Issue 1426 - Source validation on the claim form #1428

lucaslobatob · 2024-10-29T12:34:53Z

Description

BaseClaimForm.tsx: Creating source validation on the claim form

Type of change

Please delete options that are not relevant.

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Existing feature enhancement (non-breaking change which modifies existing functionality)

Testing

When placing an invalid source in the claim creation form, the form is not created and remains on the page until it has a valid source.
First test: Tested with one source valid, the user can send the form and create claim
Second test: Tested with one source valid and one source invalid, the user is unable to proceed with the creation of a claim, as it has an invalid source and the feedback: "A fonte não está mais disponível"
Third test: Tested with one source invalid, the user is unable to proceed with the creation of a claim, as it has an invalid source and the feedback: "A fonte não está mais disponível"

Developer Checklist

General

Code is appropriately commented, particularly in hard-to-understand areas
Repository documentation has been updated (Readme.md) with additional steps required for a local environment setup.
No console.log or related logging is added.
No code is repeated/duplicated in violation of DRY. The exception to this is for new (MVP/Prototype) functionality where the abstraction layer may not be clear (comments should be added to explain the violation of DRY in these scenarios).
Documented with TSDoc all library and controller new functions

Frontend Changes

No new styling is added through CSS files (Unless it's a bugfix/hotfix)
All types are added correctly

Tests

All existing unit and end to end tests pass across all services
Unit and end to end tests have been added to ensure backend APIs behave as expected

Merge Request Review Checklist

An issue is linked to this PR and these changes meet the requirements outlined in the linked issue(s)
High risk and core workflows have been tested and verified in a local environment.
Enhancements or opportunities to improve performance, stability, security or code readability have been noted and documented in JIRA issues if not being addressed.
Any dependent changes have been merged and published in downstream modules
Changes to multiple services can be deployed in parallel and independently. If not, changes should be broken out into separate merge requests and deployed in order.

…making a GET request. - Backend: Created new route /api/source/check-source to handle URL validation and return link status. - Frontend: Updated ClaimSourceListItem component to call API for link verification and handle valid/invalid links.

… a GET request

…nd return link status.

…ion, handle valid/invalid links and created message feedback for user

server/source/source.controller.ts

thesocialdev · 2024-11-12T13:07:07Z

@lucaslobatob cypress tests are failing after this changes

thesocialdev · 2024-11-12T13:10:12Z

server/source/source.controller.ts

@@ -103,6 +103,23 @@ export class SourceController {
        );
    }

+    @ApiTags("source")
+    @Get("/check-source")


issue(blocking): now that I'm thinking, this is a DDOS vector and we should not continue. We can consider a few options like putting this behind RBAC for logged-in users.

But why aren't we just requesting from the client-side? Why we need to create a new endpoint for this?

The endpoint was needed because of CORS restrictions, many sources block client-side requests. After, I can look with @lucaslobatob at some ways to make it more secure.

I'm still not satisfied with the current solution, there are still too many vulnerabilities. Let's sync and create an epic documentation before proceeding.

thesocialdev · 2024-11-12T13:10:27Z

server/source/source.controller.ts

@@ -103,6 +103,23 @@ export class SourceController {
        );
    }

+    @ApiTags("source")
+    @Get("/check-source")
+    async checkSpurce(@Query() query) {


nitpick: typo

…egular User Ability for permissions control

…the provided URL

server/source/source.service.ts

… API to check the validity of a URL before opening it

sonarqubecloud · 2024-11-21T15:40:17Z

Quality Gate passed

Issues
6 New issues
0 Accepted issues

Measures
0 Security Hotspots
9.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

thesocialdev · 2024-12-15T09:26:14Z

server/claim/claim.controller.ts

@@ -142,7 +142,7 @@ export class ClaimController {
                        : path,
            };
        } catch (error) {
-            return error;


issue: if you're doing this the try/catch is not needed.

thesocialdev · 2024-12-15T09:35:03Z

server/source/source.controller.ts

+    @ApiTags("source")
+    @Get("/check-source")
+    @UseGuards(AbilitiesGuard)
+    @CheckAbilities(new RegularUserAbility())


issue: this should be a FactChecker, regular users can't create resource anyway.

thesocialdev · 2024-12-15T09:35:42Z

server/source/source.controller.ts

@@ -103,6 +103,23 @@ export class SourceController {
        );
    }

+    @ApiTags("source")
+    @Get("/check-source")


I'm still not satisfied with the current solution, there are still too many vulnerabilities. Let's sync and create an epic documentation before proceeding.

lucaslobatob added 6 commits October 21, 2024 11:16

Added checkSource method to validate URLs before redirection bymaking…

3cf4be9

… a GET request

Created new route /api/source/check-source to handle URL validation a…

1ba2275

…nd return link status.

Updated ClaimSource ListItem component to call API for link verificat…

d0b7ede

…ion, handle valid/invalid links and created message feedback for user

Created message feedback for user

4211940

Creating source validation on the claim form

8d1459e

lucaslobatob requested a review from thesocialdev as a code owner October 29, 2024 12:34

github-advanced-security bot found potential problems Oct 29, 2024

View reviewed changes

server/source/source.controller.ts Fixed Show fixed Hide fixed

thesocialdev force-pushed the stage branch 6 times, most recently from 05f8912 to 864c35e Compare November 7, 2024 18:27

thesocialdev reviewed Nov 12, 2024

View reviewed changes

thesocialdev requested changes Nov 12, 2024

View reviewed changes

thesocialdev mentioned this pull request Nov 12, 2024

issues1396 - Bug Invalid Url #1420

Closed

17 tasks

lucaslobatob added 2 commits November 21, 2024 12:22

Implemented @UseGuards with AbilitiesGuard and @CheckAbilities with R…

f7ee409

…egular User Ability for permissions control

Added the checkSource method that performs a GET request to validate …

2771679

…the provided URL

github-advanced-security bot found potential problems Nov 21, 2024

View reviewed changes

server/source/source.service.ts Dismissed Show dismissed Hide dismissed

Maintained the checkLink method that uses the Source Api.check Source…

5188f1d

… API to check the validity of a URL before opening it

thesocialdev reviewed Dec 15, 2024

View reviewed changes

thesocialdev requested changes Dec 15, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Issue 1426 - Source validation on the claim form #1428

Issue 1426 - Source validation on the claim form #1428

lucaslobatob commented Oct 29, 2024

thesocialdev commented Nov 12, 2024

thesocialdev Nov 12, 2024

caneppelevitor Nov 13, 2024

thesocialdev Dec 15, 2024

thesocialdev Nov 12, 2024

sonarqubecloud bot commented Nov 21, 2024

thesocialdev Dec 15, 2024

thesocialdev Dec 15, 2024

thesocialdev Dec 15, 2024

Issue 1426 - Source validation on the claim form #1428

Are you sure you want to change the base?

Issue 1426 - Source validation on the claim form #1428

Conversation

lucaslobatob commented Oct 29, 2024

Description

Type of change

Testing

Developer Checklist

General

Frontend Changes

Tests

Merge Request Review Checklist

thesocialdev commented Nov 12, 2024

thesocialdev Nov 12, 2024

Choose a reason for hiding this comment

caneppelevitor Nov 13, 2024

Choose a reason for hiding this comment

thesocialdev Dec 15, 2024

Choose a reason for hiding this comment

thesocialdev Nov 12, 2024

Choose a reason for hiding this comment

sonarqubecloud bot commented Nov 21, 2024

Quality Gate passed

thesocialdev Dec 15, 2024

Choose a reason for hiding this comment

thesocialdev Dec 15, 2024

Choose a reason for hiding this comment

thesocialdev Dec 15, 2024

Choose a reason for hiding this comment