Finding
- ... as False Alarm
- ... as Acceptable Risk
| <label className="block text-sm font-medium mb-2"> | ||
| Version Description | ||
| </label> | ||
| <textarea |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Mend Code Security Check
New finding (2 of 10)
The Mend Code Security Check of your branch failed because of a DOM Based Cross-Site Scripting finding in this line.
| Severity | Vulnerability Type | CWE | File | Data Flows | Detected | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DOM Based Cross-Site Scripting | 1 | 2025-09-15 08:49pm | |||||||||||||||||
| |||||||||||||||||||
| <div className="space-y-4"> | |
| <div> | |
| <label className="block text-sm font-medium mb-2"> | |
| Version Description | |
| </label> | |
| <textarea |
1 Data Flow/s detected
| <textarea |
Secure Code Warrior Training Material
● Training
▪ Secure Code Warrior DOM Based Cross-Site Scripting Training
● Videos
🏴 Suppress Finding
- ... as False Alarm
- ... as Acceptable Risk
| <label className="block text-sm font-medium mb-2"> | ||
| Draft Name | ||
| </label> | ||
| <Input |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Mend Code Security Check
New finding (3 of 10)
The Mend Code Security Check of your branch failed because of a DOM Based Cross-Site Scripting finding in this line.
| Severity | Vulnerability Type | CWE | File | Data Flows | Detected | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DOM Based Cross-Site Scripting | 1 | 2025-09-15 08:49pm | |||||||||||||||||
| |||||||||||||||||||
| <div className="space-y-4"> | |
| <div> | |
| <label className="block text-sm font-medium mb-2"> | |
| Draft Name | |
| </label> | |
| <Input |
1 Data Flow/s detected
| <Input |
Secure Code Warrior Training Material
● Training
▪ Secure Code Warrior DOM Based Cross-Site Scripting Training
● Videos
🏴 Suppress Finding
- ... as False Alarm
- ... as Acceptable Risk
| <label className="block text-sm font-medium text-gray-700 mb-2"> | ||
| Version Number | ||
| </label> | ||
| <input |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Mend Code Security Check
New finding (4 of 10)
The Mend Code Security Check of your branch failed because of a DOM Based Cross-Site Scripting finding in this line.
| Severity | Vulnerability Type | CWE | File | Data Flows | Detected | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DOM Based Cross-Site Scripting | 1 | 2025-09-15 08:49pm | |||||||||||||||||
| |||||||||||||||||||
| <div className="mb-6"> | |
| <label className="block text-sm font-medium text-gray-700 mb-2"> | |
| Version Number | |
| </label> | |
| <input |
1 Data Flow/s detected
| <input |
Secure Code Warrior Training Material
● Training
▪ Secure Code Warrior DOM Based Cross-Site Scripting Training
● Videos
🏴 Suppress Finding
- ... as False Alarm
- ... as Acceptable Risk
| Custom Version (e.g.,{" "} | ||
| {isDraft ? "1.0.0-rc1" : "1.0.0"}) | ||
| </label> | ||
| <input |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Mend Code Security Check
New finding (5 of 10)
The Mend Code Security Check of your branch failed because of a DOM Based Cross-Site Scripting finding in this line.
| Severity | Vulnerability Type | CWE | File | Data Flows | Detected | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DOM Based Cross-Site Scripting | 1 | 2025-09-15 08:49pm | |||||||||||||||||
| |||||||||||||||||||
| > | |
| <label className="block text-sm font-medium text-gray-700 mb-2"> | |
| Custom Version (e.g.,{" "} | |
| {isDraft ? "1.0.0-rc1" : "1.0.0"}) | |
| </label> | |
| <input |
1 Data Flow/s detected
| <input |
Secure Code Warrior Training Material
● Training
▪ Secure Code Warrior DOM Based Cross-Site Scripting Training
● Videos
🏴 Suppress Finding
- ... as False Alarm
- ... as Acceptable Risk
| <div className="mb-6 flex flex-col sm:flex-row gap-4 items-center justify-between"> | ||
| <div className="relative flex-1 max-w-sm"> | ||
| <Search className="absolute left-3 top-1/2 transform -translate-y-1/2 h-4 w-4 text-gray-400" /> | ||
| <input |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Mend Code Security Check
New finding (6 of 10)
The Mend Code Security Check of your branch failed because of a DOM Based Cross-Site Scripting finding in this line.
| Severity | Vulnerability Type | CWE | File | Data Flows | Detected | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DOM Based Cross-Site Scripting | 1 | 2025-09-15 08:49pm | |||||||||||||||||
| |||||||||||||||||||
| {/* Search and Filters */} | |
| <div className="mb-6 flex flex-col sm:flex-row gap-4 items-center justify-between"> | |
| <div className="relative flex-1 max-w-sm"> | |
| <Search className="absolute left-3 top-1/2 transform -translate-y-1/2 h-4 w-4 text-gray-400" /> | |
| <input |
1 Data Flow/s detected
| <input |
Secure Code Warrior Training Material
● Training
▪ Secure Code Warrior DOM Based Cross-Site Scripting Training
● Videos
🏴 Suppress Finding
- ... as False Alarm
- ... as Acceptable Risk
| await this.questionService.updateQuestionGradingContext(assignmentId); | ||
| } | ||
|
|
||
| await this.assignmentRepository.update(assignmentId, { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Mend Code Security Check
New finding (9 of 10)
The Mend Code Security Check of your branch failed because of a NoSQL Injection finding in this line.
| Severity | Vulnerability Type | CWE | File | Data Flows | Detected | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| NoSQL Injection | 2 | 2025-09-15 08:49pm | |||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||
| if (questionContentChanged || !existingAssignment.published) { | |
| await this.questionService.updateQuestionGradingContext(assignmentId); | |
| } | |
| await this.assignmentRepository.update(assignmentId, { |
2 Data Flow/s detected
View Data Flow 1
| async publishAssignment( |
| return this.assignmentService.publishAssignment( |
| async publishAssignment( |
| this.startPublishingProcess(job.id, assignmentId, updateDto, userId).catch( |
| private async startPublishingProcess( |
| await this.assignmentRepository.findById(assignmentId); |
| await this.assignmentRepository.update(assignmentId, { |
| await this.assignmentRepository.update(assignmentId, { |
View Data Flow 2
| async publishAssignment( |
| return this.assignmentService.publishAssignment( |
| async publishAssignment( |
| this.startPublishingProcess(job.id, assignmentId, updateDto, userId).catch( |
| private async startPublishingProcess( |
| published: updateDto.published, |
| await this.assignmentRepository.update(assignmentId, { |
Secure Code Warrior Training Material
● Training
▪ Secure Code Warrior NoSQL Injection Training
● Videos
🏴 Suppress Finding
- ... as False Alarm
- ... as Acceptable Risk
| } | ||
|
|
||
| if (cached) { | ||
| this.insightsCache.delete(cacheKey); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Mend Code Security Check
New finding (10 of 10)
The Mend Code Security Check of your branch failed because of a Server Side Request Forgery finding in this line.
| Severity | Vulnerability Type | CWE | File | Data Flows | Detected | ||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Server Side Request Forgery | 1 | 2025-09-15 08:49pm | |||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||
| this.logger.debug(`Cache hit for assignment ${assignmentId} insights`); | |
| return cached.data; | |
| } | |
| if (cached) { | |
| this.insightsCache.delete(cacheKey); |
1 Data Flow/s detected
| async getDetailedAssignmentInsights( |
| return await this.adminService.getDetailedAssignmentInsights( |
mark/apps/api/src/api/admin/admin.service.ts
Line 1600 in 0eb730e
| async getDetailedAssignmentInsights( |
mark/apps/api/src/api/admin/admin.service.ts
Line 1606 in 0eb730e
| const cachedInsights = this.getCachedInsights(assignmentId); |
| private getCachedInsights(assignmentId: number): any | null { |
| const cacheKey = `insights:${assignmentId}`; |
| this.insightsCache.delete(cacheKey); |
Secure Code Warrior Training Material
● Training
▪ Secure Code Warrior Server Side Request Forgery Training
● Videos
🏴 Suppress Finding
- ... as False Alarm
- ... as Acceptable Risk
* fix variation generation for true false question types with a nicer refactor * adding local github client id/secret * feat: Implement soft deletion for question variants, improve publishing workflow, and fix UI bugs - Added soft deletion for question variants to retain them in learner attempts when deleted. - Refactored the publishing workflow to: - Record assignment overview and configuration in the database when "Save & Publish" is pressed. - Reduce the number of API calls for improved efficiency and clarity. - Fixed bugs including: - Proper display of bullet points and ordered lists as set by the author. - Disabling the "Save & Publish" button when no changes are detected in the assignment. * fileupload-bug-fix * refactor: Update useFilteredAssignmentConfig to include questions This commit updates the useFilteredAssignmentConfig function in the filterAssignmentConfig.ts file. It adds the 'questions' property to the destructured object from the useAuthorStore hook. This change ensures that the 'questions' property is included in the returned ReplaceAssignmentRequest object. Ref: #123 * refactor: Update ReplaceAssignmentRequest to make questions optional * fixing report type issue with OTHER * refactor: Update fetchRepoContents to handle errors and set owner name - Refactored the fetchRepoContents function in GithubUploadModal.tsx to handle errors when fetching repository contents and set the owner name correctly. - Added error handling for failed repository content loading. * fix tool tip positioning * Mark language integration (#756) * fix ugly scrollbars by removing them haha * new mark translation feature * Add translation capability to AI usage type enum * Refactor language integration and translation logic * it checks over the assignment configuration and intro before enabling the submit button * remove console.log * Refactor TipsView and QuestionPage components so that if the version matches, it shows the tips. If the learner chose to not see it again, it will be toggled off until a new version is out * fix github organization file save bug * making learner side responsive * fix name issue
* fix variation generation for true false question types with a nicer refactor * adding local github client id/secret * feat: Implement soft deletion for question variants, improve publishing workflow, and fix UI bugs - Added soft deletion for question variants to retain them in learner attempts when deleted. - Refactored the publishing workflow to: - Record assignment overview and configuration in the database when "Save & Publish" is pressed. - Reduce the number of API calls for improved efficiency and clarity. - Fixed bugs including: - Proper display of bullet points and ordered lists as set by the author. - Disabling the "Save & Publish" button when no changes are detected in the assignment. * fileupload-bug-fix * refactor: Update useFilteredAssignmentConfig to include questions This commit updates the useFilteredAssignmentConfig function in the filterAssignmentConfig.ts file. It adds the 'questions' property to the destructured object from the useAuthorStore hook. This change ensures that the 'questions' property is included in the returned ReplaceAssignmentRequest object. Ref: #123 * refactor: Update ReplaceAssignmentRequest to make questions optional * fixing report type issue with OTHER * refactor: Update fetchRepoContents to handle errors and set owner name - Refactored the fetchRepoContents function in GithubUploadModal.tsx to handle errors when fetching repository contents and set the owner name correctly. - Added error handling for failed repository content loading. * fix tool tip positioning * Mark language integration (#756) * fix ugly scrollbars by removing them haha * new mark translation feature * Add translation capability to AI usage type enum * Refactor language integration and translation logic * it checks over the assignment configuration and intro before enabling the submit button * remove console.log * initial attempt of fully translating assignments * fully translated assignment version 1 * linting * fix bugs with variants * linting and formating * some final touches with tiny bug fixes and ui adjustments. Fixed the way progress bar looks and the percentage it gets to make it linear * fix tests * fix submit button * refactor(api): improve error handling and agent selection in ApiService * linting and fixing some minor bugs * minor adjustments to ensure that older assignments with no language translation is not broken * file name change * change file name (#870) * update yarn.lock * commenting not so useful code and fix a build issue with jwt.cookie.strategy * Install build dependencies required to compile native modules. * Install build dependencies required to compile native modules. * restoring back old jwt cookie strat * restoring back old jwt cookie strat * restoring back old jwt cookie strat * small patch * Refactor API controller to use UserSessionRequest instead of Request for handling API requests * Refactor ApiService constructor and methods * Refactor ApiService constructor and methods * Refactor ApiService constructor and methods * Refactor AuthFetchToAbout component to improve data fetching and decoding This commit refactors the AuthFetchToAbout component in the learner/[assignmentId] directory. It improves the data fetching process by using async/await and Promise.all to fetch assignment and attempts data. It also adds decoding of assignment fields to handle special characters and improve readability. * Refactor ApiController and ApiService to work on skills network platform (test) * testing out this change * Refactor ApiController and ApiService to improve logging and error handling * Refactor ApiController and ApiService to improve logging and error handling * fix problems with publishing assignments * some bug fixes with publishing and translating the assignments and its questions * Authors are not required to pick languages as they should be testing the assignment using the original language that they wrote
PR Description
Overview:
Type of Issue:
feat): New functionality or feature added.bug): Issue or bug resolved.chore): Maintenance, refactoring, or non-functional changes.doc): Documentation improvements or additions.Change Type:
Testing & Validation:
Purpose:
Context:
Basic Usage:
Notes to Reviewer: